Two-Factor Authentication: When is it worth it?

Question

I was reading this article, and it triggered the question: Why not use two factor authentication? In his case, it both possibilities were enabled anyway, so this looks to me like it's two attack vectors.

But more importantly, security is never absolute, but always something that should be adapted to the value protected.

The biggest disadvantage with two-factor authentication that I can see right now is that it might become slightly more work for the user. But when do I know that two factor authentication has become suitable in my "regular" life? When does one form of authentication become insufficient / When does one need to add the additional layer of security?

Answer 1

Answer: Two factor authentication is worth it when one form of authentication is not enough or when it makes sense to have an added layer of Security.

An Example of Two Factor and Why we need it For example (a tried and true), an ATM Machine. If someone swipes your wallet then they could go to town on your bank account if ATM Machines did not require a pin. If someone figures out your pin through some kind of passive attack then they are still forced to get your card somehow. The What you have is usually called a token.

Minutiae of getting Two Factor right Important to note is that 2factor authentication requires authentication of different kind. In my example, Your ATM Card is Something you have while your pin is Something you know. Also note there is a throttle set on pin attempts. You can only attempt to put in your correct pin n number of times before you become locked out.

Further Details I think it is totally worth it to have two-factor authentication on your email account. Two-factor authentication makes it really difficult for someone to guess your password without also stealing your token. It certainly can't hurt and it has actually become fairly convenient. Facebook/Google both can text you a pin number. I think that's pretty damn convenient (as long as you don't register your google accounts 2factor phone number to your google voice account...). The reason that password authentication isn't enough is all the bad practices people have managing and creating passwords. Weak passwords and passwords stored in plaintext (like in firefox) makes it really easy to put yourself in a bad situation if time are careless.

When should YOU use it. Like many things in life this is simply a tradeoff. If you think you value the added security over the burden of needing to authenticate twice then you absolutely should use 2fac. On your personal email? Probably. On a junk email or a forum account you don't care about then probably not. It really is that simple.

Answer 2

You ask an interesting question.

"... when do I know that two factor authentication has become suitable in my "regular" life? When does one form of authentication become insufficient / When does one need to add the additional layer of security? "

My answer is... it depends on how paranoid you are. If you're at all like me, you'd use two factor everywhere you can. Literally, everywhere it's available, it doesn't matter if I'm going to have PII information, private documents, a backup of my family photos, or even publicly available information.

Right now I have it on all of my cloud storage solutions; if a cloud storage solution doesn't have 2 factor, I don't use it. In addition, I have it on all of my email accounts, all of my social media sites, and with my website hosting company as well. If my bank had the option to use a soft TOTP token, I would use it there too, but sadly that hasn't made its way across the ocean from Europe yet.

My suggestion is that, at a minimum, you should implement multi factor authentication when you wouldn't want whatever you are protecting (storage, access to something, etc) to get into the hands of a hacker with nefarious intent.

One suggestion, however, is to make sure you know the policy of the products you are using 2 factor with, and have a backup strategy if something goes wrong. It is possible that you will lose or break your token (if it's a hard token like a key fob), or your soft token could become non-functional (you lose/break your phone which has it, your computer gets infected with a virus, etc).

I recommend Google Authenticator. I've reviewed their documentation and RFC and found it to be a strong, sound, and secure multi factor authentication solution. If you don't have a smart phone, you could also utilize SMS MFA.

https://code.google.com/p/google-authenticator/

Answer 3

If you read the Verizon DBIR, you will see that the vast majority of attacks use lost, stolen or easily guessed credentials. http://www.verizonenterprise.com/DBIR/2014/. The numbers for that have been consistently around 75%. If you are talking about protecting systems, then few other things can force an attacker to work harder than 2FA.