What is 2FA and do I need it?
2FA (Two Factor Authentication) is an additional layer of security for your logins. Most people would know this as a secure code that is linked to an authenticator app like Microsoft Authenticator or Google Authenticator or a code that is sent to your mobile phone or e-mail.
Using 2FA means that if someone was to obtain your password they still wouldn’t be able to access your account as they would need a second code to be able to login and access your data.
It is highly recommended to setup 2FA on any of your accounts that contains data that you wouldn’t want another person to gain access to.
How do I setup 2FA?
Some websites make it mandatory to use 2FA, but many still don’t.
The process of enabling 2FA will be different for each service, but the setup can usually be found within your account settings and within the security sections of your app or website. We can help you with enabling and setting up 2FA on your accounts.
For example with Google, this setting can be found within your Google Account and then Security.
What are my 2FA options?
When setting up 2FA, you will be able to setup different methods for your 2nd layer of authentication, these can be:
- Passkeys – A secure private key that can be stored in a password manager or on a physical security key – Recommended Option & Highly Secure
- Authenticator App – You link your account to your preferred authenticator app (see below) – Recommended Option
- Physical Security Key – This is a physical key that requires you to press a button or wirelessly tap (see below) – Highly Secure Option, More Expensive
- Mobile Phone – A secure code is sent to your verified mobile phone – Less Secure
- Email – A secure code is sent to your verified e-mail address – Less Secure
Passkeys
A Passkey is a relatively new form of securing your accounts and provides 2FA all in one, a passkey combined with Face ID, Finger Print Scanning or Phone PIN.
When you sign up to a website and you setup passkey security you are asked to save your passkey to your preferred service – A passkey can be stored in places like 1Password, a physical security key such as Yubikey, Apple Keychain, Google Password Manager etc
This is an example of the Passkey settings area in Fastmail:
With a passkey you don’t have to come up with or generate a password, a secure encrypted key is automatically generated for you and stored. This takes choosing a password out of your hands and eliminates choosing a weak password or using a commonly used password. Another cool feature is it can pass the authentication duties off to another device such as your iPhone by scanning a QR code.
Passkeys also remove the risk of Phishing attacks as there is no password or code to steal.
I have been setting up Passkeys on my accounts where this method is available, you can check if your service might support passkeys here:
https://passkeys.directory/
Here is an example of logging into Fastmail with a passkey saved in 1Password:
What is an Authenticator App?
Setting up 2-Step Verification is commonly done with an Authenticator App, such as Authy, Google Authenticator, Microsoft Authenticator, Duo etc
The Authenticator App is linked to your account and will display a Token that expires after a short period of time like 30 seconds. This token is entered after you have entered your initial password. Some can also handle ‘Push’ notifications which can be a prompt to approve authentication or to enter a number that is displayed on the screen.
To link your Authenticator App to your account you will need to scan a QR code or enter in a manual code provided by the service.
At the moment I use Authy for my Authenticator App – Mainly because:
- I can set a PIN or setup face ID within the app, which adds a 2nd layer of security
- Accounts can be backed up to the cloud for easy recovery on lost or stolen devices
- You can enable Authy on multiple devices including your desktop if required (but use this with caution)
- I like the interface and design
The Authy code interface:
2FA codes can still be susceptible to phishing attacks or keyloggers where a password and 2FA code could be captured remotely and used.
For services that use a Push method of authentication, this prevents the above type of attacks as the user has to manually press Approve or manually select the displayed number. This requires a user to be discerning and to only approve valid requests, as hackers will rely on a user not being present and approving a popup just to get rid of the message.
What is a Security Key?
Recently I purchased a security key from Yubico to use and test out. This is a physical key that is used as a 2nd step of authentication. The key can either be physically plugged into your phone or laptop via USB or just tapped to your phone using wireless technology (NFC)
This means that for someone to gain access to your account they would not only need to have your account password they would also need to have physical access to your security key. And as many hacking attempts are made from passwords that are stolen remotely, this step adds a physical component to accessing your account, which renders remote attacks useless.
A security key could be a great option for any highly sensitive accounts that require added protection or in my case I use this on any of my accounts that have the option to use a security key available.
Yubikey example:
Mobile Phone
You can use your mobile phone as a 2nd layer of authentication where a code is sent via SMS or a phone call to your device.
However this option is considered less secure as there are a few methods where a SMS message could be intercepted, such as SIM Swapping, SIM Cloning, Man in the Middle Attacks etc (look these up for more information). To be hacked in this way would be unlikely, but it is possible.
You could also have a code display on your lock screen if this option is not turned off or if someone was to gain physical access to your phone they could gain access to your messages or if your messages are linked with iCloud they could also be viewable on your Mac/PC.
Note: With iPhone iOS18 now allowing the locking down of any iPhone application, it is now possible to lock down the messages app.
Sending a one time code to your e-mail address is another method that can be used for second factor authentication. This method is also considered less secure as emails can be compromised if not secured properly with 2FA and if someone was to gain access to your emails there is a high probability they could also reset your login password by sending a forgot password link via email. They would then have access to both your login password and 2FA code.
Important Note: Securing your email with 2FA is highly recommended as this is one of the main accounts where your important and confidential data is kept.
Further Notes
Attacks on accounts and data are becoming a daily threat. Securing your accounts with 2FA when it is an available option should be standard practice. Also to note is that no security method is 100% fool proof, but being informed and taking all the steps available to make your accounts and data as secure as possible is the best way to go.
~ Clete Diamond IT
