What Is Two Factor Authentication?
Often these passwords were less than ten characters, and at
best were a word with a number, usually 01, on the end. Where it wasn’t 01, it was either the month in which they were born, or the last 2 digits of the year they were born.
Invariably the word was something that related to them, and with
a little effort and research, could be discovered easily.
If that description sounds at all familiar, please read on.
It has been suggested to make your password a nice long sentence,
complete with punctuation and numbers. This is probably as far as most users need to go, so long as they have an additional layer of security in place called “two factor
authentication”, which I will explain shortly. It is still able to be
compromised though, especially if you have used something from popular literature.
Use a quote from your favourite book, which you might have mentioned on
Facebook, and a ne’er do well and a few lines of code could break it by automating the process to attempt different selections from the book repeatedly until they are successful.
This method is called a “brute force” attack, and they do take time.
Most service providers have processes in place to
limit the effectiveness of such attacks, but plenty don’t; users
tend not to find out about the ones that don’t until it is too late.
For this reason, anyone looking for additional security should consider setting up what I’m about to describe.
I have become a dedicated user of a password generator and wallet application on
my phone. The app is locked behind one password I am required to
remember, but will generate passwords for me based on the
requirements I set, then store them behind that master password.
I can customise the requirements of a password on the basis of number and type of characters.
The strength of such a setup is the passwords are long and
complicated, and there is zero need for me to remember it. The weakness is the app relies on an algorithm to generate the passwords, and that could be
reverse engineered, or stolen in a data breach.
Since I use Two Factor Authentication (I am getting there), if my password is
compromised, I am still protected.
Two Factor Authentication is slowly becoming the accepted standard of adding an
additional layer of security to services and accounts, and I appear to be part of a pilot program within Telstra for our own version of it. At its most basic, two factor authentication requires
providing an additional piece of information which is sent by the service provider to
you once you have provided your password. This is either provided by text message, or a code generated by an app on your phone. Basically it’s your
service provider saying “Either you, or someone
pretending to be you, has attempted to access your account. We want to be sure it’s you, please use this code.”
The code provided is a single use token, able to be used once, and never again.
To gain access to your account, a bad actor would need to break
your password AND have compromised the second factor.
Tell me what you think the likelihood is of an attacker achieving ALL of the following:
Discovering that I use a particular website or service
Discovery of my username
Discovering my password
Intercepting the one time Two Factor Authentication code Not likely.
As an added bonus the code also acts as an alarm that a breach has been attempted; if I get a code when I haven’t attempted to log into that service, I know someone
somewhere has broken my password.
I can then immediately log in, generate and record a new password.
Can I still be compromised? Absolutely. A month doesn’t go by that I don’t read about a
service provider having been breached and their users’ details being stolen.
I liken the steps
I have in place to putting a steering wheel lock on your car: if a car thief sees
your car with a steering wheel lock, and one without, which is more tempting?
By forcing the attacker to expend more time and resources
to gain access to my accounts, I have made every other persons’ account
more attractive than my own.
I’m not outrunning the lion, I’m outrunning the other guy lost in the jungle.