In this pocket guide, you’ll find essential information about main security controls. I will explain the concepts, risks, share real-world examples and some interesting, less obvious insights.
Idea
Two-factor authentication (2FA) uses two forms of identity verification. It is also known as multi-factor authentication (MFA).
2FA is much stronger than one-factor authentication.
The factors are a combination of:
- Something you “know”, like a password.
- Something you “have”, like a mobile phone.
- Something you “are”, like a fingerprint.
You can verify that you have a certain mobile phone via several methods:
- SMS/text to a phone number. That is tied to possession of the number.
- Time-based One-Time Password (TOTP). That is tied to possession of a secret key.
- Push notification. That is a proprietary technology to deliver messages to a mobile device, which is not tied to a mobile number, but to a unique key instead.
How TOTP or Push keys differ from the traditional secrets? They are not accessible to the user, but tied to the user’s device instead. So the user does not need to “know” the key, but to “have” the device instead.
Another authentication factor is biometrics. User’s fingerprint or face image could be requested in addition to (or instead of) the password.
Please note that 2FA is applicable to user->system connections only. However, you can imitate multi-factor authentication for system->system connections via multiple authentication steps. For example – combination of secret and certificate. The correct term for that scenario would be 2SV – two-step verification.
Application examples
Your Internet Bank may request 2FA for high-risk transactions. For example – movement of the large sum of money, or payment to a new payee.
Risks
Mobile number is easy to spoof due to the “porting” attack. Many carriers allow porting of the existing number to an attacker if the attacker has the basic user knowledge, like full name, date of birth and address. Because of that, SMS/text is a weak authentication factor. It is the easiest to implement, though.
Additional verification via email code is not considered multi-factor authentication, because the user would need to provide two pieces of something they “know”. Two-step verification would be the correct term for that.
You can change the mobile number, device, or password, but you cannot change your biometric information. If it is compromised – it is compromised forever. For that reason, I do not use biometric authentication personally.
Quirks
Implicit 2FA is built into some communication protocols, where your computer, or your device fingerprint, is sent to the server alongside with the user’s password.
Mobile device authentication comes with the risk of losing the device. Most of the resources allow you to reset the second factor authentication via backup methods, like email code. As mentioned above – that is no longer 2FA, but 2SV rather.
Same concern goes to the solutions which allow storage (or sync, or backup) of 2nd factor keys in the cloud. If you access the storage via password, then you do two “something you know” challenges, instead of “something you know” + “something you have”.
Further reading
Pocket Guide: Authentication – Passwords
Pocket Guide: Authentication – Certificates
Please check out the map of cyber security controls below. It is simple yet awesome.
