Security Advisory: You Should Use Two-Factor Authentication

Passwords are rapidly becoming less and less protective of your online information. And at the same time, we're putting more of our lives online and standing to lose more from someone breaking that security. And don't think it can't happen to you: you probably heard about Wired writer Mat Honan, who recently had his Amazon, Apple, Gmail, and Twitter accounts hacked and his iPhone, iPad, and MacBook all wiped with no backup—because the hacker thought his Twitter username was cool.

Two-factor authentication is an easy way to add a great deal of security to accounts that support it without really losing much. In Mat's case, he would never have lost all his data had he had two-factor authentication enabled on his Gmail account, and he urges everyone to turn it on. Here's why (and how do to it).

What exactly is two-factor authentication? In its most common usage, it means that logging in requires not only a password (in security speak, "something you know"), but also an item with some sort of cryptographic key or other code ("something you have"). This item can take the form of specialized hardware such as a smart card or a device that displays randomly changing numbers, a flash drive, or a decidedly low-tech sheet of paper with one-time-use numerical codes printed on it. It can also be a smartphone app or a server that distributes codes via text message or phone call, which is the simplest to implement for average users and the method I'm focusing on in this article.

Two-factor authentication works really well with very little sacrifice on the part of the user. If you're using two-factor authentication, if somebody gets your password, you're not screwed yet—they still have to get hold of your phone. In the case of Mat's recent hack, the hacker never knew him personally, so he would have had no chance at his phone or list of backup codes—both physical objects—making the rest of the damage he did impossible. (Furthermore, depending on his settings, Mat might well have received a random text message with an authentication code—a dead giveaway that somebody had tried to access his email account.) And it's not a major inconvenience to you. With many services, like Google, you don't even have to do anything different on computers you use regularly; you just use them once and check a "remember" box. On other computers, you simply have to take fifteen seconds to pull out your phone and type a number into the computer. It's a pretty small price to pay for making it nearly impossible for a random stranger to destroy your online life.

I was one of the first wave of people who signed up for two-factor authentication at Google when it was first released. I'll freely admit I thought it was a gimmick and paranoia when I did, but I thought it couldn't hurt. But with the latest batch of password database cracks and now this widely-publicized Mat Honan business, I think the world is changing. Passwords just aren't enough anymore, even good ones—a good portion of breakins now don't even involve cracking a password, they involve stealing passwords from somewhere, using weak password reset or security question vulnerabilities, or tricking customer service into letting you into someone else's account. Those are all things which you can't control, except with two-factor authentication.

Nowadays I think everyone should enable two-factor authentication right now. A few minutes now just might save you an awful lot of trouble later!

With Google accounts, you can have codes texted to you or delivered by voice call when you need to log in, or you can install a smartphone app called Google Authenticator which works even when you're offline. In case you need to log in when you have a dead battery or no service, you can print out a list of single-use backup codes and keep it in your wallet (you could even memorize one in case you're stuck without even your wallet). They've really covered just about everything at Google.

Here's how to enable two-factor authentication on your Google account.

1. Log into your Google account if you're not already logged in.
2. Visit http://accounts.google.com. If it's been a while since you logged in, you may have to confirm your password.
3. Click the Security link on the left.
4. Next to "2-Step Verification," click Edit.
5. Click "Start setup" and give your phone number if it's not already on file in your account. You'll receive a text message (or call, if you're using a landline or SMS delivery isn't working) with a code to confirm your phone.
6. Check the box if you want to "trust" the current computer, which means that you won't need to enter codes on it. This way, you only have to bother with verification codes if you're on a computer other than your own, safe computer.
7. Click Confirm to activate two-factor authentication.

Here are a couple of things you may want to check (and things to keep in mind now):

1. On the overview page, it is wise to provide a backup phone number and print (or write down) the list of backup codes. The codes are useful, as mentioned, if you're without your phone or without use of it. It's a good idea to make the backup phone a landline, as you can lose a cell phone for a while and be stuck locked out, but it's pretty hard to lose a landline number.
2. If you have a smartphone or iPod Touch, you can investigate the "mobile application" (Google Authenticator in your device's app store) to make logging in even easier.
3. If you use apps that access your email, you may need to set up "application-specific passwords," as many apps can't accept two-factor verification. Google simply generates a special sixteen-letter password for use with only that app; if someone gets into that account or steals that device, you can simply revoke the password from your accounts page (leaving everything else untouched and fully operational). You cannot log into the main Gmail web interface with an application-specific password.
4. At the bottom of the page, you'll notice that you can forget all other trusted computers, just in case you think someone managed to get a computer trusted with your verification code or you accidentally checked the "trust" box when logging in on a computer you don't actually trust.
5. Before you log out, it would be wise to open a new incognito window or a different browser and double-check that you can log in properly, just in case there's somehow something wrong with your phone setup.
6. If somebody ever gets your password or it's somehow released onto the internet by some other database for which you used the same password being cracked, you should still change your password (it's essentially only one-factor authentication until you do), but you're safe for the moment.
7. If you lose your phone, simply log into accounts.google.com and deauthorize your phone (you can use a backup code or your backup phone if you're locked out because your phone is missing). If you get it back or you get a new one, you can just add it back in.

You can also use two-factor authentication on Facebook, LastPass, and a growing number of other popular applications—it wouldn't hurt to investigate, especially on accounts you care about keeping secure. (UPDATE: Yahoo Mail and Dropbox have recently added two-factor authentication options as well.) It's especially important, however, to have good security on your email account. Why? Think about what you do if you need to reset a password. On nearly all websites, you enter your email address and have a reset link sent to your email account—the one you used when you set it up. If someone gets into your email account, they essentially have a free pass to all your other online accounts.

If you have problems with or questions about two-factor authentication, I'd be happy to help you in the comments—I'm surprising myself with how strongly I've started to believe that this stuff is important.