Multi-Factor Authentication: The Password Conundrum Part 3
MFA…Protecting Your Online Accounts, Not a Master of Fine Arts
In part 1 of the Password Conundrum, we talked about how we all hate passwords and how we can never remember a strong, unique password for every website, system, and application that we use.
In part 2, we talked about how a password manager can solve this problem and make your digital life much easier and more secure.
In part 3, I’ll explain multi-factor authentication and how to use it.
You don’t need an MFA (Master of Fine Arts) degree to use MFA (multi-factor authentication). Sorry for the acronym humor. MFA requires a user to provide an additional means of authentication or verification, in addition to entering a username and password.
Before we delve into MFA, let’s talk quickly about authentication. Traditionally, authentication is made up of two things, a username and a password.
The username is meant to be the identity of the account. This is not meant to be private or difficult to figure out. In fact, in most cases the username is meant to be public or at least visible to others who use the same system, service, network, etc.
The password is meant to be the secret that is exchanged to allow the user to access the system, service, network, etc. Using just a username and password is known as one-factor authentication because the user is verifying his or her identity with one piece of evidence or one factor. In this case it is referred to as “something you know” because, well, you typically memorize your password.
MFA adds two or more pieces of verifiable evidence or factors to the authentication process to greatly reduce the chances of an account being accessed by the wrong person. Two-factor authentication (2FA) is a subset of MFA and is a means of authenticating with just two pieces of verifiable evidence or factors. A good real-world example of 2FA is using an ATM. You use something you have, the ATM card, and something you know, your pin number.
There are generally four factors of authentication that are available for us to use today:
Something you have (e.g. a number generator like Google Authenticator)
Something you know (e.g. a password or passphrase)
Something you are (e.g. biometrics like fingerprint or facial geometry)
Where you are (e.g. GPS location tracked by your phone or IP address location)
Below, I’ll explain some options that fit into each of these categories.
Hardware Token - Something you have
A hardware token can come in many forms. Back in the 90’s, you could always tell the IT people in a company because they had little fobs on their keychains that had a small display with numbers changing every 30 seconds. This is known as a Time-based One Time Password (TOTP). While this is still an option today, most implementations of TOTP are executed using a mobile app or SMS message (see below). Another popular hardware token is the Yubikey. This is a hardware token that typically is plugged into a computer via USB however some Yubikeys support near field communication which supports devices without usb ports, like an iPhone. To use this token, you log in with your username and password, then, a field appears on the page that asks for the Yubikey authentication. Instead of typing in that field, the user plugs in the Yubikey and touches the sensor. With this physical connection, the key is entered by the Yubikey.
TOTP SMS - Something you have
The SMS Time-based One Time Password (TOTP) is a text message or email with a numeric code, called a one-time password (OTP) because it is only good for one use. This method is less popular with cybersecurity professionals since it’s been shown to be weak compared to other options but it’s still MUCH better than only using a username and password.
Time-based One Time Password Token - Something you have
Another popular method is the use of a TOTP generator such as those found on the old hardware RSA keychain tokens or a smartphone app like Google Authenticator, LastPass, FreeOTP and others. These numbers change every 30 seconds based on a shared algorithm that the software token and the authentication server both know. There is no network or Internet communication needed to use the soft token. The below image shows the time-based token on a mobile phone and where it is entered into the web page after the username and password are entered, to log into Google.
Phone/e-mail - Something your have
Two other TOTP MFA options are to get a phone call or an email with the MFA code. While this is better than no MFA, it has been shown many times, how easy it is for a threat actor to intercept or use this option without the knowledge of the user who owns the account.
Backup Codes - Something you have
Backup codes are provided to you when you set up MFA on many sites. The idea behind the backup codes is that you secure them in a safe, locked desk/office, safe deposit box, or an encrypted vault, like your password manager. They are used only if you lose or do not have access to your regularly used MFA factor. For example, if your phone is stolen, you can no longer use the Google Authenticator. In this case, you could pull out your backup codes and log into your account.
Biometrics - Something you are
Biometrics have become mainstream with the fingerprint readers and facial recognition technology embedded in the mobile devices and laptops that we use every day. However in those implementations, biometrics is used as an alternative to the username and password rather than another factor. We don’t see biometrics used much in MFA online these days but the possibility is there to use it.
GPS - Where you are
GPS location is another factor that isn’t used much for MFA today, but is frequently tracked to find if accounts have been breached. Let’s say that Sally logs into her company’s VPN from New York City at 8 am on Monday and then logs into the VPN server again at 10 am from Paris. Obviously she was not able to get from NYC to Paris in 2 hours, so the VPN server would deny that second connection and alert the cybersecurity team to investigate.
QR - Something you have
QR Codes are growing in popularity as a method of authentication and in some cases, replacing username and password altogether. While this is currently not that common for most Internet users, there is technology in the works today that may make QR codes and cameras in phones and computers, the replacement for username and passwords. More about that in the next blog post!
Summary, so far…
We all hate passwords, especially when we need to make them complex so we can’t remember them.
Password managers allow us to create great passwords for all accounts.
MFA will further secure an account by requiring more than just a username and password to authenticate.
MFA is offered on many of the most popular websites such as Google, Facebook, Twitter, LinkedIn, etc but most users don’t enable it.
Below are two websites that offer a searchable list of websites that support multi-factor authentication and instructions on how to enable MFA on the sites that you use.
In the fourth and final blog in this series, we will talk more about rainbow tables.