Set up two-factor authentication (2FA) - another nice COVID-19 project

Now that you've all wisely used some of your pandemic spare time to start using a password manager – as recommended by my previous post -- it's time to move to the next step: using two-factor authentication.  This isn't as much fun as watching Netflix, but with a bit of learning and one-time effort, you can help avoid some pain in the future by reducing the chance of being hacked.   

Instead of jumping to the punch line -- the action to take -- I'm going to first explain why what I’m suggesting is important.  This is a long story but I've added some summaries throughout to help make the material below more digestible.

First, a password manager

If you always use your password manager to log into online services and if all your passwords are strong and unique, then:

• your passwords won't be guessed or brute-forced,
• your passwords are much less likely to be phished, and
• if your password is part of a credential spill (an attacker breaks into an online service and steals the file containing all their users' userids and passwords), it (your password) probably won't be cracked (whereas weak passwords definitely will be). (If that service stored passwords properly, yours won't be cracked, but if not it could be. You have little control over this.)

Congratulations!  You've protected yourself from the biggest attacks: phishing and (most) credential spills.  Both of these can lead to account takeover not only of the service in question but also of multiple other accounts by way of credential stuffing, where an attacker tries a known userid-password combination on a large list of online services.  Most people – not you, of course – reuse passwords like there's no tomorrow, making credential stuffing a very worthwhile attack 

 

TL;DR: Use a password manager on all your online services, as your first line of defense.

Why you also need two-factor authentication

But what it you don't use your password manager religiously (or not at all :) and are not disciplined with your passwords?  That is, you continue to:

• use some weak passwords,
• to reuse some passwords,
• to not use your password manager for at least some accounts, and/or
• to paste some passwords yourself into login forms

In that case you're still susceptible to phishing attacks and credential spills, so two-factor authentication (2FA) can provide you some additional protection.

Don't think, though, that by being very careful you can avoid the need for 2FA.  Even security professionals, who are vigilant with their practices and passwords, will generally use 2FA wherever it's offered by an online service.  They know that mistakes are easy to make and that defense in depth – having more than one security measure protecting something – is a very good idea.

(There is another type of attack: keyloggers, a form of malware (usually).  2FA might provide some protection against keyloggers, but in general, once a device of yours is compromised with malware, you're in big trouble no matter what you do. )

The bottom line is to always:

• choose strong and unique passwords for your online services;
• use a password manager to manage your account credentials (userids and passwords) and to autofill your credentials into login forms; and
• use 2FA, on all services that support it.

TL;DR: Use 2FA on all your online services that support it, as your second line of defense.

But what is 2FA?

That was a long-winded "why" that hopefully has convinced you that you need to use 2FA.  So now on to the "what".  We'll start with the difference between "two-factor authentication" (2FA) and another term you may have heard of, "two-step authentication" (2SA) (or "two-step verification", 2SV).

To substantially simplify the story, the "first factor" of authentication is usually your password -- something you know – and the "second factor" of authentication (2FA) is either a physical object whose ownership you can prove – something you have – or some biometric aspect of your body – something you are.  If instead of a second factor -- a physical object or a biometric -- you use some other input into authentication, that's called a "second step" of authentication (2SA). 

A second factor is harder to compromise and so provides stronger protection than a second step, but the latter is often good enough and is always better than just using a password.  It's important to note that it's not always agreed on whether a particular thing is a second factor or a second step – so the difference is a continuum, not black and white. 

 

The rest of this post will use only the term 2FA, but in it I’m including the entire 2FA/2SA continuum.

By the way, you'll also see the term "multi-factor authentication" (MFA).  MFA is a more general term than 2FA in that all 2FA is MFA, but all MFA is not 2FA, because MFA encompasses more complex combinations of authentication inputs than 2FA does. This post deals with the simpler case of 2FA.

TL;DR: In general, use whatever is available on a particular online service, whether it's called 2FA, 2SA, 2SV, or MFA.  (I'll call it "2FA" below for simplicity.)

 

Flavors of 2FA

There is a wide range of types of 2FA used across online services.  Most services support only one type but some support more than one.  If you have a choice for a particular service, how do you know which to pick?

