How can email address account as the weakest security link be prevented?

Question

Internet accounts nearly always use email addresses as the way to logon. If you forget your password, it is often easy for anybody to just request a way to reset the password. So assuming you have one email address with many common website accounts, once someone hacked into your email address account, they would be able to control many other accounts.

Is this something we have to just be careful about by being cautious with where we login and using good passwords, or are there common tactics from user and website perspectives to combat this?

Answer 1

Two factor authentication solves most issues.

Ideally we would be using more than two, but that is what the web is currently built around. Enforcing the use of not only a password, but that with something the user has (a smartphone/tablet), security for the respective account is increased. Not only does the attacker have to breach the account, but also the portable device.

Steam, a gaming platform, allows users to tie their account to a mobile token. This generates a one time series of characters and numbers that must be entered when logging in.

Google uses it's own system, the Google Authenticator, which is leveraged off a Time/HMAC based One-Time password system.

While most attacks on the internet are done from a very remote location compared to the user, a hardware token does not solve the problem that a local attacker could simply enter the code. This is where biometrics come into play, but aren't integrated into the public internet as of yet.

Web Links:

https://support.steampowered.com/kb_article.php?ref=8625-WRAH-9030

http://www.techrepublic.com/blog/google-in-the-enterprise/use-google-authenticator-to-securely-login-to-non-google-sites/