It doesn’t matter if you’re new to 2 factor authentication or you’ve been doing it for
years, most people still make the common mistakes of using SMS text verification,
limiting which accounts they use 2FA on and, worst of all, not creating proper backup systems.
My name is Josh, this is All Things Secured, and today I’m going to explain why you’re
probably doing 2FA wrong and how you can avoid making these same mistakes
that completely negate the security that 2 factor authentication provides.
This video is made possible by Trend Micro,
a complete device and identity protection for you and your family.
Speaking of devices, let’s jump in with the the #1 most common mistake with 2FA,
which is choosing to receive your codes via SMS text when there are other options available.
Now I realize that for some accounts, SMS text or
phone calls might be your only option. That’s the case for me and Chase bank,
which frustrates the heck out of me, but there’s little I can do about it.
The reason this is such a big deal is that your mobile phone provider is
actually a weak link in your security chain. It’s far too easy for somebody
to impersonate you and steal your phone number, an attack known as SIM swapping,
which then sends all texts and phone calls to the hacker’s phone instead of yours.
This happened to Jack Dorsey, then-CEO of Twitter, back in 2019. His Twitter account wasn’t hacked,
a low-level customer support representative from his mobile phone provider was scammed. And once
the hackers were able to gain control of Jack’s phone number to receive the 2FA codes via text,
it was simple to log in as Jack on Twitter and start posting crazy,
racist comments that made international headlines.
If Jack’s phone can be SIM swapped and compromised, so can yours.
If you’re still receiving codes via text - and you probably are - I suggest logging
into those accounts to see if they offer more secure forms
of 2 factor authentication such as an authenticator app or a 2FA security key.
By the way, a quick bonus tip for those of you super-security nerds. If you can’t get
away from SMS text verification but you still want stronger security, there are alternative,
more secure mobile phone providers that put specific protections in place for
SIM Swapping attacks. I’ll link to an article describing those below.
And while you’re thinking about it, why not go the extra step of protecting your entire Android
or iOS device with mobile security from this week’s sponsor, Trend Micro. Check this out.
I have their Premium Security Suite, which covers all the devices in my home,
and allows me to scan these devices for any security vulnerabilities. In this case you
can see that they recommend I set up a guard so I don’t accidentally visit malicious websites,
set up protection from suspicous links in calendar events, and enable lost device protection.
On my Mac or a PC, Trend Micro offers protection against ransomware,
and if you’re not already using a password manager, they have that as well. When you
combine this with dark web monitoring, a secure VPN for public WiFi and a lot of other features,
there’s obviously a lot of value offered here. Learn more about the
Trend Micro Premium Security Suite in the link here or in the description.
So once you start moving away from SMS text as your primary form of 2 factor authentication,
the next common mistake I see people make is being very picky about which accounts they enable 2FA.
I mean, at a bare minimum, you always hear me say that you need to have 2FA active for your email,
financial accounts, investment accounts, etc. But that’s just the bare minimum. My rule of thumb is
this: if an online account offers you 2FA as an available security setting, you take it!
It’s that simple! Once you start using 2FA on a day-to-day basis, it won’t be nearly as daunting
as it feels now, and at this point I’m quite used to pulling out my 2FA key and plugging
it in when requested. And if you’re comfortable storing some of your 2FA authenticator codes in
your password manager - and many of them offer this now - that makes it even more convenient.
Whatever your threat model allows,
my point is that it’s a mistake not to be securing most of your accounts with 2FA.
And last but definitely not least: proper backup.
Please, please don’t click away yet, because this is the one thing that I get
emails about more than anything else. People locked out of their accounts,
people who can’t access their crypto wallets, people who lose online assets…the list goes on.
Here are my thoughts in a nutshell. Using 2-factor authentication well means taking responsibility
for your own security. And failing to set up a proper backup is irresponsible and costly.
So what do I mean by “proper” backup. A good backup meets the following criteria:
it is a separate device, kept in a separate location, that is all equally secure.
When I say separate device, that means you’re not just putting your authenticator code on
a different app on your same mobile device. In other words, having Google Authenticator
and Authy with the same 2FA code is not strong backup. If you lose your device you’re stuck.
The strongest backup in this case is having two 2FA security keys,
which are two different devices. But this only works if it meets the second criteria,
which means keeping it in a separate location. I keep one key on me and one stored securely
away. The only problem with this setup is that it makes it tricky to add new
2FA because I have to go and grab my backup before proceeding. But that’s proper backup.
And finally, having a backup that is equally secure follows the logic that you’re only as
strong as your weakest link. If your primary 2FA is a strong security key
but your backup is SMS text, you’re actually downgrading your security, not upgrading it.
I’m going to finish us off here with some good news. Identity verification is
quickly evolving and you’re probably already using it without realizing. Perhaps you open
your computer with your smart watch or you verify a payment with facial recognition.
Biometrics, or using something you are, as a replacement for either passwords or even
2 factor authentication, is attractive because it’s not something you can lose or forget - I
always have my face and my fingerprint with me wherever I go. It’s also very difficult to forge.
We’re probably going to see things like the Apple Passkey and other similar services
start to replace passwords and as long as all of this verification is done on the device,
it seems so far to be a secure option.
What do you think? Share your thoughts on using FaceID or fingerprints as
verification in the comments below. Thanks again to our sponsor Trend Micro. Click here
to learn more about their device and identity protection services.