Tweet

The past few weeks have seen some very high-profile sites adopt two-factor authentication in one form or another. First was Twitter, followed soon by Evernote and Linkedin.

For users of these sites, these represent a welcome improvement to their security. In the event that their password is (somehow) compromised, an attacker faces another barrier before they can gain access.

There is still room for improvement. All three services use text message verification – i.e., they send an access code to the user’s phone when somebody tries to log in. Unfortunately, mobile malware can also intercept text messages: it is possible for a clever attacker to intercept these.

An alternative which some sites use is an authenticator app, which generates the verification code on the device. Some sites require their own app; other sites are compliant with RFC 6238 so that a single app can authenticate multiple services.

There are also some usability challenges. Not all apps or operating systems allow the user to enter authentication codes (actually, relatively few do). In these cases, you need to create an application/device-specific password – if the service supports it. (Theoretically, a bad implementation of these could pose a risk as well.) In addition, there is the very real problem of people losing their phones. In the United States alone, 1.6 million people lost their smartphones in 2012. A large service rolling out two factor authentication has to consider some way for users to authenticate if they’ve lost their device.

This highlights the importance of the stolen device problem we talked about recently. Not only are mobile devices in and of themselves valuable and contain the user’s personal data, they can act as the keys to the rest of the user’s accounts.

Of course, these three services are not the only ones to introduce two-factor authentication. Many other high-profile companies like Blizzard, Facebook, Google, and Microsoft all support some form of two-factor authentication. Users should check which of their services support it and strongly consider activating it.