 

The types of 2FA can be ranked very roughly as follows, from most secure (#1) to least secure (#7):

1. biometric (you likely won't see this for authenticating to online services since biometrics should not go to the cloud for security reasons)
2. hardware token or security key (e.g., U2F, YubiKey)
3. push verification (e.g., Google Prompt, Apple trusted device, Microsoft Authenticator)
4. TOTP authenticator app (e.g., Google Authenticator, Authy)
5. email verification
6. SMS (text) verification
7. phone call verification

If an online service gives you a choice, simply choose the type highest up the list.

The three types that you are most likely to be able to use are hardware token, push verification, and TOTP authenticator app.  Hardware tokens are very secure but not that convenient, because you need to always carry a physical token with you.  The push notification type is very secure but for consumers it is mostly limited to apps/services from companies like Google, Apple, and Microsoft.  The authenticator app type is much more widely available and is quite secure.  Authenticator apps typically generate 6-digit codes that change every 30 seconds, a scheme called Time-based One-Time Password (TOTP).

SMS and phone call 2FA are the least secure and should be avoided unless there is no other alternative.  Before you decide to use SMS or phone call 2FA using your mobile number, recognize that they won't work if you put a different SIM card in your phone when traveling.  (To be clear, SMS for 2FA is usually better than no 2FA so if a service offers only SMS for 2FA, you should probably use it.)

With TOTP 2FA you're not invincible!  Be aware that using an authenticator app provides some but not complete protection from phishing, because TOTP codes can be phished (as with passwords).  Your combined best and most convenient protection against a range of threats is using a password manager and an authenticator app.

TL;DR: For most services, use a TOTP authenticator app to add 2FA.

 

Which TOTP authenticator app?

There are, very roughly, a dozen different authenticator apps available on any OS platform, so how to choose one?  The great-grandparent is Google Authenticator, and most services, when they offer 2FA using an authenticator app, will use the term "Google Authenticator".  So most users will choose that app -- but you could choose any of the dozen apps available, because they all generate the same TOTP codes.

This list will help to explain the differences between the types of TOTP authenticator apps.  I've only shown the most popular ones.  (These "types" are my own cooked-up classification scheme.)

• Type 1: Single-device, mobile only: Google Authenticator (see Note 1 below)
  
• Type 2: Multi-device, mobile only: Microsoft Authenticator, LastPass Authenticator, 1Password Authenticator
• Type 3: Multi-device, cross-platform: Authy

A Type 1 app is installed on a single mobile device (usually a phone), so if you lose that device or buy a new device, you need to go into every online service you had set up with it, to run through the 2FA recovery process to reconnect the service to a new device.  That's painful.

A Type 2 app is a great improvement in that the data is backed up to the cloud: so you can easily move your online services' use of 2FA over to another device.  But Type 2 apps are only available for mobile devices, which is an inconvenience.  

A Type 3 app backs up data to the cloud like Type 2 and is available on most all mobile and desktop platforms.  With a Type 3 app you can install it on all your devices and access your TOTP codes from any device at any time.

Authy (https://authy.com/) is the only Type 3 app available and is my suggestion for most people (outside of enterprises) and most online services.  You can learn more about Authy and how to use it in this excellent article:  https://thewirecutter.com/reviews/best-two-factor-authentication-app/

Alternatively, the other four apps are fine to use as long as your understand their limitations.  In particular, the 1Password Authenticator -- because it's integrated into the 1Password service (which is arguably a negative for security) -- can't be used to provide 2FA for the 1Password service itself; so you'd still need to use anther authenticator app, like Authy, for that.

TL;DR: Use Authy for services for which you want to use TOTP 2FA.

 

How to Authy

To use Authy, install the Authy app on all your devices (computers, phones, and tablets), set up a Backups Password using one Authy app, and enter that password into all the other Authy apps on all your devices, so that your Authy apps all sync with each other and your TOTP codes are available from all devices.  

Then, to add Authy 2FA for an online service, log into the online service on a computer and trigger the 2FA setup process.  This will display a QR code on your screen, and you'll use the Authy app on a phone or tablet to scan it.  The TOTP code for that online service will become immediately available in the Authy app on every one of your devices.

Authy is a zero-knowledge service, which means that all the 2FA data about your online services is stored in Authy's cloud service in such a way that Authy itself (or an attacker breaking into their cloud service) cannot access it – only you can – as long as you choose a strong Backups Password.  So, as you would for any password, choose a long random string and store it in your password manager.  

