Skip to main content

Not sure what two-factor authentication is? We're here to help

What 2FA is, why it's important, and why you should use it.

You see a lot of talk on the internet about two-factor authentication (or 2FA as it's commonly called), and most of the time, you just see people like us telling you to use it.

We'll continue that trend and start this guide by telling you to use 2FA whenever and wherever you can. However, we're also going to let you know what it is and why you must use it. Ready to learn more? Read on.

Lock it down

Yubico Yubikey 5 NFC

$45 at Amazon

Keep your accounts extra safe with a physical 2FA key

Everyone should be using two-factor authentication (yes, you!), and one of the best ways to start is with the Yubico Security Key. This USB key fits in any USB-A port and securely saves 2FA login codes for your Google, Facebook, Dropbox, and other online accounts. It's also extremely durable and can be attached to a key ring for easy transportation.

Jump to:

What is two-factor authentication?

To put it in simple terms, two-factor authentication (2FA) means that you need to present two different things from two different sources that prove who you are. Generally, three different ID types can be used for 2FA purposes when it comes to online accounts:

  • A thing that only you should know. A password, PIN, account number, your street address, or even the last four digits of your Social Security number fit the bill here.
  • A thing that you can hold in your hands. This means your phone, an authenticator fob, or a USB security key.
  • A thing that is part of you, like your fingerprint, retina pattern, or voice pattern.

When you have 2FA enabled on an account, you need two of these three things to get access.

You've been using 2FA all along and probably didn't realize it.

You've been using 2FA for most of your adult life. The companies who process credit card payments for online retailers usually force you to enter the three-digit code on the back of your credit card as well as the card number, then need you to provide the billing address. The numbers on the card (both front and back) are a way to make sure you have the card in your possession for the first method of authentication, then the address you provide has to match what the card issuer has on file as a second way to prove who you are. That's 2FA.

Back when the world still used checks to pay for things, most businesses wanted two forms of physical ID from a well-recognized place like your state DMV or school as a way to make sure you are the person whose name is on the top of the check. That's also 2FA. Plus, to get those IDs usually requires multiple things from different places to prove who you are.

Using 2FA for your online accounts is a little bit different but still uses the same principle — if you can provide more than one method to prove who you are, you probably are who you claim to be. For an account like Google, Facebook, or Amazon, you need to supply a password. Your password is something only you should know, but sometimes other people can get hold of it. When you add a 2FA requirement — like an authentication token sent to your phone or a something like the Google Titan security key you plug into your computer — a password is no longer enough to get into your account. Without both pieces of authentication, you're locked out.

Do I still need a strong password if I use two-factor authentication?

With all the various online services at your disposal, it's important to have a unique password for every single one of them. Duplicate passwords open you up to being potentially hacked in the event that someone gets ahold of one password and then tries to use it at different sites. It's impossible to keep all of your passwords stored in your memory, and that's where password managers come in.

The great thing is that password managers have evolved so much that many of them offer additional features that are not only useful but continue to keep your information confidential. For example, 1Password is currently our favorite password manager due to its ease-of-use. But the app can also act as a 2FA authenticator after everything has been set up. The code refreshes on a regular basis and is much more secure than relying on SMS messages for authentication.

Password managers are great tools for ensuring you have a lengthy and unique password for all of your online accounts, but a strong password isn't a good enough excuse to ignore two-factor authentication and not use it. Just about any password can be hacked if someone is persistent enough and has the right amount of computing power, but bypassing 2FA through a dedicated app or security key is virtually impossible unless you have access to that physical device.

As such, it goes both ways. Just because you use two-factor authentication, you should still have a strong password. Similarly, you still need to use two-factor authentication even though you have (what you think is) an un-hackable password.

Is two-factor authentication secure?

Yes and no. Using 2FA on an account is a lot more secure than not using it, but nothing is perfectly secure. That scary thought aside, using 2FA is usually sufficient protection for your "stuff" unless you're a high-profile target or really unlucky.

Using 2FA is usually sufficient protection for your online accounts and services.

On the positive side, if you're using 2FA and some fake phishing email manages to get you to supply your password, they still can't log into your account. The way most people use 2FA for online accounts is to have a token sent to an app on their Android phones, and without that token, the email scammer isn't going to have any luck getting access. They will enter your account user name or ID, then the password, and then they need to supply that token to go any further. Unless they have your phone, the work involved in bypassing the second ID requirement is enough to get the bad guy to say "forget it!" and move to someone else.

On the other hand, if you're someone like the President or Mick Jagger, people are going to want to get into your accounts, and there are ways. The communication between the people supplying the authentication token and your phone is safe for the most part, so attackers go after the website or server asking for the credentials. Very clever folks can hijack auth tokens and cookies, and as soon as one method gets patched, they start looking for another. This takes a lot of knowledge and hard work, which means that the result has to be worth it all. Chances are you and I aren't worth the trouble, so 2FA is an excellent way to secure our accounts.

How do I use two-factor authentication?

It's easier than you might think!

Setting up 2FA on an account is a three-step process. You need to provide your current credentials by typing in your password again (this helps keep someone else from adding it to your account), even if you're currently logged into the service. Then you go into the account settings and enable 2FA on your account. This lets the server know you want to enable it, and it'll ask what kind of authentication you will be using — most common are codes sent to your phone as an SMS message or through an authenticator application. Finally, you affirm the change by supplying a token back to the server. If you're using an app, this might be a barcode you have to scan or manually enter some information into the app. If you chose to use SMS, a code will be sent that you need to enter on the website to finish things up.

