Introduction[edit]

Definition[edit]

Even users who are knowledgeable about (spear) phishing can benefit from two-factor authentication (2FA). 2FA and similar terms are encompassed under the broader multi-factor authentication (MFA) definition: ^[1]

Multi-factor authentication ... is an electronic authentication method in which a user is granted access to a website or application only after successfully presenting two or more pieces of evidence (or factors) to an authentication mechanism: knowledge (something only the user knows), possession (something only the user has), and inherence (something only the user is). MFA protects user data—which may include personal identification or financial assets—from being accessed by an unauthorised third party that may have been able to discover, for example, a single password.

2FA can be used to strengthen the security of online accounts, smartphones, web services, access to physical locations and other implementations. By requiring two (or more) separate and distinct forms of information/identification before secure access is granted to something, this minimizes the threat posed by malicious actors. 2FA relies upon a combination of two of the following: ^[2]

• something you know -- like a password
• something you have -- like a code sent to a smartphone or smartphone authenticator application
• something you are -- such as biometric markers (fingerprints, face or retina scans)

A familiar example of 2FA is the withdrawal of money from an Automatic Teller Machine (ATM). To withdraw cash it is necessary to present a valid credit or debit card (something you have), and to enter a Personal Identification Number (PIN; something you know) for a successful transaction. Although this increases overall security, this procedure is vulnerable to attacks such as ATM skimming ^[archive]. ^{[3] [4]}

2FA is not foolproof because hackers can potentially access these authentication factors via malware, account recovery procedures, phishing attacks, browser vulnerabilities ^[archive] and Man-in-the-middle Attacks. It is also possible to intercept text messages that are sent as part of a 2FA procedure. This is why MFA is more secure than 2FA -- more than two factors are required before account access is granted.

Digital Identity[edit]

Consider what would happen if:

• you immediately lost access to your email address
• a malicious third party had exclusive access to your email address while you did not

These hypothetical scenarios reinforce that a digital identity is centered around the inviolability (security) of personal email addresses. For many purposes, it's a trust anchor. Malicious actors who control your email address also have major control over most of your digital life. As noted in the Essential Security Guide Introduction chapter:

Just one breach of an online email service permits the theft of valuable personal data, account/contact harvesting, re-sale of retail accounts, spam and much more. An email account is a particularly weak link, since once under the attacker's control they can reset the password, along with the passwords of many linked services and accounts.

Feasible consequences of an email breach include: ^{[5] [6]}

• Employment: forwarding of work documents and work email; access to Fedex, UPS, Salesforce or related accounts; employer/colleague details; a hack of the victim's employer; and sending a termination letter to an employer, employees, landlord, mobile carrier, banks etc.
• Financial: access to bank accounts; reset of accounts for malicious transactions; financial accounts/loans made in the victim's name; email account ransom; personal credit score harm; changed billing arrangements; cyberheist lures; and blackmail/extortion opportunities against the owner of the hacked account.
• Harvesting: all email and chat contacts; access to file hosting accounts; Google Docs, MS Drive, Dropbox and other accounts; software license keys; social security number and other information for identity theft; and password recovery requests to all social media and other accounts. ^[7]
• Privacy: access to personal name and history; personal messages, calendar, photos, Google/Skype chats; call records (plus mobile account); your location (plus mobile/i-Tunes); names of friends and family members; the threat of real-world stalking; and potentially political views, travel and favorite places.
• Spam: commercial email; phishing; malware proliferation; stranded abroad, email signature and Facebook/Twitter scams; and other malicious emails/messages requesting funds/cryptocurrency transfers to help "solve" non-existent scenarios.
• Reputation: reputational harm due to uploading of indecent content, photos, videos to social media/other websites; sending of inappropriate e-mails; and catfishing romantic partners. ^[8]
• Retail Resale: Facebook, Twitter, Tumbler, Macys, Amazon, Walmart, i-Tunes, Skype, Bestbuy, Spotify, Hulu+, Netflix, Origin, Steam, Crossfire and other accounts.