But – and this is important -- also store it somewhere else.  Or print it out and save the sheet somewhere secure.  Otherwise, you can paint yourself into a "recovery corner".  To wit: you'll use Authy 2FA to protect your password manager, so logging into your password manager is dependent on Authy; and you'll store the Authy Backups Password in your password manager, so reinstalling Authy is dependent on your password manager.  

Imagine that you then go traveling with only your phone and for some reason (loss, theft, failure, etc.) have to reinstall your apps (this is a type of recovery process).  Just knowing your password manager's master password won't be good enough (as it was before you added 2FA), and you'll be stuck in that recovery corner.  There are many ways to address this (I listed two above), but you need to pick one and implement it ahead of time.

A related issue: to create an Authy account you'll need to provide both an email address and a phone number; and for recovery purposes the phone number is the more important of the two.  Make sure that you have access to that phone number when you're traveling, in case you need to reinstall the Authy app.  If you normally get a local SIM card when you travel, make sure you take your home SIM card with you (if that's the phone numbers you used to set up your Authy account).  If you can, use a VoIP number for Authy instead of cell number, and you'll avoid this issue -- a Google Voice number is a great choice.

TL;DR: Install Authy on all your devices; carefully choose which phone number to use; and plan ahead for recovery.

Use it everywhere

Finally, what online services should you use Authy with?  Once you start checking your accounts for 2FA or not, you'll notice that it's generally your important online services that offer 2FA, and the unimportant ones tend not to.  (By the way, this website offers a great way to quickly check on any online service's level of support for 2FA:  https://twofactorauth.org/)

So set up 2FA on all your online services that support it, but start the migration with your most important services – usually your password manager and your email accounts (and not your bank accounts as you might imagine).  Any email account that you use as the ownership email address (or the security email address) for any of your online services is very important to protect.  That's because if an attacker can take over such an email account, they can usually take over (using the password recovery process) any online service that is tied to that email address.

TL;DR: Set up Authy first on your password manager and main email account(s), then move to the rest of your accounts

