 |
| © Provided by Consumers Union of United States, Inc. |
By Bree Fowler, Consumer Reports
In a world plagued by cyber threats, it takes more than a strong password to protect your personal information. According to security experts, you need a second layer of defense for your online accounts, complements of two-factor authentication (2FA).
If you've ever had to use a six-digit verification code texted to your cell phone to log into a Gmail account, you're familiar with how 2FA works. The code — entered after your password — basically acts like a second form of ID.
What you may not know is that you can now choose from a number of 2FA options beyond those texted codes, including mobile apps, your phone itself, and physical security keys that can make the process easier to manage and more secure.
And while 2FA doesn't work on everything just yet, it's not reserved solely for your laptops and smartphones. It's often useful on tablets and internet of things devices, too.
“Even if you have a good password strategy, like employing a password manager, I always recommend using two-factor authentication,” says Gerald Beuchelt, chief information security officer for LogMeIn, parent company of the popular password manager LastPass.
That's because passwords can be stolen through a data breach or even a simple phishing attack, no matter how strong you make them. And so, most online services that handle sensitive information — Social Security, banking, and credit card numbers; birthdates; and personal emails — now offer 2FA, as do connected devices such as security cameras.
But there are notable exceptions, such as Fitbit and OKCupid. And 2FA is not always turned on by default, which means you can't count on it unless you activate it on your own.
Here’s a quick look at the pros and cons of the latest two-factor authentication methods. If you want to see whether your online banking, social media, and other accounts use one, here's a handy resource.
SMS Texts
This is the method familiar to most people. Any time you log into a digital account via a new laptop or smartphone, you're required to enter your password and then a multi-number code that gets texted to your phone.
The good: You don't need a fancy cellular phone to use this method. As long as you can receive texts, you're good to go. In some cases, you can even have the code sent to you in the form of a robocall, which comes in handy if you'd like to have the numbers read aloud to you.
The bad: Smartphone batteries always seem to die at the worst time; and, when that happens, you can't receive texts. If you’re traveling overseas and haven’t set up your phone for international service, you'll have the same problem.
To receive those texts, you also have to hand over your phone number, which could open you up to marketing-related texts from the company that issues them.
Some experts say this method is less secure than the others, too, because cybercriminals can retrieve passcodes through phishing scams, which trick users into entering the code into faked websites, and by cloning your phone number. That last practice, known as "porting," allows the criminal to intercept the code by taking your existing cell-phone number and transferring it to a fake account.
But the odds of either of those things happening to the average person are very slim. And, in the rare instance that it does, the cybercriminal still has to crack your password.
Phones and Phone Apps
With this method, your smartphone acts as a security key.
If you choose to use a mobile app, such as Google Authenticator, you must scan a QR code presented by the site you wish to visit into the app. Once you do that, the app will continually generate the numerical codes required for log-in.
You also have the option to print out an image of the QR code for safekeeping. If you lose your phone, you just scan the code into a new one.
Google Authenticator is available for Android and iOS phones, but you need to have a Google account to set it up. And you have to sign up for Google 2-Step Verification before you can use it.
Instead of installing an app, you can also set up a push-based system such as Google Prompt, which sends notifications to all the phones signed into your Google account when a new log-in is detected. The notifications include location information for the log-in attempt.
You then have the choice of approving or denying the attempt.
This is the default method of 2-Step Verification for most Google accounts. Apple has adopted a similar approach for its products.
The good: Because the key is stored on your phone, you can use this method even if the device isn’t connected to a network. And, on the off chance someone manages to clone your phone number, they still won’t be able to retrieve the key without access to the phone itself.
The push-notification version offers the added benefit of being quicker and easier to use. It’s also less susceptible to phishing, because it doesn't rely on a passcode. And, if the approximated location is far away from your home or office, notifications like these might be more likely to grab your attention and spur you to take needed action.
The bad: With the QR code method, if your phone goes missing or loses power and you don’t have copies of the code saved elsewhere, you’re out of luck. But you can activate another version of 2FA as a backup to prevent that.
This method also can be a pain if you use lots of devices.
And, unlike with the methods listed above, push notifications require a working cellular data connection.
Physical Security Keys
Though consumers may be less aware of this option, people who work at Google, Facebook, Twitter, and cybersecurity companies have been quick to embrace it.
Instead of entering a code into your computer to verify your identity, you insert a physical key.
In some cases, the key and computer are linked via Bluetooth. In fact, cellular phones that run versions of the Android operating system dating back to 7.0 (Nougat) can now act as a Bluetooth-connected key.
The good: Google has famously claimed that not one of its 85,000 employees has had a work account phished since the company started using these physical keys in early 2017.
While hackers may be able to phish an SMS code from the other side of the world, they certainly can't fish a physical key out of the bottom of your purse or nightstand drawer remotely.
What's more, this method doesn't require a data connection or a powered-up cell phone.
The keys themselves are easy to set up and relatively inexpensive. Google’s Titan bundle costs $50, but you can buy quality keys from reputable companies such as Yubico for as little as $20. Google and Yubico both sell them through their respective websites. Yubico's are also for sale on Amazon.
Regardless of brand and price, security experts recommend buying a key that supports the FIDO2 security standard, which mandates higher levels of cryptography and authentication.
The bad: Yes, you have to buy the key. And you have to make sure it's with you whenever you need it. Logging in without it can be horribly complicated. But you can have a backup key or two, just in case the original gets lost.
And while many of the major tech companies have embraced security keys, your bank may have not. The overall adoption rate still trails those of other 2FA methods.
And, just a warning, not all browsers work with physical security keys just yet. Using them for mobile devices can be tough, too, because most keys are USB- or USB-C-compatible, though Yubico will have a Lightning version for iPhones very soon.
In the meantime, if you wish to log into a site from an iPhone or some Android phones, you'll either need a Bluetooth-equipped security key or you'll need to fall back on one of the other 2FA methods above.