That last step happens when you want to log into that account again. You'll enter a username or ID, then a password, and then be asked to supply an authentication number. That number is sent as an SMS, for example, or in the app on your phone if you decided to go that route. You type that number into the text field, and that's it! You have access.

Most services will store an authentication token on your phone or computer, so you won't have to resupply the code the next time you want to log in. However, if you want to set up access from another place, you'll need a code. While the process is practically the same regardless of whether you're setting up 2FA on your Google account or just trying to keep your Amazon payments safe and secure, there are a few differences here and there.

Something else we hear about all of the time is that various Twitter accounts end up getting hacked and those accounts start tweeting out some weird stuff. With a platform as large as Twitter, it's extremely important to make sure you have 2FA set up, along with changing your password on a regular basis.

Why is two-factor authentication so important?

In a world that's constantly becoming more connected with new security and privacy issues popping up just about every day, it's important that everyone out there takes the necessary precautions to protect their online presence as much as possible.

Two-factor authentication is not 100% foolproof, but it adds a significant security layer that can keep unwanted eyes and hands off your data. And when you combine using a password manager with two-factor authentication, you have a better chance at thwarting anyone from getting ahold of those precious logins.

It might be annoying at first to deal with entering your 2FA codes when logging into your online accounts. Still, the extra couple of seconds this takes is well worth the added protection that two-factor authentication provides.

Lock it down

Yubico Yubikey 5 NFC

$45 at Amazon

Keep your accounts extra safe with a physical 2FA key

Everyone should be using two-factor authentication (yes, you!), and one of the best ways to start is with the Yubico Security Key. This USB key fits in any USB-A port and securely saves 2FA login codes for your Google, Facebook, Dropbox, and other online accounts. It's also extremely durable and can be attached to a key ring for easy transportation.

Source: androidcentral

Popular posts from this blog

Review: The Teracube 2e is a more sustainable phone that you can afford

It just got easier to be green. If you know me or read my work here at AC, you know that I feel strongly about a few things when it comes to smartphones and consumer tech, and those things are not necessarily what some of my colleagues or others in the tech-sphere care about. You can have your 10x optical zoom cameras, folding phones, and 50W wireless charging devices all day, but I'm more interested in affordable to mid-range devices that last longer than you'd expect and which are at least trying to do environmental and social good. Sounds great, but it seems that it's harder to find this combination of features in a phone than the ultra-premium specced-out devices we typically talk about here on this website. That's why I was excited when I had the chance to write this Teracube 2e review. Teracube is a relatively new smartphone OEM based out of Redmond, WA, and founder Sharad Mittal's stated goal is to change the "disposable nature of the consumer ele

Google's new Guest Mode is like incognito mode for Google Assistant

Your interactions with Google Assistant will not be saved when Guest Mode is turned on. What you need to know Google Assistant is getting a new Guest Mode for privacy-conscious users. When it's turned on, the virtual assistant will not save any of its interactions with you. Turning it on and off is as simple as a single voice command. Google this week announced a new Guest Mode for its virtual assistant that's designed with privacy-conscious folks in mind. A simple "Hey Google, turn on Guest Mode" will ensure that none of your interactions with Google Assistant are collected by the company and nor will they be used to 'personalize your experience' — often an indirect way of referring to targeted ads. When it's on, the Assistant will play a special chime to let you know. Smart displays with Assistant will also show a guest icon on the screen. And you can always check for yourself by saying, "Hey Google, is Guest Mode on?" Even with G

Spotify Q1 beats on sales of $2B with monthly active users up 31% to 286M

The coronavirus may be decimating some corners of the economy, but the impact on the digital music, as evidenced by the world’s biggest music streaming company, appears to be minimal. Today Spotify reported its earnings for Q1 with revenues of €1.848 billion ($2 billion at today’s rates) and an inching into a positive net income of $1 million. Monthly active users (not total subscribers) now stand at 286 million, with paid (premium) users at 130 million and ad-supported monthly active users at 163 million. Ad-supported users are growing at a slightly higher rate at the moment, at 32% versus 31%, Spotify said. Spotify beat  analysts’ forecasts on both sales — they had on average been expecting revenues of $1.86 billion — and EPS, which had been forecast to be -$0.49 but came in at -$0.20 on a diluted basis and $0.00 undiluted. The numbers underscore the positive signals we’ve had from the wider industry. More generally, we have seen a huge boost in streaming media services — includ

Adobe is giving students and teachers free access to Creative Cloud

Your university's IT admin will need to make an application for access. What you need to know Adobe is temporarily making Creative Cloud free for teachers and students. The offer is aimed at enabling them to continue being productive as they work and study from home. Students cannot individually avail the promo, however, as the application for access needs to be made by a university's IT admin. As universities around the world shut their campuses and organizations ask their employees to work from home, many tech companies are making their products available to educational institutes free for use. Google and Microsoft have both made their large-scale communication and videoconferencing tools free for everyone, and now Adobe is temporarily giving free Creative Cloud access to students and teachers. The subscription, which usually costs $79.49 per month, will give affected students and teachers access to the entire range of Adobe's applications, such as Photoshop