Congratulations

We're done! If you use a password manager and do so properly, if you set long random passwords on all (or at least your important) accounts, and if you set up 2FA (such as Authy) on all accounts that support it, you'll be resistant to many of today's online security threats, and way ahead of most people.

~~~~~

Good reading:

• Use Authentication Apps for Multifactor Security - Consumer Reports
• Why You Should Stop Using SMS Security Codes—Even On Apple iMessage (forbes.com)

Note 1:  2020-05-07: Google has added an import/export feature to the Android and iOS versions of Google Authenticator.  It's not the same functionality as Authy, and it's not as powerful as Authy's multi-device feature.  See: https://security.googleblog.com/2020/05/introducing-portability-of-google.html

Set up a password manager - a nice COVID-19 project

You might have some extra time on your hands right now given that COVID-19 thing going around. You could watch another streaming movie -- or you could do something you've been putting off for a long time: setting up and starting to use a password manager.  It's a key part of security hygiene, and a nice complement to hand-washing and elbow-coughing.

Why your passwords are so bad

You may have heard that reusing passwords is bad, but you probably don't know why and you don't know how you'd manage a unique password per account anyway. You've definitely heard about phishing but don't know how best to save yourself from it. And although you may have heard about password managers, you may not fully understand why using one is so important to your cybersecurity.

There are two main reasons, one you can see and one you can't:

1. If you receive a phishing email/SMS that sends you to a web page that looks just like your bank's, and without noticing you enter your userid and password, your account may be taken over and drained – a password manager can save you from that.
2. If you reuse your favorite password on a dozen websites (online services) and one of them gets hacked, resulting in a "credential spill" of users' userids and passwords, attackers will try the stolen credentials on a variety of sites, and they'll be able to break into your 11 other accounts – a password manager can save you from that too. (This attack is called credential stuffing.  If you doubt how often online services get hacked, check for hacks affecting your email addresses using https://haveibeenpwned.com.  And register your email addressees there too, to get notifications when hacks happen in the future.)

Update 2021-06-04: A much better description of the risks of bad passwords:

How to hack into 5500 accounts… just using “credential stuffing” – Naked Security (sophos.com)

How to fix them

To protect you from both phishing and credential stuffing, respectively, you need the following for your passwords:

1. your passwords are not in your head, so you cannot type them into login pages, and
2. every account has a long, random, and unique password. (Long means, say, 20+ characters.)

Enter the password manager

So how do you manage passwords for your (hundred?) accounts if you don't know them and if every one is unique? You use a password manager: it will generate a random password for you for a new account and will store the userid, password, and URL for each account, and later will autofill the userid and password into that account's login page.

Because the password manager carefully examines the login page's URL (domain name, actually), it won't be fooled by phishing pages. And because all your passwords will be unique, any hack of an online service means that only your account on that service is at risk, not a dozen or more other accounts too.

And there are at least three other benefits of moving your accounts to a password manager:

1. all the pain of remembering your passwords, and resetting them when you forget, goes away as your password manager is doing all the remembering for you; 
   
2. you can log into your accounts from any of your devices, whether you're at home or away (and you can manage your password manager's vault on all your devices); and
3. you are setting yourself up nicely for moving to two-factor/two-step authentication (2FA/2SV), which will help to make you even more resistant to account takeover.

What will it do for me?

At a very high level, this is what a password manager does:

• It provides apps that you install on your computer(s) and mobile devices(s), to access the password manager service.  It also provides a website that you can use to directly access the password manager service, without using an app. 
• It maintains a database (aka vault) of entries, one for each of your accounts, with each entry having a website URL and the associated userid and password for your account on that website.
• It stores the database in the cloud (on the password manager's servers) and syncs the database automatically to/from your devices.  So any changes you make to the database in the cloud or on one devices are reflected in the cloud and your other devices.
• It automatically records your logins to websites that are not yet in your database, storing the website URL, userid, and password.
• It lets you play back any entry from your database to quickly log you into a website you previously recorded. 
• It lets you manually create, edit, and delete entries in your database.
• It lets you import the database from some other password manager.
• It lets you export the database so that you can import it to some other password manager, 
• You can all the above using the password manager computer app.
• You can do all the above -- except for recording, import, and export -- on the password manager mobile app.

Which one to use?

Now that you know the why of a password manager, the which and how are not that complicated.

For which one, I suggest you look at one of these well-respected password managers:

• Bitwarden, whose free version meets most people's needs; see https://bitwarden.com/
• LastPass, which has (an unusable) free version and a couple of paid versions; see https://www.lastpass.com/
• Update 2023-01: LastPass had a big data breach in 2022, and appears to no longer be a good choice.
• 1Password, which has a couple of paid versions; see https://1password.com/

And how to do it?

Do this from your computer, not a mobile device:

• 1. Go to the password manager's website, choose the tier you want: free, premium, family, business, etc.:
• If you are a family, check out these family tiers, which provide manageability of the individual accounts in the family:

• https://www.lastpass.com/family-password-manager
• https://1password.com/families/
• https://bitwarden.com/pricing/ > Families Organization

• If you are a business:

• Look at these business tiers, which provide manageability of the individual accounts in the business:
• https://www.lastpass.com/team-password-manager
• https://1password.com/business/
• https://bitwarden.com/pricing/business/
• Don't mix personal userid/passwords in the same password manager account as business ones: use two separate accounts.  Both the suggested password managers allow you to access both sets of userids/passwords all the time.

