Two factor authentication what it is why you should use it?

Two factor authentication

Two-factor authentication (2FA), sometimes called dual-factor authentication or two-step verification, is a security procedure in which users provide two different authentication factors to verify themselves. Authentication factors are a category of security credentials used to verify the identity and authorization of a user. This procedure further protects the user's credentials, and the resources said the user could access. Dual-factor authentication is a higher security level than verification methods that depend on single-factor authentication (SFA)^[1]. The user provides only one factor, usually a passcode or password.

However, two-factor verification methods require a user to provide a password or passcode and a second factor, which is often a security token or a biometric factor, such as a facial scan or a fingerprint. A security token is a mobile device that authenticates a user's identity electronically by storing personal information. The user then plugs the security token into a system to gain access to a network service.

Two-factor verification adds an extra layer of security to the authentication process by making it harder for attackers to access the user's devices or online accounts. Knowing the user's password alone isn't enough to bypass the verification check. 2FA has been in use for a long time to control access to data and sensitive systems. Service providers online have been increasingly using two-factor verification to protects their customers' data from being used by hackers who have illegally acquired a password database or have used phishing campaigns to get user passwords. (Phishing is a cybercrime in which targets or targets are contacted by email, telephone, or text message by someone impersonating a legitimate institution to lure individuals into providing sensitive information such as ID information, banking, and credit card details and passwords.)

SO, WHAT ARE AUTHENTICATION FACTORS?

In the past, organizations and online service providers have relied on unique usernames and self-selected passwords or phrases as the primary technique of authenticating user identity and providing access to systems. An example would be the password types required to combine characters and certain keywords long, making them harder to crack. Nowadays, organizations focus on data security; hence, they adapt to using multiple authentication factors to control and secure data systems.

A user can be authenticated in several ways, using more than one authentication method. Here are some authentication factor categories arranged in order of adoption for computing and how they work.

Knowledge Factors

Knowledge factors users to provide some data or information, something the user knows before accessing a secured system. A password or PIN (personal identification number) or some other type of shared secret is the most common type of a knowledge-based authentication factor used to control access to a system. A shared secret is a data that is only known to the entities involved in secure communication. Most common applications or network logins require a username/e-mail address and a corresponding password or PIN to gain access. The username or email address on its own is not considered an authentication factor; rather, this is how the user shows their identity to the system. A password or PIN is used to verify that said username or email address belongs to the correct person.

Possession Factors

Possession factors refer to something the user has, like an ID card, a mobile phone, a security token, a mobile device or smartphone app, or even a specific piece of information, before they are granted access to the system. Possession factors ensure that access is granted to the correct user by ensuring such a device belongs to the user. Here's how it works:

1. A user registers for an account with their password and phone number recorded during the registration.
2. The user logs into their account with a username and PIN/password.
3. An OTP (one-time password) is sent to the user's phone number.
4. The user enters the OTP and gains access to the system.

This type of authentication factor is seen when making mobile monetary transactions. It can also be seen while registering for some accounts with your email address, and a link is sent to the email to verify whether you are truly the owner.

Inherence Factors

Inherence factors, commonly called a biometric factor, authenticate access based on the user's physical feature. These could be thumbprints, fingerprints, palm prints or handprints, retina or iris scans, voice, and facial recognition, or even behavioral biometrics (the measure of uniquely identifying a pattern of behavior specific to a person), like keystroke dynamics, speech patterns, or gait or walk posture. An example of the latter in pop culture is a scene in Mission:  Impossible – Rogue Nation. When systems can successfully identify users based on these data, inherence can be one of the most secure authentication factors. The downside is that users become rigid with how they access their accounts. An example is a system that requires a fingerprint scan to access can only be accessed on devices with hardware that supports fingerprint scans. This restriction is useful for security but could negatively inconvenience the user.

Location Factors

These are denoted by where an authentication attempt is being made and can be used by service providers. They use it to execute services that use geo-location security checks by limiting authentication attempts to specific devices in that particular location. More commonly, by tracking the geographic source of an authentication attempt based on the source IP (Internet Protocol) address or other geo-location information. For example, Global Positioning System (GPS) data, derived from the user's mobile phone or other devices. However, hackers can use VPNs to hide their location. MAC addresses can also be implemented as a location-based authentication factor because they are unique to individual devices, ensuring that a network or system can only be accessed from a limited number of authorized devices. An example of this is how Google sends you a report anytime you try to login into your account with another device.

Time Factors

A time factor restricts user verification within a specific period, so logging on to the network or system is only permitted within that period and restricts access to the system once the period has elapsed.

