Until we get rid of passwords, then unless you want to get hacked you need to be using
multi-factor authentication. That's not even a debate. Everyone with even the slightest
clue about cybersecurity is in agreement. But there are loads of different methods,
and they are not created equally. In this video, I'm going to rank them from the worst
to the best; so you can figure out how secure you really are, and whether it's good enough.
Welcome back to the Pro Tech show. When we refer to multi-factor authentication (sometimes
called two-step verification) we are talking about the practice of proving your identity
in more than one way. Those different ways are your multiple factors. There are (generally
speaking) four accepted authentication factors. There's the knowledge factor: something you
know, like a PIN or a password; the possession factor: something you have, like a phone or
a dongle; the inherent factor: something you are, like your fingerprint or facial recognition;
and the location factor: somewhere you are, usually based on your IP address or GPS coordinates.
The idea being that if you use more than one of these factors, it's a lot harder for someone
to break into your account. They don't just have to crack your password or steal your
phone. They have to crack your password AND steal your phone, without you realising to
reset either of them. For this video, I'm going to concentrate on the possession factor:
something you have. There's no point talking about the knowledge factor because it's
rubbish. The whole reason we need multi-factor authentication in the first place is because
passwords aren't secure enough. I'm also not going to talk about the location factor
because that just moves the question somewhere else (no pun intended). Let's say you use
your company's network as an authentication factor. That's fine, but there's almost
certainly a way to gain remote access to that network. So now the question becomes "How
good is the authentication on the remote access to that network?" Basically, what other factor
are you using to protect your location factor?
So now we're down to the possession factor and inherent factors. The inherent factor
is valid, but it's also a minefield because biometric technologies are all over the place.
I'd love to be able to tell you that facial recognition is either good or bad; but the
implementations vary so much it's just impossible. Some are so good they can tell
the difference between identical twins. For context, DNA can't do that! Others can be
tricked using a photograph from your social media page. So because I can't cover it
properly I will simply say that if you're considering biometric authentication, do your
research into the specific implementation you're using.
Ok, possession factor then. Starting at the junk end of our list, the winner of "Worst
Authentication Factor Beyond Passwords" is… sending a one-time code to your email address.
I would contend that this doesn't even count as multi-factor authentication. What is the
second factor? Email isn't an authentication factor! When a website uses this, what they're
really doing is saying they couldn't be bothered to implement the authentication;
so they're just hoping your email provider did, because your security is entirely dependent on your
inbox. Unfortunately, a lot of security breaches start with your inbox. 91% of attacks begin
with an email. Bad guys can deliver scams and phishing emails directly to it, and they
want your email account, because quite often your email account is the method used to reset
passwords on all of your other accounts. If your second factor (and I use that name loosely)
is the same thing that resets your first factor, what was the point? That aside, the worst
authentication factor that actually counts for something is sending a one-time code as
a text message to your phone using SMS, closely followed by validation using a phone call.
I rated SMS as the worst legitimate method because it is actually possible to snatch
messages out of the air with the right equipment, although in the real world that's very unlikely
to happen. There is, however, a much simpler method of stealing the SMS codes; and that's
for the attacker to trick your mobile network operator into transferring your number to
their phone. If you've ever changed networks, you'll know you can phone up and get your
number transferred over. They're supposed to take you through a few security checks,
but with a bit of social engineering an attacker can sound pretty convincing once they find
out a few basic details about you. Although there are checks in place to try and prevent
this, the fact is these checks rely on humans; and humans can get lazy or make mistakes,
particularly when they're overworked and have a backlog of customers to deal with.
What are the odds of this happening? It doesn't really matter, because the attacker can just
keep trying again and again with different people until one employee slips up. This isn't
theoretical - this has happened quite a few times; and once they've got your phone number
they can receive your SMS codes or your verification phone calls. Would someone use this against
you as an individual? Maybe not - it's not a random attack, it's targeted. Would someone
consider using this against you to get at your business or your employer, though? Yeah,
probably. That could be worth their time. So what's better than a phone call or text
message? Well, the next step up is an app prompt. You know, the little pop-up on your
phone that you have to click "yes" on? This is a lot harder to intercept because it doesn't
follow your phone number. In fact, the weakness that prevents this method being higher up
our list is not actually a weakness with the technology itself. It's the person using
it. There he goes: blaming the squishy humans again. This authentication method is more
secure, but it is vulnerable to what's known as an MFA fatigue attack. This involves
spamming the target with prompts until they hit the wrong button, either by accident or
out of frustration. They'll often target people at night in the hope they'll be tired
and hit "yes" instead of "no". The problem here is that even if the victim presses the correct
button 99 times out of 100, they only need to get it wrong once and the attacker wins.
