Should the email server/application be protected by 2 factor authentication? What applications should be protected?

Question

When should email be protected by 2 factor authentication?

Suppose a given company is in an industry where two factor authentication is offered to some or all of its clients. Does this mean that it should also offer (or require) two factor authentication to its employees?

If the roll-out of two-factor authentication doesn't target every applications in a company, what criteria should be used when evaluating an application?

Answer 1

I don't think there is a simple answer for this: your security demands may vary. If you fear keyloggers stealing your passwords, giving adversaries access to confidential email, then by all means use 2-factor authorization (among other techniques). However, if you only anticipate receiving relatively mundane emails then there isn't a need for it, and enabling it could be an extra burden -- e.g., if you lose your cell phone on vacation you can't log in to any of your systems.

Additionally, using 2-factor auth may encourage bad habits; e.g., you may think my phone is always on me; so I can use a simple easily guessable password. Then on systems that have been authenticated once, it may be straightforward for someone to guess your password.

In summary; 2-factor auth provides extra security when:

• users frequently authenticate from a variety of untrusted client computers that may be running keyloggers
• users don't mind the burden of needing to be able to receive text message/phone call to authenticate
• users don't always cache the first authentication (only cache on trusted computers; and still require the user to enter password)
• users are still required to have strong passwords in the second authentication
• web authentication still use https (or equivalent; e.g., ssh login) (prevent MITM attacks with spoofed servers; keep your password secret in case a valid token is later found).

As an aside, email by itself is not a good method for sending confidential data -- the email as its routed is sent in plaintext for any intermediate mail server/router/transport agent to read. You really should encrypt/sign sensitive emails using PGP (or similar) to protect the contents of emails from being read or secretly altered.