Do note that most two-factor authentication methods rely mainly on the first three authentication factors. However, networks or systems that need greater security may use them to execute multifactor authentication, relying on two or more independent security credentials for more secure authentication.

HOW TWO FACTOR AUTHENTICATION WORKS?

• The user is requested to sign in to the application or network.
• The user enters the knowledge factor —what they know, usually a username, email address or a phone number, and a password/PIN. The site's server looks for a match and recognizes the user.
• If the process doesn't require a password, the app or website generates a unique security key for the user. The verification tool processes this key, and the server validates it.
• The site then cues the second login step. Though this step can come in different forms, users are mostly requested to use the possession factor. So, an ID card, a smartphone, or other mobile devices are used.
• The user enters the OTP (one-time-password) that was generated in the previous step.
• After both factors have been authenticated, the user is then granted access to the network or application.

A two-factor authentication is a form of multifactor authentication, MFA. However, it should not be confused with two-step verification. Two-step verification uses the same type of information from the same authentication factor; let's say, a password, and a code, sent to you over SMS (token). Two-factor authentication, on the other hand, would need information from two authentication factors.

The main problem with password-based authentication is it requires knowledge and diligence to create and remember strong passwords. Passwords require protection from many inside threats, like carelessly stored sticky notes with login credentials or old hard-drives. Passwords are also vulnerable to external threats, such as hackers using a dictionary, brute-force, or rainbow table attacks (a rainbow table attack) hacking. The hacker tries to use a rainbow hash table to crack passwords stored in a database). A hacker can breach password-based security systems with time and resources and obtain corporate data, including users' personal information. As a result of how easy they are to implement, their low cost and familiarity passwords remain the most common SFA form. Protocols like multiple challenge-response questions can improve security, depending on how they are implemented, stand-alone biometric authentication methods can also provide a more secure SFA method. Long, complicated passwords created by generators like Safari's iCloud Keychain or third-party apps like LastPass or 1Password help. Still, the absolute best way to lock down your accounts is to add extra security options for two-factor authentication (2FA). 

WHY YOU SHOULD USE 2FA?

Single authentication factors alone may present security vulnerabilities, sometimes due to users' behavioral patterns and other times because of the current technology's limitations.

Knowledge-based authentication factors require users to memorize passwords and PIN. It can prompt users to make overly simplistic passwords and change them too infrequently, making them easy to guess or hack or make long, complicated passwords they can't even remember.

Location-based authentication factors can be foiled by VPN technologies that make it difficult to accurately authenticate the origin of network traffic, an IP address, or a GPS signal.

Behavior-based authentication factors could be observed and replicated by an impersonator.

Possession-based authentication biometric factors may be the best means of securing a network or application against unauthorized access for now. Combining these methods into a multifactor authentication procedure decreases hackers' chances of gaining unauthorized access to the secured network.

Better productivity and flexibility

In the recent pandemic, many businesses now allow remote working as it encourages productivity. Two-factor authentication implementation gives employees safe access to corporate systems and databases from any device or location without putting sensitive data at risk.

Lowers security management costs and time

Two-factor authentication helps to reduce password-resets, which consume time. Help desks are burdened with this too. 2FA provides an easier and safe way for users to reset their passwords. It allows for increased employee productivity in businesses.

Reduces cyber fraud and builds secure online relationships

Phishing and identity theft are becoming popular. That is extremely damaging to businesses as it results in a loss of trust and credibility. By introducing two-factor authentication, you can help to provide a secure, trustworthy brand experience. That encourages a strong relationship between customers and business owners.

Loss of device

One main fear with two-factor authentication is the potential loss of your primary authentication device. For example, if you lose your phone, you can't get SMS messages. The good news is, most services have ways to prevent total loss of your account. There are data recovery keys or special passcodes that can unlock your account just in case you don't have access to your main authentication device at the moment. For example, companies like Google make sure you have a recovery email for cases like this.

can i set up an account with two-step verification or two-factor authentication

In recent years, many web services and banks have incorporated multiple authentication methods in their security procedures. Two-factor authentication can be used in many apps and web services such as Google, Apple's iCloud, and many more. Two Factor Auth has put together a comprehensive list of services and banks that support two-step verification or two-factor authentication. There are links to how-to documents, the methods of two-factor authentication they support, and ways to contact a service you utilize to request that they implement two-factor authentication.

Nowadays, even mobile devices require up to two different authentication methods for access. It shows you have paramount data security is for manufacturers. I hope these answer all the questions you have regarding Two-Factor authentication and how you can secure your accounts and databases.