Nowadays, when we talk about security, we no longer mean adding a deadbolt to your front door. In fact, what’s more disturbing and in need of security is our online identity. Having a password may keep the casual snoop out, but it’s far from enough to deter those cybercriminals.
So, what can we do to strengthen our digital security?
Over the past few years, the Two-Factor Authentication has proved to be that much needed extra layer of security, by demanding not just what you know – your password, but also something you have or are.
Now, you might be wondering, “Isn’t my 14-character password with numbers, symbols, and hieroglyphs enough?” The short answer is Nope. Passwords are notoriously weak links. Two-Factor Authentication drastically reduces your risk. Even if someone gets past the first barrier, the second factor makes their job exponentially harder.
Let’s unpack this technology and figure out the best way to keep your digital life locked down.
What Is Two-Factor Authentication (2FA)?
The 2FA requires, as the name already hints, two forms of verification before granting access to your accounts.
It’s a bit like getting into the exclusive party of a secret society. At the door, first, you may be asked for your name. If it’s on the list, then, you might have to confirm your identity with a face scan. No match, no party.
By requiring two separate factors, 2FA ensures that even if someone steals your password, they’ll still need the second piece of the puzzle.
The Three Flavours of Two-Factor Authentication
The Two-Factor Authentication typically falls into three main categories. Each has its strengths, weaknesses, and quirks. Let’s take a moment to weigh the pros and cons of each type.
1. The Knowledge Factor
Providing something you know as second authentication is the first, most basic line of defence. What we’re talking about is the classic password, PIN, or answer to a security question. Unfortunately, passwords can be cracked, guessed, or stolen. While passwords are necessary, they’re no longer sufficient on their own.
2. The Possession Factor
This next level security layer refers to something you have. There are three options here:
SMS Codes: A one-time code sent to your phone via text. It’s convenient, simple and widely supported, but far from perfect. Hackers can intercept texts through SIM swapping or phishing. It’s like hiding your house keys under the doormat—better than nothing, but even a not-so-crafty thief can find it. Also, it becomes an inconvenience when you travel often and switch sim cards. Plus, do you really want to share your phone number with all those platforms?
E-mail Codes: Same as SMS codes, but sent to your e-mail. If you are using a secure, encrypted e-mail provider, and have a strong password, this is an ok option. Is it better than SMS? Hard to say, since your e-mail can be accessed from anywhere in the world. And with SMS, one either has to have your phone, or have it cloned.
Push Notification: You receive a notification for approval on a trusted device. It’s an overall secure method, unless your device is compromised. One drawback is that if you have too many notifications on your device, it could easily get lost in the clutter.
Authenticator Apps: Apps like Authy generate time-sensitive one-time codes. These are more secure than the ones mentioned above, and are becoming increasingly popular for a reason. They are easy to use, you can use them offline, and the apps themselves are password protected (except for Google Authenticator), so even if you lose your phone, you won’t be exactly in for a world of trouble if you have saved your recovery codes. If you haven’t, well, then you are… you know.
Hardware Tokens: Physical devices, such as YubiKeys, that plug into your computer or phone to authenticate you. Think of these as the Fort Knox of 2FA. No wonder organisations like Google issue such keys to their employees to secure their corporate accounts. They’re almost impossible to hack, you can use them offline, but again – you’d better not lose them. It’s advisable to always keep a backup key. Another disadvantage is that you actually have to carry an extra physical object with you.
3. The Inherence Factor
Here’s where things get sci-fi. Inherence factors rely on biometrics—things that are unique to you. Such things could include:
Fingerprint Scans: Common for opening smartphones and laptops, fingerprints are quick and reliable.
Facial Recognition: From Apple’s Face ID to airport security systems, this is becoming increasingly popular.
Voice Authentication: Less common, but still an option for verifying identity.
Retina or Iris Scans: James Bond-level security, often seen in high-security environments.
Biometrics are convenient and, by far, the hardest to steal. But, again, they’re not flawless either. We don’t have to get too descriptive about all the spy movie scenes where one puts their hands on someone else’s fingerprints. Theoretically, they are all possible. The problem is, if your data gets compromised in a breach, well, you can’t exactly change your fingerprint as if it were a password.
Finding Your 2FA Sweet Spot
The best 2FA method depends on your priorities.
For most people, the sweet spot is using an authenticator app, paired with a strong password. This strikes a balance between convenience and security. If you’re particularly cautious (or just love cool gadgets), consider adding a hardware security key. And biometrics? Well, they are perfect for everyday devices, but better consider pairing them with another method for robust security.
Remember that even with 2FA, you’re not invincible. Always set up backup methods, such as recovery codes or alternative devices. This prevents lockouts if you lose access to your primary factor. Because hackers can trick you into entering your 2FA code on fake websites, it’s advisable to double-check URLs and never share codes with anyone.
Overall, use 2FA alongside other best practices, like regular password updates and avoiding public Wi-Fi for sensitive tasks. But don’t forget to double the locks, double the safety.
