Progress pill
Implementation of solutions.

Two-Factor Authentication

Update Your Online Security

Two-Factor Authentication

  • Why implement 2FA
  • Which option to choose?
  • Conclusion of the course:

Why implement 2FA

Two-factor authentication (2FA) is an additional layer of security that ensures the person attempting to access an online account is who they claim to be. Instead of just entering a username and password, 2FA requires an additional form of verification.
This second step can be:
  • A temporary code sent via SMS.
  • A code generated by an application like Google Authenticator or Authy.
  • A physical security key that you insert into your computer.
With 2FA, even if a hacker obtains your password, they will still be unable to access your account without this second verification factor. This makes 2FA essential for protecting your online accounts against unauthorized access.

Which option to choose?

The various options for strong authentication provide different levels of security.
  • SMS is not considered the best option as it only provides proof of possession of a phone number.
  • 2FA (two-factor authentication) is more secure as it uses multiple types of evidence, such as knowledge, possession, and identification. One-time passwords (HOTP and TOTP) are safer than SMS because they require cryptographic calculation and are generated locally on your device, while SMS can be intercepted.
  • Hardware tokens, such as USB keys or smart cards, offer optimal security by generating a unique private key for each site and verifying the URL before allowing the connection.
For optimal security with strong authentication, it is recommended to use a secure email address, a secure password manager, and adopt 2FA using YubiKeys. It is also advisable to purchase two YubiKeys to anticipate loss or theft, for example, keeping a backup copy both at home and on your person.
As for potential threats to SIM 2FA, a common example is a SIM swap attack, where an attacker steals a user's phone number by linking it to a SIM card controlled by the attacker, there are several ways an attacker can complete the attack; however, this threat is usually only a major concern for high-profile individuals and people of interest.
Biometrics can be used as a substitute, but it is less secure than the combination of knowledge and possession. Biometric data should be stored on the authentication device and not disclosed online. It is important to consider the threat model associated with different authentication methods and adjust practices accordingly.
Finally, it may be useful to provide a brief context about HOTP and TOTP OTPs: HOTP is a one-time password based on the HMAC (Hash-based Message Authentication Code) algorithm, while TOTP is a time-based OTP. Key features of such algorithms are that passwords can only be used once, each generated value is unique, and a shared key exists between the user's device (client) and the authentication service (server). The primary difference between the two systems lies in how the factor is generated: the TOTP is time-based, whereas the HOTP system is counter-based.

Conclusion of the course:

As you have understood, implementing good digital hygiene is not necessarily simple, but it remains accessible!
  • Creating a new secure email address.
  • Setting up a password manager.
  • Activating 2FA.
  • Gradually replacing our old passwords with strong passwords with 2FA.
Keep learning and gradually implement good practices!
Golden rule: Cybersecurity is a moving target that will adapt to your learning journey!
authy
Authy 2FAHow to use a 2FA application?
security-key
YubiKey 2FAHow to use a physical security key?
Quiz
Quiz1/5
Why is it important to gradually replace your old passwords with those generated by a password manager?