Multi-factor Authentication (Two Factor Authentication)

Originally Posted 2/24/24

What is it?

Multi-factor Authentication (MFA) is a security feature that is at least an option for almost anything online now a days. It's sometimes referred to as Two Factor Authentication (2fa). It works by typically pairing an app or your phone number to the website or service you're using so that when you login it sends a code to your phone. The idea behind this is it's unlikely someone would have both your password to login to something, as well as your physical phone. On top of that, your phone probably also has another password you use, meaning if someone had your phone they still might not be able to approve the sign in request. This can also take the form of Apple or Google sending a prompt to your phone to say "yes this is me" when trying to login to one of their services.

Why is it important?

As I spoke about in my Passwords and Password Management post, you can have one of the most secure passwords possible, but if the website you use that password with is compromised, suddenly hackers could know your password. Then it doesn't matter if it's a ridiculously long and complicated password, because the hacker would just know it. Two factor authentication adds a separate safety measure to stop someone from accessing your account, since even if they have your password it would send a notification to your phone which you could either just ignore or decline. I would recommend if you get random two factor authentication notifications to change your password for whatever though.

How do I set up Multi-factor authentication?

This is going to change from site to site. In general it will be under privacy settings, and you can choose to turn it on. Typically it'll either let you put in your phone number to receive the code via SMS (text message), or you can choose to scan a QR code with an app on your phone. There are many options you can choose for an app for multi-factor authentication. The password manager Bitwarden (which I talk about in my passwords post here) has a built in 2fa option for example. Currently I've been using the app 2FAS Auth on Android. My thought for using a separate app is so if my bitwarden account was ever hacked, they wouldn't have access to both my login information and two factor authentication codes. But, there are plenty of apps you can choose.

When you setup two factor authentication, you'll usually be given a bunch of codes after you've paired with the app you're using or confirmed your phone number. These are very important and save them somewhere safe (like google drive or a removable flash drive you don't lose or something). These codes can be used in the case you ever lose the app that has your 2fa codes in it, or lose access to your phone number. If using an app, one thing too is that if you get a new phone the 2fa codes won't typically be available when you re-download the 2fa app on your new phone. It's important if you get a new phone to transfer the 2fa codes to the new phone. If you use something like Bitwarden, it might sync over automatically. If you use a separate app however, you might be able to simply export your authentication codes (this varies from app to app). However, if none of that works, that's when those codes you were given would come in handy. You could put one of them to disable multi factor authentication on whatever program, and then re-enable it with your new phone.

Conclusion

I wanted to put out something touching on Multi factor authentication to try to explain it to anyone who wasn't quite sure the point of it. I also wanted something that would be a shorter post than my last one on FreshRSS. Let me know if you have any questions, comments, or suggestions for future things to write about! Send an email to steventanzimedia@gmail.com.