What's the best Two-Factor Authentication Option?
Hi
everyone. Leo Notenboom here
for Askleo.com. You'll know that I've been a long time
proponent of using two factor authentication as a great way to secure
your account from hackers and from other kinds of compromise.
Naturally, that leads to a question.
What's the most effective type of second
factor authentication for home computer users besides SMS or email?
Is it Yubi Keys, Google Authenticator or something else?
So.
The short answer, yeah, those are all good options.
Some are perhaps better than others,
depending on what your style is, what you have available to you,
and more importantly, what the service provider actually provides.
When given the option, which one would you choose?
Let's go over them and talk a little bit about the pros and cons of each.
A Yubi Key i is a physical device, literally.
It is a little USB device that you can hang on your keychain.
It has a little button that you could
press to enter the information that it carries.
You associate your account with the Yubi Key to set up your
Two-Factor authentication by plugging it in and pushing that button when requested.
Then later, when it comes time to log
in on an unfamiliar device, your login will ask you to insert
the device into a USB port and then press the button.
If you have the Yubi Key and if you have
the correct Yubi Key, then you're authenticated.
Possession of this little hardware device
is your second factor, and plugging it in when requested is how
you prove you have your second factor with you.
It's considered to be probably the most
secure approach to Two-Factor authentication specifically because
there's one key you can associate more than one key with some accounts.
But the bottom line is it's like having
one key to your house and only that key will let you in.
It's very secure and it is typically what
is required in some cases in high security environments, government agencies.
I think Google even requires it internally for some of their accounts.
It's a fine solution.
And as you can see, it's not that expensive.
It's not that big.
It is something you can easily hang off your key ring and use when you need it.
My preference in general is Google Authenticator.
Google Authenticator is an app that runs on your smartphone.
It runs on both Android and iPhones.
And it is something that once again you
associate with your account when you set up Two-Factor authentication.
It's usually done by having your device scanned, a QR code that is displayed or
entering a special key that then associates your specific phone,
your specific installation of the Google Authenticator with your account.
No other Google Authenticator will do.
It has to be your phone and your Google
Authenticator that's used to authenticate you are who you say you are.
How is that done?
Well, when you log in, the login process will ask you to enter
a code that is currently displayed by the Authenticator.
Your ability to enter the correct six
digit code when requested proves you are in possession of your phone.
The phone that was previously associated with your account.
That's two factor authentication in a nutshell.
Now, what I actually do is use an app called
Authy and I'll show it to you here in a minute for the reason I use it.
Here is an example of it showing some codes for, in this case,
my team viewer account, which happens to have two factor authentication turned on.
The reason I like Authy is that it allows
you not only to support multiple accounts, and I have many as you can imagine,
but it allows you to transfer from one device to another very easily.
So, for example, when I replaced my phone some time ago, all I really had to do
to preserve my two factor authentication ability was to install Authy on the new
device and it synchronized all the appropriate codes.
When last I looked, the Google Authenticator itself did not do that.
You actually have to go through a much more involved process to transfer your
Google Authenticator to factor authentication to a different device.
So my recommendation in general, if you can if you have a smartphone
capable of running these applications, is to use Google Authenticator.
Now, of course, you don't have a smartphone, right?
What if you're someone who does not have a smartphone?
I get that. That's fine.
Then the next level of authentication that I recommend is SMS text messaging.
If you have a mobile phone of any sort, doesn't have to be smart.
That is simply capable of receiving text messages.
I recommend you give your account provider
your mobile number and have them enable it for Two-Factor authentication that way.
When it comes time to log in,
you are then texted a code that you must enter in order to prove that you are
in possession of the device currently getting your phone numbers calls.
Now, that actually kind of lends itself
to both the pros and cons of SMS as a two factor authentication.
If you lose your phone,
you can go to your mobile provider and port your phone number to a new device.
All of your SMS comes with it and all of your Two-Factor authentication based
on SMS continues to work automatically with your new device.
There is a threat of what's called SIM
swapping where an attacker does that maliciously.
Instead of you doing it, they transfer your phone number to their
device and now all of a sudden they're getting your SMS Two-Factor codes.
This requires typically what's called social engineering.
They have to call up your mobile provider
and somehow convince them that they are you and that you've gotten a new phone.
It happens.
It can happen.
It's not particularly common, but it is something to be aware of.
Now, let's say you don't have a cell phone at all.
All you have is a landline.
Some providers, not all but some providers,
will allow you to do the same thing as SMS text messaging using voice.
What that means is you give the provider your voice number
and when it comes time to log in, they call you and they tell you. They speak
to you a six digit code that you then enter to prove you are the person who is
able to access calls received at that number.
That's your second factor.
I'm not a huge fan of this, but it's still better than no Two-Factor at all.
And finally, the last one is email messaging.
This is actually a very viable solution.
If you don't have a phone,
you don't have a mobile phone or you don't want to deal with a smartphone. Instead
of sending you a code via one of those devices, they email you one.
So when you log in,
your second factor is your ability to prove that you can access the email
account associated with your service and enter the code that was emailed to it.
The downside and honestly, the only downside that I've ever
experienced is that there tends to be a delay.
The security is as secure as your email account.
So as long as you keep your email account secure from getting hacked itself,
using it as a second factor is also a very viable approach.
Now, I do want to point out that there is one solution that is explicitly not
a solution, in my opinion, and that's not using Two-Factor at all.
Many people,
when faced with the complexities of Two-Factor,
when faced with the unknowns of how Two-Factor works, they simply say
too complicated. Not going to do it... Is not an option.
There's also these folks that say, you know what, I heard SMS can be hacked.
So I'm not going to do Two-Factor. Not an option.
Any of the methods that I've mentioned as
Two-Factor, authentication makes your account more secure.
Even the worst one makes your account more
secure than not using two factor authentication at all.
So I strongly recommend you consider using
authentication that includes two factor authentication.
My preference in order for most consumers is Google authenticator for anyone
with a smartphone, specifically the Authy app,
which is Google Authenticator, compatible. Yubi Key
If you have a very high security need.
Generally for average consumers, you don't.
But for some you may feel that you do.
And it's a very, very secure solution.
SMS text messaging is my number three
solution because, honestly, it still is way more secure than no Two-Factor at all.
Email messaging, because it's the next most convenient. Voice messaging,
because it is also an option for those that don't want to face the delays
of email, and anything else that your provider offers.
Any Two-Factor, authentication is better than no Two-Factor at all.
Now, I do want to point out that all of this is nice.
It sounds like we've got all of these options.
But the real limiting factor besides what you're willing to,
do yourself is, of course,
whatever is offered to buy the service, you're attempting to set up the Two-Factor
authentication. Which that, in my experience is actually the more
limiting factor. Use the best one that they offer. But use it.
For updates, for links related to this article that this video is based on,
for comments and more, visit Askleo.com/130305.
I'm Leo Notenboom.
This is Askleo.com.Thanks for watching.