Two-Factor Authentication: What it is and Why You Should be Using it Now

Not too long ago, WordPress sites around the world started getting attacked with automated botnet traffic trying to brute force admin passwords.

The other day, the official
Twitter account of the Associated Press was hacked

Last year, Wired reporter Mat Honan was hacked when his Amazon account was compromised. That compromise allowed an attacker to access his Apple ID which gave him access to Mat’s Google account which, in turn, let the attacker into Twitter.

Email, in my opinion, is the gateway to identity theft. It’s bad if your Twitter or website are hacked. You get things like the AP hack. It’s bad, if an attacker gains access to your website and defaces it, or does something else. But as terrible as these things can be (and expensive), identity theft is something that is quite a bit more dangerous.

Here’s a scenario. Somehow, someway I gain access to your Gmail account. It could be that you have a pretty easy password, or you use the same password everywhere, or it can be from some other nefarious means. But I get access to your Gmail.

You might say, “well it’s only email and there’s nothing all that important there.”

But you’d be wrong. If I have access to your email, I have access to everything else. Can’t remember your Amazon password? That’s fine. I can perform a password reset, and gain access by clicking on a password reset link. Then delete it so you never even know it was there. Once into Amazon, using your saved billing information, I can run up your credit card info.

I might even be able to get into your bank, although that’s become significantly more challenging in recent years because of two-factor authentication (which I will get into momentarily).

I could potentially access credit records. Or, depending on the state or locality you are in, your driving and criminal records. And if there is something incriminating in your inbox, I might be able to blackmail you.

Granted, all of this stuff is extremely illegal, but I could still do it if I have access to your email account.

Side Point: Web services that use an email address as the login name are inadvertently dangerous. If I know your email address, I know your login. Then all I have to do is know your password. Whereas not having an email address as a login means I have to figure out BOTH your password AND your username.

Fortunately, Google has two-factor authentication. Amazon, Apple, Microsoft, and Facebook all have two-factor authentication as well. Banks, including Bank of America, all have two-factor authentication.

Two-factor authentication is your saving grace and you need to enable it on every account you have.

What is two-factor authentication?

The easiest way to explain what two-factor authentication is with the phrase, “Something you have, something you know”. You need BOTH things for authentication to happen.

You see this with some biometric systems. Enter a pin (something you know) and scan your thumbprint (something you have).

With banking sites, you enter a password (something you know) and you might identify a unique image (something you have).

You see this with SSH on Linux systems with ssh keys. You provide the server you are logging into with your public key (something you have) and in the “handshake” of authentication, it matches against your private key (something you know).

Google, Facebook and the other services providing two-factor authentication require you to enter your password (something you know) and then they’ll send a pin to your phone (something you have) that you have to also enter in.

It’s a pain in the ass, and certainly I hope technology reduces the friction that two-factor offers to the authentication process, but it’s incredibly important that you have two-factor authentication wherever you can.

Go re-read Mat’s nightmare and you will understand how vastly important that two-factor is. It’s a nightmare. It’s scary. It should be a come to Jesus moment for anyone that operates on the internet.

I will let you use the power of the internet to figure out how specifically to do this for various services, but this wouldn’t be my blog if I didn’t also suggest a plugin for WordPress (.org, not .com) to enable two-factor. I highly endorse the Duo Two-Factor Authentication plugin. I use it on several of my sites.

Hopefully, by enabling this stuff, we can not only stem off a vast amount of hacking attempts, but also become smarter about how we use the internet, protect our privacy and security and, even, in some cases… safety.

Be safe out there!

Bonus: More on 2FA from my friend Mika Epstein (@Ipstenu).

Thoughts on MobileMe and Apple

As I’ve spent the past 24 hours wiping my Macbook Pro and trying to get back up to speed, I thought I’d give a few thoughts on MobileMe, Apple Mail and Push/Cloud technology.

This is relatively raw as I am much more focused on getting back to work than I am “getting things right” as they say in the journalism business. I’m a user. I’m a tech guy. I’m a Unix guy. I’m an Apple guy. Those are the lenses I see this world through.

MobileMe Saved My Preference Life

MobileMe saved my life in terms of preferences, contacts and calendar. It was absolutely beautiful to watch everything sync beautifully back into place on a fresh install of Leopard.

Apple Mail no Longer Handles TLS/SSL Authentication

Apple Mail no longer wishes to communicate with my mail server running Zimbra. Mind you, the exact same setting exist between a parallel install of Thunderbird, but Apple Mail will not authenticate against a TLS based server. It was mildly flakey before, but it worked. Now it simply will not work no matter what combination of settings I try.

Standardize around Protocols, not Products

If I have to use Thunderbird, it would be nice if I could connect to MobileMe to sync my address book. Others, apparently, feel the same way. Why is MobileMe contacts and calendars not running on a WebDAV server that any client can develop communication prototypes against? If I have to use Thunderbird as opposed to Apple Mail, I lose the selling point of MobileMe.

Likewise, Apple is building for the software on the Windows side with people complaining that you can only use MobileMe with Outlook. What about Outlook Express, Thunderbird, etc?

What about Gmail, Hotmail, Yahoo Mail?

Bad software development always starts with developing against the symptom instead of the root problem. A better concept for MobileMe would be to develop around standard protocols: POP/IMAP/Exchange for Mail, CalDAV for iCal, WebDAV/LDAP for contacts.

Just some thoughts for the Apple Team. There’s probably more I can’t address at this time. What advice would you give the Apple product teams around their products, particularly their productivity products?

Bonus: Why is the Mozilla team not supporting native Mac datastores (Address Book) on their Mac products”?