Ep2: Securing Logins with Two-Factor Authentication

Marc: 00:00:33

Welcome back to the bite-size security podcast.

Marc: 00:00:36

Your source for practical cybersecurity advice.

Marc: 00:00:39

I'm your host, Marc David.

Marc: 00:00:41

With new account breaches in the news weekly it's clear, relying

Marc: 00:00:44

on passwords alone is not enough to protect our online identities.

Marc: 00:00:48

That's why today I'll be talking with returning expert Nancy Doe about

Marc: 00:00:52

how two factor authentication takes login security to the next level.

Marc: 00:00:57

Stay tuned to learn how to factor authentication works.

Marc: 00:01:01

And simple ways to start using it.

Marc: 00:01:03

In your important accounts.

Marc: 00:01:05

Nancy.

Marc: 00:01:06

Thanks for joining me again.

Nancy: 00:01:08

Happy to be here.

Nancy: 00:01:09

It's such a pleasure talking Information Security that hopefully

Nancy: 00:01:12

makes a difference in somebody's life who's out there listening.

Marc: 00:01:15

To start off can you explain what two factor authentication is?

Nancy: 00:01:19

Sure.

Nancy: 00:01:20

Two-factor authentication, or 2FA, is a method for confirming a user's identity

Nancy: 00:01:24

that requires two different forms of evidence before granting access.

Nancy: 00:01:28

Typically this involves something you know, like a password,

Nancy: 00:01:31

along with something you have, like a generated code from an

Nancy: 00:01:33

authentication app or a security key.

Nancy: 00:01:36

Requiring both factors verifies the person signing in is who they claim to be..

Marc: 00:01:40

So adding that second factor definitely seems more secure

Marc: 00:01:43

than relying on passwords alone.

Marc: 00:01:45

Walk us through what two factor authentication looks like in practice

Nancy: 00:01:48

Definitely.

Nancy: 00:01:49

Let's say you want to log into your email.

Nancy: 00:01:51

You enter your username and password as usual - that's the

Nancy: 00:01:54

first “what you know” factor.

Nancy: 00:01:55

But instead of immediately getting into your account, you'll then be

Nancy: 00:01:58

prompted for the second factor.

Nancy: 00:01:59

This could be a 6-digit one-time code generated from an authentication

Nancy: 00:02:03

app you've installed on your phone, like Authy or Google Authenticator.

Nancy: 00:02:06

You open the app, grab the current code, and enter it to complete login.

Marc: 00:02:10

And that unique code changes continually so it can't

Marc: 00:02:13

be reused what other options are there for the second factor?

Nancy: 00:02:17

Right, it's a one-time code just for that session.

Nancy: 00:02:20

Other options include getting the code texted to your phone, using a hardware

Nancy: 00:02:23

security key that plugs into your computer, or tapping a notification

Nancy: 00:02:27

on your phone to approve the sign-in.

Nancy: 00:02:29

The key is requiring something in addition to your static password.

Marc: 00:02:33

Definitely more secure what are the main benefits

Marc: 00:02:35

companies and users get from 2FA?

Nancy: 00:02:39

There are a few big upsides.

Nancy: 00:02:40

It blocks hackers and thieves who manage to steal a password, since they won't

Nancy: 00:02:44

have the second factor to complete access.

Nancy: 00:02:46

It prevents automated bots from breaching accounts using

Nancy: 00:02:49

lists of leaked credentials.

Nancy: 00:02:50

It alerts you to login attempts from unknown devices.

Nancy: 00:02:53

And it gives users peace of mind knowing their accounts have extra protection.

Nancy: 00:02:56

Enabling 2FA is one of the top steps companies and individuals

Nancy: 00:02:59

can take to improve login security.

Marc: 00:03:02

Are there any downsides to be aware of?

Nancy: 00:03:05

There's a small amount of additional friction since you

Nancy: 00:03:07

need both factors to sign in.

Nancy: 00:03:09

Occasionally the Two-Factor Authenication code can expire on

Nancy: 00:03:12

your phone before entering it.

Nancy: 00:03:13

You also want to make sure you don't lose access to your second factor.

Nancy: 00:03:16

But overall the added security far outweighs these minor inconveniences.

Marc: 00:03:20

What advice do you have for listeners looking to start using 2FA?

Marc: 00:03:25

Should they enable it everywhere

Nancy: 00:03:26

I would recommend starting by enabling 2FA on accounts where a

Nancy: 00:03:29

breach would be most damaging - like email, banking, and social media.

Nancy: 00:03:33

Also use it for any sites that store your financial data or sensitive information.

Nancy: 00:03:37

From there, you can expand to other logins as well.

Nancy: 00:03:39

As for which method to use, authentication apps tend to be the

Nancy: 00:03:42

most secure and convenient option.

Nancy: 00:03:44

A great start is the 2 Factor Directory at two f a dot directory.

Nancy: 00:03:48

This website shows different categories of web sites that can support 2FA.

Nancy: 00:03:52

If 2 factor can be enabled and then step by step instructions on how to enable

Nancy: 00:03:55

2 factor authentication for each site.

Nancy: 00:03:58

It's absolutely one to visit and bookmark.

Nancy: 00:04:00

Check the show notes for a link to this site.

Marc: 00:04:03

If someone is nervous about getting locked out if they lose

Marc: 00:04:06

a device what's the solution?

Nancy: 00:04:09

Excellent point.

Nancy: 00:04:10

It's smart to set up backup Two-Factor Authenication methods you can use

Nancy: 00:04:13

to recover access, like printing out one-time use backup codes or setting

Nancy: 00:04:17

up a secondary authentication app.

Nancy: 00:04:19

And confirm that account recovery options like phone numbers are up-to-date.

Nancy: 00:04:23

But the small risk of temporary lockout is still far preferable

Nancy: 00:04:26

to the huge risk of a breach.

Marc: 00:04:28

Great overview of how to smartly implement to 2FA.

Marc: 00:04:31

Before we wrap up what emerging authentication trends are on the horizon?

Nancy: 00:04:36

Biometrics like fingerprint, face, or iris scanning offer a convenient second

Nancy: 00:04:40

factor tied to a physical characteristic.

Nancy: 00:04:42

Security keys that confirm logins after tapping them are also growing in use.

Nancy: 00:04:46

And passwordless methods like sending a link or code to your phone

Nancy: 00:04:49

could complement 2FA in the future.

Nancy: 00:04:51

But for most purposes right now, standard 2FA is a huge step up in account security.

Marc: 00:04:56

Excellent advice for listeners looking to lock down their online

Marc: 00:04:59

accounts thank you nancy for shedding light on two factor authentication!

Nancy: 00:05:04

My pleasure Marc.

Marc: 00:05:06

Thanks for joining us for this episode, explaining the

Marc: 00:05:08

power of two factor authentication to block unauthorized access.

Marc: 00:05:12

Enable two factor authentication, on important logins for

Marc: 00:05:15

serious peace of mind.

Marc: 00:05:17

Visit bite-size security.show to learn more ways to boost your online security.