Security today is a really big issue, and one of the best steps you can take to keep yourself secure is to use two factor authentication.

What is two factor authentication?

Currently you probably use a username and password to identify yourself to services. This is the concept of logging in using something you know. Anyone with your username and password can log in as you. Two factor authentication adds the concept of logging in with something you have. Once two factor authentication is turned on, an attacker not only needs to know your username and password, but they also need something you physically have. This makes an attack a lot harder to pull off.

[perfectpullquote align=”right” cite=”” link=”” color=”” class=”” size=””]Once two factor authentication is turned on, an attacker not only needs to know your username and password, but they also need something you physically have. This makes an attack a lot harder to pull off.[/perfectpullquote]

The most common form of two factor authentication uses your cellphone. After you enter your username and password on a site, the site will text you a code you will need to enter to complete the log in process. The code can also be generated with an app on your smartphone, or, sent through the service’s app as a notification on your smartphone. Google uses the Google Authenticator app to generate a code to use at log in, while Twitter can receive the code through the Twitter app.

A downside to using text messages is that the process of text messages on the cellphone provider side isn’t the most secure. There are ways for an attacker to intercept your text messages, and then get your code.

Instead of generating a code, Google can now use the Google app on your Android or iOS device and let you confirm that you are trying to log in by simply answering a yes/no question. This is a lot easier than have to deal with codes.

My smartphone was run over by a bus!

What happens if you lose your smartphone, or it gets destroyed? When you turn on two-factor authentication, the service will usually ask you to generate a list of codes. These codes will let you log in without your smartphone, so after the list is generated you will want to put them in a safe place. Lastpass would be a good way to securely store generated codes. Each code can only be used once.

It’s a good idea

Turning on two-factor authentication does add a level of complexity to day to day usage of services, but it’s a good idea to still turn it on. At the very least, you should have two-factor authentication turned on for your main email account. This account is very important, because if an attacker gets access to your main email account, then can reset the passwords and email address for all of your services, taking over your life. Just ask Mat.