This kind of attack is becoming very common, so it's definitely worth upgrading to more
secure methods. Fortunately, there is a relatively easy fix for this, and that is to use an app
that supports some kind of matching. Instead of asking you to approve the login by pressing
"yes" this variation asks you to choose a number or a picture that matches one on the login
screen. This is a very small change, but one that makes a substantial improvement to your
security. If an attacker tries to spam you with login prompts hoping you'll mistake
one for being legitimate, it's not enough for you to hit "yes". The number or picture
on the attacker's login screen is random, and you need to select the same one on your
phone. So what will actually happen if they send you a malicious prompt when you're
expecting a legitimate one is their prompt will not match the legitimate login screen
you're looking at, so you won't choose the correct option, and the authentication
will be rejected.
Another option that protects you from MFA fatigue attacks is a time-based one-time passcode
or TOTP for short. This typically takes the form of a numeric code that is generated on
your device and changes every 30 seconds. There is no externally triggered prompt, so
unless you choose to open the app and enter the code it cannot be easily exploited. In
terms of security, I'd place this about the same level as an app prompt that uses
number matching. You could argue TOTP is a little more secure because it requires manual
action on the end user's part to trigger an authentication sequence; but you can also
argue that it can be easier for malware to steal the shared secret the codes are based
on, allowing them to generate their own codes without you knowing. Ultimately, both of these
methods protect you against the same sort of attacks and are also vulnerable to the
same sort of attacks, and I'd rate them about the same.
Which is better probably comes down to convenience. I prefer the app prompt because it means I
don't have to type a code; but the TOTP code works without an internet connection,
so that may be more convenient for you depending on where you need to use it. A slight variation
on a TOTP-generating app is a hardware token. The most common type is a dongle that generates
a code and displays it in a small screen. Another version is something like a YubiKey
that basically pretends to be a keyboard and types in the code automatically when you plug
it into your computer. These hardware tokens are a bit more secure than an app. An app
runs on an operating system which can be attacked by malware to steal shared secrets. A hardware
dongle or YubiKey has no such operating system to attack. The main disadvantage is
they're more expensive because you have to buy a physical thing instead of just installing
an app on a phone you have already. There are times it's worth spending more to improve
your security, but personally, I don't think this is one of those cases. The security improvement
versus a free app is relatively small; and if you're going to purchase a hardware token
there are better options that will bring you more significant benefits for the money.
Before we talk about those, let's talk about certificates and smart cards. These are generally
used as an alternative to passwords rather than as a second authentication factor, but
they can be used for both. These are similar in nature because a smart card is essentially
a device that holds a certificate. Those both use a key that is much longer than a typical
password; but more importantly, they don't transmit the key itself. They use public key
cryptography to authenticate you using a digital signature generated using your private key.
I'm not going to go into how exactly this works here, but I will link a video about
passwordless authentication in the description which explains how it works in more detail.
Suffice to say, this is much better than a password; and combined with something like
a PIN or a password to protect the private key it can be considered to be multi-factor
authentication by itself, negating the need to combine it with anything else. The downside
is that certificates usually require an IT infrastructure to support them, which places
additional burden on the IT team to provision these certificates, install them on end-user
devices, and revoke them if necessary. When smart cards are used there are also physical
devices to buy. These used to be actual cards that looked a bit like credit cards, but most
computers don't have built-in support for them and need a reader to allow them to be
used. This increases the cost even more, and limits where they can physically be used;
so it's increasingly common for these cards to be replaced by more flexible devices like
YubiKeys that can do the same job, but using a standard USB port. Usually, these smart
cards and certificates are used to log on to a corporate computer or to access internal
company resources. They don't scale particularly well to the internet because of that requirement
for an IT infrastructure to back them up, so using them to access your personal accounts
probably isn't a feasible option. I mean, I have hundreds of online accounts, and I'm
not going to carry around a stack of hundreds of smart cards, all managed by different companies,
just to use them. So let's go back to something a bit more suitable for online accounts. We've
talked about a few options. Some good, some not so good, but so far they all have one
common weakness. They're all susceptible to man-in-the-middle attacks. Like with the
app prompt, you can make an argument that the flaw here isn't the technology, but
in the person using it. Let's be realistic though: the technology only exists so humans
can use it, and humans will make mistakes. A man-in-the-middle attack is where the bad
guys position themselves between you and the application you're logging on to. There are
a few ways they can do this. The most common is by tricking you into clicking a link in
an email, but there are other less obvious methods like DNS poisoning. Let's assume
it was the link. This link takes you to a website that looks just like the one you're
expecting to log in to. If it's a proper man-in-the-middle attack, it might look identical;
because it might actually be the real website you're expecting to log in to. Basically:
you connect to their website, they connect to the real website, and they show you the
actual webpage generated by the real website. If you're paying careful attention you
might notice that the URL in the address bar is a little bit different to the real website.
