The 12 Days of 2FA: How to Enable Two-Factor Authentication For Your Online Accounts

lotuseclat79 · Dec 11, 2016

The 12 Days of 2FA: How to Enable Two-Factor Authentication For Your Online Accounts

Enabling two-factor authentication—or 2FA for short—is among the easiest, most powerful steps you can take to protect your online accounts. Often, it’s as simple as a few clicks in your settings. However, different platforms sometimes call 2FA different things, making it hard to find: Facebook calls it “login approvals,” Twitter “login verification,” Bank of America “SafePass,” and Google and others “2-step verification.”

That’s why, this holiday season, EFF’s 12 Days of 2FA is here to help you navigate the world of two-factor authentication. In a series of 12 posts, we’ll show you how to enable 2FA on a range of online platforms and services.
Click to expand...

-- Tom

lotuseclat79 · Dec 11, 2016

How To Enable Two-Factor Authentication on Gmail and Google

You can enable 2FA for your Gmail account on Google’s single settings page, so your new, more secure settings will apply across other Google services like Google Drive and Google+. Google calls it “two-step verification,” but the idea is exactly the same: if signing in requires something you have (like your phone) as well as something you know (your password), then your account has an added layer of protection.
Click to expand...

-- Tom

lotuseclat79 · Dec 13, 2016

How To Enable Two-Factor Authentication on Yahoo Mail

For the third day of the 12 Days of 2FA, we’ll look at how to enable two-factor authentication (2FA) on Yahoo. After Yahoo disclosed the largest known data breach in the history of the Internet in September, 500 million compromised users have been advised to change their passwords and update the answers to their security questions. On top of these common-sense steps, 2FA is an easy, powerful defense in the face of large-scale, password-stealing hacks.
Click to expand...

-- Tom

lotuseclat79 · Dec 14, 2016

How To Enable Two-Factor Authentication on Outlook.com and Microsoft

The last email service we’ll cover in the 12 Days of 2FA is Outlook.com. If we haven’t covered your email service here, check twofactorauth.org’s more extensive list of email platforms that offer two-factor authentication. If you only enable 2FA for one account, email is a good choice for most users. Email is often a golden key to all of your other online accounts. When you forget or lose your password, services will often email you to confirm your identity and reset it. If your email password is compromised with no second layer of authentication to back it up, an attacker can use it to access your other accounts.
Click to expand...

-- Tom

lotuseclat79 · Dec 15, 2016

How to Enable Two-Factor Authentication on Facebook

For the fifth day of the 12 Days of 2FA, we turn to the world’s largest social media platform: Facebook. Facebook calls its two-factor authentication “Login Approvals,” but the idea is exactly the same: signing in from a new browser will require something you have (like your phone) as well as something you know (your password), giving your account an added layer of protection.
Click to expand...

-- Tom

lotuseclat79 · Dec 16, 2016

How to Enable Two-Factor Authentication on Twitter

For the sixth day of the 12 Days of 2FA, we turn to Twitter. Twitter calls its two-factor authentication system “Login Verification,” but the idea is exactly the same: signing in from a new browser will require something you have (like your phone) as well as something you know (your password), giving your account an added layer of protection.
Click to expand...

-- Tom

lotuseclat79 · Dec 18, 2016

How to Enable Two-Factor Authentication on Dropbox

As the 12 Days of 2FA continue, we wrap up the week with a guide to enabling two-factor authentication on Dropbox. Dropbox supports 2FA over SMS or over one of several popular authentication apps.

On a cloud storage and sharing service like Dropbox, protecting shared files often means working with others. Protecting your account with 2FA gives your documents and files the best security when the people you share them with do the same. For a more comprehensive list of cloud services that support 2FA, check twofactorauth.org.
Click to expand...

-- Tom

lotuseclat79 · Jan 4, 2017

How to Enable Two-Factor Authentication on Amazon

Amazon supports 2FA via both text messages and an authenticator app. Authenticator apps are generally more secure and avoid a lot of the downfalls of text messages. However, text messages are more practical if you do not use a smartphone. Consider your threat model and choose the best mode for you. Note, however, that Amazon requires a phone number to enable 2FA regardless of the method you choose.
Click to expand...

-- Tom

lotuseclat79 · Jan 4, 2017

How to Enable Two-Factor Authentication on Bank of America

No matter where you do your banking, 2FA can be an important security measure. Bank of America is one example of how 2FA can be different for banks compared to other online services. They require security questions as well as a password to log in, and offer 2FA for sensitive or high-value transactions. Bank of America calls it “SafePass,” but the idea is exactly the same: if signing in requires something you have (like your phone) as well as something you know (your password), then your account has an added layer of protection.
Click to expand...

-- Tom

lotuseclat79 · Jan 4, 2017

How to Enable Two-Factor Authentication on LinkedIn

The LinkedIn hacks were notorious for their scale, and have even provided the basis for some password-related artwork. But they were only a couple among countless data breaches and leaks. While data breaches may compromise your password and other information eventually, it is harder for them to affect a second factor of verification that you physically have in your possession, like your mobile phone.
Click to expand...

