Two-factor authentication and keeping your business safe

To ruin a digital life, hackers only need a few moments. This is what happened to the American journalist, Mat Honan. His story is a great example of what occurs when users do not take enough steps to preserve their security on the Internet. In 2012 a group of hackers set Honan’s Twitter account as their target.

To hack his Twitter, they firstly got into his Amazon account. From there, hackers obtained the last four digits of his bank card, a type of information that usually appears in a lot of applications and websites which require payments. With these numbers, they logged on to Hanon’s Apple ID account, as paradoxically, this data was valid to verify user identity. Once inside, they gained access to his Gmail and unfortunately, the two-factor authentication of his e-mail account was not activated. Finally, through this last attack, hackers entered Honan’s Twitter account and used it as platform to spread homophobic and racist messages.

The journalist explained his nightmare on this Wired post and said that if he had activated the two-factor authentication of his Gmail, the damage would not have been that big.

Once again, this story shows that there are people with bad intentions and enough desire that could steal users information successfully. So, it is important that users and companies know all the cybersecurity tools they have to shield their systems. One of the most popular methods is called multi-factor authentication (MFA) or two-factor authentication (2FA or TFA).

What is two-factor authentication?

To log onto some applications and systems, users should confirm their identity by two security layers which try to guarantee authorized access. If there are more layers, that is multi-factor authentication. However, the most popular method for users is the two-factor authentication. This last one is based on some information which may include: data the user knows and something the user has got. For example, user name and password (data the user knows) and a smartphone where a number arrives (something the user has) via text message or an app. This number can be used just once (OTP – One Time Password) to make logging in more secure.

There is a third type of data on multi-factor authentication: biometric information of the user, like the fingerprint, facial or voice recognition, among other physical characteristics. However, this last method is not so widespread on websites and applications.

Nowadays, two-factor authentication is very well known among users, and that is why there are more and more services which use this security method to improve their protection. Google was one of the first companies that implemented it, and also two-factor authentication can be activated on popular social networks like Facebook and Twitter.

Typing passwords is tedious but necessary

Computer security is progressing constantly. Most of the time, it is forced by the threats of cybercriminals who don’t stop at creating and spreading viruses. This may explain how, a few years ago, users were only writing passwords and now they have the choice of activating mechanisms like two-factor authentication to increase the security of their systems and services accounts on the Internet. Despite data stealing happening every day, these security mechanisms are only optional for users. In other words, if they can choose to use them or not, they likely won’t.

It may be because the human being is lazy by nature. In passive activities like writing in front of the computer, we usually use the easiest method to perform some tasks, despite putting at risk our security on the Internet. So, it is not surprising that anything that could minimize or remove part of the sign-up or log on process is welcome.

That is why typing passwords is tedious, but it is necessary for those users who connect to the Internet or computer systems daily. Furthermore, everything suggests that we will be writing passwords for a long a time, despite the unstoppable cybersecurity development. So, we will keep creating credentials to access our systems and accounts.

One of the most common recommendations is not to use the same passcode on every website, but there are people who still do it. Passwords with small changes don’t work because if one of them is discovered, they are all exposed. This is what happened to Dan Kaminsky, computer security expert.

It was 2009 when a group of hackers accessed Kaminsky’s website servers and published personal information of one of the most important security computer experts. If this was not enough, they also showed that Kaminsky created poor passwords under the same pattern:

Is there any infallible method to prevent cyberattcks?

Passwords can be revealed and two-factor authentication can fail. Frequently, hackers obtain passcodes from users’ mobile phones through pirate applications which were downloaded intentionally. Android users are the most common victims of these kind of attacks when compared to iOS, but if you have Jailbroken your device, your passwords may be exposed, too.

There are also cases like the PayPal one. In 2014, the American company had a security breach which allowed avoiding the 2FA indicator on the user’s account.

Apparently, everybody is susceptible to being hacked, but all these examples show that users and businesses should make every possible step to reduce the chances. At the ODS team, we have created Wolf-Ray, a business solution to improve our clients security exponentially.

This unified authentication proxy protects the access systems of a company which works with online applications, as they are exposed to cyberattacks. For this purpose, Wolf-Ray operates with security protocols like two-factor authentication, among other mechanisms to strengthen the company’s protection. The best part of this solution is that businesses can give more freedom to remote staff without compromising their security. This is a big detail to consider as we are living in times where it is vital that each person and institution keeps performing their role in our society in the safest way.