Realistically, people don't read the URL every time they log in, and even a slight
character anomaly in the address is enough to differentiate the fake website from the
real one as far as your browser is concerned and prevent it displaying any warnings. So
now you log in. The fake website simply copies your login details and passes them through
to the real one, and then presents back the real response with its request for your multi-factor
authentication. At this point, it doesn't matter which of the methods we've talked
about you're using. You don't need to enter anything into the web browser. You just
need to complete the authentication to satisfy the real website and it will issue your browser
with a session token. That session token is used to prove your identity while you're
logged on the website, so you don't have to re-authenticate every time you open a new
page. Because the attacker is sat in between you and the real website though, they can
intercept that session token; and now as far as the real website is concerned, they are
you. They can do anything you can do. Your account is now their account. As I record
this, Reddit has just been in the news for getting hacked. This is how they got hacked,
despite using multi-factor authentication. If you want a way to protect yourself against
the fallibility of the human element, the next couple of methods will help with that.
The first method goes by several names: FIDO, U2F, and UAF. U2F and UAF are different standards
that achieve a similar result and are part of the FIDO specification. Unless you're
actually building the application, you don't need to worry about the differences between
these acronyms. As an end user you can pretty much treat them as interchangeable. These
use physical hardware tokens that usually take the form of a USB key, like our recurring
friend the YubiKey. Like a smart card, these tokens use public key cryptography to generate
digital signatures; but unlike a smart card, the private key is generated automatically
and tied to the URL of the specific website it is intended to be used with. This brings
similar benefits as using a smart card, but without the overhead of needing an IT team
to manage the certificates for you. More importantly from a security perspective: your browser
and your authentication device work together to validate the identity of the website you're
connecting to. If there are any anomalies in the URL, if the connection isn't encrypted,
or if the website certificate hasn't itself been signed by a publicly trusted certificate
authority, then your device will not sign an authentication response and the attack
is blocked. This is by far the strongest authentication method so far, and it's the reason I cautioned
you against paying for dongles that only generate TOTP codes. There's nothing wrong with those
devices. They're still pretty secure so don't feel bad about using one. But if I'm
going to spend money to buy physical dongles I want one that can do more than I can do
with a free app. I want it to help block man-in-the-middle attacks.
These days I wouldn't settle for just FIDO, though; because we now have FIDO2. One of
the advantages smart cards had over FIDO was the ability to protect the private key with
another factor like a PIN code; which makes them multi-factor in their own right and means
you don't need to use them with anything else. FIDO2 combines the benefits of FIDO
with that ability to protect the key with something like a PIN or biometrics. FIDO2
is a passwordless solution; meaning instead of combining it with traditional passwords,
you can get rid of the traditional password altogether. This levels up your security yet
again because the password is always the weak link. FIDO2 has also gained more industry
traction, so as well as the usual suspects like YubiKeys it's starting to get built
into devices like phones. So as time progresses and support improves, you'll be able to use
them as your authentication token. If you're buying a physical dongle today, make sure
it supports FIDO2. This is currently the most secure option, and the one I personally
use to protect my most sensitive accounts. Like FIDO, there are a few interrelated
standards. As an end-user, the names to watch out for are FIDO2, WebAuthn and Web Authentication.
You can treat these as meaning the same thing if offered by a web app. Putting this all
together into summarised categories then... These methods are to be avoided if at all
possible. In my opinion, these are already broken. The basic app prompt is a little better,
but it's too easy to exploit the person on the other end. These methods are fine.
They're OK. I would accept them for most use cases, and sometimes they're the best you
can achieve for reasons of practicality. They are still vulnerable to a man-in-the-middle
attack, however; so for the strongest security, use FIDO, or even better, FIDO2. I'll put
links to the YubiKey I use in the description if you want my current recommendation for
a device that's compatible with a number of these methods, including FIDO2. And if
you'd like to understand why FIDO2 is more secure than the other methods I've mentioned,
I explain it in more detail in this video; so if you're on the fence, give that one
a watch to find out more. If you found this video useful, please hit the like button and
consider subscribing to the channel.