-- Tom

lotuseclat79 · Jan 4, 2017

How to Enable Two-Factor Authentication on Slack

Slack supports 2FA via text message and via one of many authenticator apps. Authenticator apps are more secure for most people and do not have the potential for interception that text messages do. If you decide to use an authenticator app, Slack does not require a backup method or phone number, meaning you can keep your number off Slack if you choose.
Click to expand...

-- Tom

lotuseclat79 · Jan 4, 2017

How to Enable Two-Factor Authentication on PayPal

PayPal calls 2FA and the associated verification codes “Security Keys.” This can be confusing if you think of security keys as hardware 2FA devices like YubiKeys. Regardless of the naming, the idea and execution are the same as other services we have looked at: if signing in requires something you have (like your phone) as well as something you know (your password), then your account has an added layer of protection.
Click to expand...

-- Tom

deBoetie · Jan 4, 2017

It's really disappointing that PayPal are still with VIP or smartphone 2FA, since they were one of the members of the U2F (but were sadly going down the biometric route). I really don't get the argument that you can't support a $10 small passive device that has a smaller attack surface vs a $$$$$ smartphone with high level of attack surface and poor battery.

Of course, it's really because they want you by the smartphone and mobile number.

Palancar · Jan 4, 2017

I am considering using one of my Bitcoin Trezor's for this purpose. Its fully U2F but I have been procrastinating because few of my accounts support it yet. It would also be a great smokescreen for why I am carrying a Trezor anyway. I use my smartphone for several real name places where a simple "text" is my whopping 2FA. Better than nothing. LOL!

For those living in the USA I would say don't get your short term hopes up. Hell, we haven't even activated full credit card chip technology yet and its deadline was a longggggggg time ago. Maybe 20% of merchants offer chip protection for their customers where I live. That being the case, why would I expect U2F to be any different?

Rasheed187 · Jan 4, 2017

deBoetie said: ↑

I really don't get the argument that you can't support a $10 small passive device that has a smaller attack surface vs a $$$$$ smartphone with high level of attack surface and poor battery.
Click to expand...

I'm thinking about activating 2FA on all of my accounts, but what if you don't have access to your smartphone? I would also love to have a hardware authenticator, that could be used for most important sites, like banking, email and social media.

https://www.vasco.com/products/two-factor-authenticators/index.html

guest · Jan 4, 2017

Rasheed187 said: ↑

I'm thinking about activating 2FA on all of my accounts, but what if you don't have access to your smartphone
Click to expand...

If you lose your smartphone, you can use backup codes to login into your account (it depends, not all are providing backup codes)
For example In the case of Protonmail, after enabling Two-factor authentication the user can see a list of backup codes which the user should keep in a safe place:

Balthazar · Jan 4, 2017

deBoetie said: ↑

It's really disappointing that PayPal are still with VIP or smartphone 2FA, since they were one of the members of the U2F (but were sadly going down the biometric route). I really don't get the argument that you can't support a $10 small passive device that has a smaller attack surface vs a $$$$$ smartphone with high level of attack surface and poor battery.

Of course, it's really because they want you by the smartphone and mobile number.
Click to expand...

Yeah, I am disappointed with the use of (or lack of) U2F. Years ago I thought this would be a standard for many sites but not much has happened since then.
Well, I don't mind anymore what PayPal uses. I closed my account a while ago - this time for good. In the past they declined several perfectly legitimate transactions for no good reason. I canceled my credit card as well. I don't mind my credit score, haha.

I also don't like linking my mobile number to accounts. I do 2FA in an isolated Qubes VM and it works like it should. (https://www.qubes-os.org/doc/multifactor-authentication/) I don't use smartphones for excessive surfing or shopping so it is a nice alternative.

@Palancar
Thanks for your report on Trezor. I read your experiences and I am interested in buying one. I just did a little research and it looks like a very good solution. Would you recommend it compared to other devices? It's a little expensive but it would be usable for a long time, I suppose.

Palancar · Jan 5, 2017

Balthazar,

The TREZOR was a no brainer for me. I am a crypto trader and a hardware wallet is virtually a must if you want any level of convenience without sacrificing security. With coins, one private key leak means they are gone. As soon as the new TREZOR2 gets released the original Trezors will sell for cheap, cheap. Beta and code for the next generation Trezor is proceeding, but still no official release date yet. You might score an original Trezor on the cheap if the timing goes right for you. The U2F is solid on the original trezor. I don't use that feature yet as posted earlier in this thread, but that is due to not many establishments accommodating the features it offers. I do have all the firmware updated and the device is ready but I don't have anywhere to use it (maybe one or two sites but I need about a dozen).

Balthazar · Jan 8, 2017

@Palancar
Thanks for the reply. I will wait and see when the Trezor2 gets released. If it's not taking too long I will then decide which to buy. I bought a few "gadgets" in the past and most of them are put to good use. I still use my old Yubikeys for static passwords.