• 2. Create an account.  You'll need to create a strong and memorable "master password" to unlock your password manager.
• 3. Download and install the password manager's apps and browser extensions on all your computers, tablets, and phones, and log into these apps (using your master password) so they are all syncing to the password manager's online service.

You're now set and can start using the password manager.  

These how-to notes will point you in the right direction: 

• You'll need to store each of your online accounts, one by one, into your password manager. 
• Your password manager will help by automatically recording the details whenever you login to an online account in a computer browser.
• Once a login (userid and password) is stored for an account, use the account's password change feature to set a new password; your password manager will general a long random string for you (choose 20+ characters) and will then record it.
• Start that recording and changing with your most important accounts. 
• Your most important account is not your bank; it's the main email address that you use to create new online accounts. Why? If an attacker gets control of that one email account, they can take over most of your other accounts using their password recovery mechanisms.
• You can export the contents of your password manager as a spreadsheet file anytime you want
• But don't store this anywhere that is not encrypted!  
• In particular, if you're on Windows Home (and not a Microsoft Surface or similar device), your main drive is not encrypted, and anyone who gets access to your computer can remove the drive and read its contents.
  
• It's a good idea to back up the contents of your password manager occasionally, say, every three months.  
• If your main drive is not encrypted (see the previous bullet), you could store the export in a VeraCrypt container, protected with a strong password.  (Don't reuse your password manager's master password for this -- password reuse is always bad.).  
• Bonus points if you store a copy of this VeraCrypt container somewhere outside your computer, such as a USB thumb drive.
• Or you could store the export unencrypted on a USB thumb drive, as long as you hide that thumb drive really well.
• As an aside, if you're an Apple-only user tempted by Apple's built-in password manager, I suggest you not use it for three reasons: 
1. if you ever decide to do something outside the Apple ecosystem -- like buy an Android phone or tablet, a Chromebook, or a Windows machine -- you won't be able get your passwords on it;
2. you probably back up your Apples devices (and their keychain) to iCloud -- which is not an end-to-end encrypted service; and
3. independent security researchers tend to pay more attention to the big third-party password managers (like LastPass and 1Password), which means their vulnerabilities tend to get identified quicker.

Why should I trust it?

If you're (rightfully) concerned about trusting the cloud with your passwords:

• Know that high-quality password managers (like LastPass and 1Password) are end-to-end encrypted (E2EE) services (a.k.a. "zero knowledge"). 
• That means that all your data (userids, passwords, URLs, and associated notes) is encrypted before it leaves your device for the cloud, using an encryption key that never leaves your device (and is based on your master password). 
• As a result, if an attacker manages to break into an E2EE service and steal every bit of data (including yours), they won't be able to decrypt any of it.  
• You can do a web search on "end-to-end encryption" for more information.
  

Setting up a password manager does take a little bit of learning and time, but once you start using a password manager, you'll wonder how you ever lived without one. And it's an ideal project for a bit of COVID-19 down time.

I'll cover two-step authentication (2SV) and two-factor authentication (2FA) in my next post.  But the TL;DR is: set up Authy (https://authy.com/) and use it to enable 2FA on LastPass ASAP; your password manager is not very secure without 2FA.

---

Update 2021-05-31: 

There are 3 steps to changing a password to long and random:

1. Generate a long and random password: LP will do this for you
2. Go to the service's password change page and change to the new password: you have to do this, using the password generated by LP.
3. Update your LP vault entry with the new password: LP will do this for you most of the time (there will be a pop-up dialog box asking if you want to update the vault). If you don's see the pop-up, you have to manually edit the LP vault entry with the new password.

After you're comfortable with LP, I encourage you to review all LP settings everywhere:

1. mobile app > Settings
2. browser extension: Web browser > LastPass extension icon > Account Options > Extension Preferences
3. lastpass.com Vault: Web browser > LastPass extension icon > Open My Vault > Account Settings > Show Advanced Settings (and notice this is a dialog with multiple tabs)

FutureBiz Penticton talk last December

December 4, 2019, I spoke at the popular annual FutureBiz Penticton conference.  My talk was called "Information Security, Cybersecurity and Privacy... an ounce of prevention...".

All the speakers are listed here, along with the decks they presented.

My own presentation deck is here.

Another Security and Compliance Talk in Kelowna - Jan. 14

On January 14 in Kelowna I'm going to be presenting another Security and Compliance Talk. This will be the first time that I'll present such a talk at the excellent Okanagan coLab facility. Thank you to Okanagan coLab for supporting this talk.

This talk will be geared toward professionals, single-person businesses, and small businesses, including startups.  Most of my past business talks were oriented more toward larger organizations, and my talk this month will be much more for organizations with 1 to 10 people.   That size of organization will find my upcoming talk much more concrete and actionable than past ones.
 
Please register here: https://kelowna-security-compliance3.eventbrite.ca

Security and Compliance Talk Start the new decade on a secure foundation

Information security and compliance (including privacy) for your business or organization involves more moving parts than you might think. This talk will provide an overview of the security and compliance space to help you decide which parts your organization needs and how to implement them.

Join us to learn how to secure and protect your business or organization and its information, people, processes, computers, devices, networks, cloud services, etc.

We'll cover this and more:

• security and privacy threats and resulting risks that your organization faces
• key measure you can take to mitigate the risks
• frameworks and resources to help you create and manage your security, compliance, and privacy programs

Tuesday, January 14, 2020 Doors open at 15:45, talk runs 16:00-18:00 Okanagan coLab 1405 St. Paul Street, Kelowna, BC Affinity Hall, Second floor Presented as a public service by Garland Sharratt Information security consultant Thank you to Okanagan coLab for supporting this talk Free of charge but registration required:  https://kelowna-security-compliance3.eventbrite.ca