Start Using Two-Factor Authentication Everywhere, Today

It can be easy to slack off when it comes to good password practices. Many users still use the same password across multiple sites and often don’t use secure passwords. Password managers make this a lot easier, but it’s really two-factor authentication (2FA) that can make all the difference. Strong, unique passwords are still important (not all accounts offer two-factor authentication) but let’s talk about why you should always enable two-factor or multifactor on all of your accounts when possible.

Getting into my programs or logged onto different websites has been easy enough by using a password management tool, especially since there are settings that can be enabled to remember a specific device. When logging on from a different device, my phone or email is immediately hit with a notification. It’s a PIN, and without the PIN there is virtually no chance of logging in. This might be annoying if my phone isn’t on me and I’m sent a text notification, but let’s be honest, I don’t go anywhere without my phone, it’s my most valuable tool. 

So, you might have tried 2FA before or you might have been endlessly hitting the “ask me later” option that you are prompted with on new software that implemented the additional authentication measures. Whether you decide to use it or not there is one indisputable statement regarding this feature: two-factor authentication makes your accounts more secure. 

What Is Two-Factor Authentication

Even if you haven’t used 2FA, you’ve probably seen it in action. In fact, many sites, like bank accounts, Google, and Facebook might force a type of 2FA on you. If you’ve ever logged into a website from a different computer and then received an email or notification on your phone that a login from an unknown location just happened - that’s two-factor authentication. Albeit, it’s the reactive version that doesn’t do much to prevent others from gaining access to your information. Let’s not rely on being reactive, and look at true two-factor authentication.

By definition, two-factor or multi-factor authentication is an authentication method in which a computer user is granted access only after successfully presenting two pieces of evidence to an authentication mechanism: knowledge, and possession.

Knowledge: This is your password. You’ve memorized it or stored it securely in a password manager. The idea is that only you know it or have access to that information. In events where you don’t know your password, some sites might also accept your full email address or phone number in order to reset your password.

Possession: This is something that you own and almost always have in your possession. This is typically your smartphone, but other methods might have you carrying around a USB thumb drive or an electronic key that generates a random number.

The instantaneous code that is sent provides one more feature. It acts as an informant. If somebody were to log into one of my accounts with my password, I would find out instantly. Even then, they wouldn’t be able to get the PIN from my text message or authenticator app to finish the login process. This tells me I should change my password immediately, but otherwise my account should be safe.

Don’t Assume You are Safe

Enabling two-factor authentication won’t entirely protect you from threats or breaches. If you have two-factor set up on Facebook, Facebook can still get breached and passwords could be stolen. We see this happen all the time, with high profile attacks on large online entities stealing millions of records in a shot.

Following the other password best practices, like using strong passwords and never using the same password on two accounts is critical.

Recently, we saw the launch of Disney+, and it was reported that several thousand users had their brand-new accounts hijacked within hours of the launch of the service. This wasn’t because Disney was hacked; hackers just attempted to log in to steal accounts with emails and passwords they already had from some other data breach. 

Phishing attacks are plaguing millions of inboxes every single day. These attacks replicate the website in which they are impersonating, with a realistic login screen. Users are tricked to go there, fill in their information, and the credentials are directly sent to the cybercriminals.

As previously mentioned, 2FA isn’t the fix-all to cybersecurity. It does however put one more step between you and an ill-willed cybercriminal. Horne & Benik has many more tips to help your business become more secure. If you would like to talk to one of our experts, give us a call at (603) 499-4400.