Rasheed187 · Jan 8, 2017

mood said: ↑

If you lose your smartphone, you can use backup codes to login into your account (it depends, not all are providing backup codes)
For example In the case of Protonmail, after enabling Two-factor authentication the user can see a list of backup codes which the user should keep in a safe place:
View attachment 255639
Click to expand...

OK, I see. BTW, I was wondering if it's possible to develop a hardware authenticator (like from Vasco) that works for all major sites. I'm not sure if it's technically possible.

Minimalist · Apr 3, 2017

What To Do When The 'Government Backed Attackers' Come For You
One fine evening last month I was wading through the week’s email backlog when all of a sudden a red banner popped up at the top of my window, followed shortly by a full-screen warning offering the cheerful warning from Google that “Government-backed attackers may be trying to steal your password.” After quickly verifying with Google that the alert was indeed genuine and came from them, I discovered just how far consumer 2-factor authentication has come since the cumbersome error-prone corporate systems of my past to the point that in today’s “one click 2-factor” world everyone should have 2-factor enabled.
Click to expand...

https://www.forbes.com/sites/kalevl...-the-government-backed-attackers-come-for-you

Palancar · Apr 4, 2017

Minimalist said: ↑

https://www.forbes.com/sites/kalevl...-the-government-backed-attackers-come-for-you
Click to expand...

Nice read. I prefer a special usb key to the other approaches. Even SMS is a major step in the right direction, but its not U2F.

guest · Jul 22, 2018

How to Secure Your Accounts With Better Two-Factor Authentication
July 22, 2018
https://www.wired.com/story/two-factor-authentication-apps-authy-google-authenticator/

Yes, the easiest way to implement two-factor is with SMS, receiving a text with an access code every time you try to log into a secured account. While certainly better than nothing, getting your 2FA from SMS has plenty of potential downside.

Instagram, in particular, has seen a surge of troubling SIM attacks, largely because it only supports text-based two-factor for now. The company confirmed that it’s working on the obvious solution: Letting you use an authenticator app instead.

“Authenticator apps are not vulnerable to this problem” of SIM hijacking, says Cranor. “They’re a more secure way to do two-factor verification.” [...]
The 2FA Spectrum
Using an authenticator app for two-factor beats SMS, but it's still not the absolute most secure way to go. To lock even your online accounts down even further, consider stepping up to a YubiKey, [...]
Click to expand...

Palancar · Jul 22, 2018

I prefer my Yubi's in actual U2F mode over all other modes they offer. By the way if the site you are using only supports TOTP and not U2F, try and set it up so the code is displayed on a separate device from the one you are logging in with. e.g. Logging in on my laptop but viewing the TOTP on my cellphone screen to acquire the needed 6-8 digit code. It is far safer to keep the authenticator AWAY/OFF the same device being logged in. Lastly to save you from disaster make sure to save the base 32 code or the QR code so you can re-install if the authenticator device gets damaged, lost, etc.....

guest · Aug 22, 2018

Good Primer on Two-Factor Authentication Security
August 22, 2018
https://www.schneier.com/blog/archives/2018/08/good_primer_on_.html

Stuart Schechter published a good primer on the security issues surrounding two-factor authentication.

While it's often an important security measure, it's not a panacea. Stuart discusses the usability and security issues that you have to think about before deploying the system.
Click to expand...

Log in or Sign up

The 12 Days of 2FA: How to Enable Two-Factor Authentication For Your Online Accounts

lotuseclat79 Registered Member

lotuseclat79 Registered Member

lotuseclat79 Registered Member

lotuseclat79 Registered Member

lotuseclat79 Registered Member

lotuseclat79 Registered Member

lotuseclat79 Registered Member

lotuseclat79 Registered Member

lotuseclat79 Registered Member

lotuseclat79 Registered Member

lotuseclat79 Registered Member

lotuseclat79 Registered Member

deBoetie Registered Member

Palancar Registered Member

Rasheed187 Registered Member

guest Guest

Balthazar Registered Member

Palancar Registered Member

Balthazar Registered Member

Rasheed187 Registered Member

Minimalist Registered Member

Palancar Registered Member

guest Guest

Palancar Registered Member

guest Guest

Log in or Sign up

The 12 Days of 2FA: How to Enable Two-Factor Authentication For Your Online Accounts

lotuseclat79 Registered Member

lotuseclat79 Registered Member

lotuseclat79 Registered Member

lotuseclat79 Registered Member

lotuseclat79 Registered Member

lotuseclat79 Registered Member

lotuseclat79 Registered Member

lotuseclat79 Registered Member

lotuseclat79 Registered Member

lotuseclat79 Registered Member

lotuseclat79 Registered Member

lotuseclat79 Registered Member

deBoetie Registered Member

Palancar Registered Member

Rasheed187 Registered Member

guest Guest

Balthazar Registered Member

Palancar Registered Member

Balthazar Registered Member

Rasheed187 Registered Member

Minimalist Registered Member

Palancar Registered Member

guest Guest

Palancar Registered Member

guest Guest

Useful Searches