The multiple, serious consequences of an email breach emphasize the importance of properly configuring 2FA for both accounts and password managers to minimize the potential damage. It is also recommended to:

• use strong and unique passwords for all accounts
• avoid the use of email accounts as a login for other accounts
• limit information shared over email
• avoid typing your email password on public WiFi networks

Common Misconceptions[edit]

Table: Common 2FA Misconceptions ^{[9] [10] [11] [12] [13] [14]}

Misconception	Description
2FA requires Google	Google authenticator is the most popular 2FA implementation, but not the only one -- Google software is not necessary to take advantage of 2FA. Many services link to and recommend Google authenticator, but any Time-based One-time Password (TOTP) implementation will work, see: Software Choices.
2FA is a quick fix to protect against future breaches	Sites cannot simply "turn on" 2FA; deployment requires tokens to be issued or cryptographic keys embedded in other devices. If 2FA is deployed, many users will not have the means to log in, or if it is voluntary, some will not bother enabling this security feature.
2FA is invulnerable to most threats	2FA does improve security but it is imperfect. For example: 2FA technologies may prompt users to approve various transactions; inattentive users might approve an attacker's transactions without realizing. Third-party authentication tokens rely upon the security of the issuer (who can be breached). 2FA relying on text messaging (SMS) depends upon the security of the mobile provider; malware on a phone can intercept SMS messages and send them to an attacker.
2FA always requires the use of a second device	Single device 2FA is possible, for example keying information with a smartphone application that prompts the user for something they know. This means a second device is not needed to receive one-time passwords.
Most 2FA solutions are similar	This is incorrect. 2FA solutions can rely on hardware tokens that produce one-time passwords, emails, SMS messages, mobile applications with cryptographic secrets (like Google Authenticator, Defender Soft Token etc.), keying information stored in a user's browser, physical security keys (like a YubiKey) and so on.
2FA is unnecessary; strong and unique passwords are sufficient	As noted in the introduction, this is demonstrably false. For example, phishing attacks, browser vulnerabilities [archive] and Man-in-the-middle Attacks can lead to the recovery of passwords. 2FA is recommended for all accounts -- even your password manager -- for an extra layer of security. This way hackers need to overcome two barriers instead of one to access an account.
All 2FA is equally strong	This is incorrect. For example, SMS and mobile authenticator applications are vulnerable to SIM swapping, mobile malware, phishing scams, and Man-in-the-middle Attacks. On the other hand, Google researchers found that no users relying exclusively on physical security keys were victims of targeted phishing campaigns (since physical key access is required to log in). [15] [16]
2FA is complicated and time-consuming	The right 2FA solution for a user's security needs can be simple to use, and does not always involve using one-time passwords. For example, a physical security key may only require one touch or tap of the key to log in.
2FA requires an Internet connection	This is incorrect. For example the TOTP authentication mechanism does not require an Internet connection.
TOTP and HMAC-based One-Time Passwords (HOTP) are identical	TOTP and HOTP are distinct: TOTP codes are time-limited and generally remain active for 30 to 60 seconds. They become invalid if not used within that timeframe. Examples are Authy, Google Authenticator and others. HOTP codes are event-based; codes remain active until a new code is requested. One example is the YubiKey implementation.

2FA Configuration and Options[edit]

Before configuring 2FA for online accounts, it is worth considering the most common methods in use by websites, the relative strengths and weaknesses of each implementation, and various configuration options.

Depending on the consumer website, more than one 2FA method may be available. 2FA may also be referred to as "login verification" (Twitter), "login approvals" (Facebook), "SafePass" (Bank of America), "2-step verification" (Google and others). Most popular websites provide 2FA -- the Electronic Frontier Foundation (EFF) provides detailed guides for the following services: ^[17]

For a comprehensive list of services and websites that support 2FA, utilize 2FA Directory ^[archive].

Implementations[edit]

2FA implementations can take several forms, including: ^[17]

• a one-time verification code sent via SMS
• a TOTP generated by dedicated applications like Google Authenticator ^[archive], Authy ^[archive] and FreeOTP ^[archive]
• downloadable, printable, hardcopy backup codes
• hardware tokens such as a YubiKey ^[archive]

As outlined in the introduction, all these methods are verifying something you have (a smartphone, printed out codes, a piece of hardware) with something you know (your password). Each method has strengths and weakness as outlined in the table below. In general, while SMS verification is the most common 2FA method, it is not recommended because SMS messages can be intercepted in transit by malicious actors. Conversely, hardware tokens like YubiKey are the most secure method, but are not widely supported and could be lost. Authenticator applications are a reasonably secure middle ground, so long as you possess a smartphone.

Table: 2FA Implementation Pros and Cons ^{[18] [19] [20]}

2FA Implementation	Pros and Cons
FIDO U2F / physical keys (recommended) [21]	Pros: Both the physical key and password are required for logins -- accounts have strong protection against phishing attacks. Easy to use once set up -- after the device is registered with a website, subsequent logins only require the device to be connected and tapped. No codes need to be entered. A U2F device does not respond to sites it has not been registered to. The same device can be used on multiple sites, with a different identity; there is no single unique device identity for tracking. Research shows physical keys provide the strongest defense against automated bots, bulk phishing and targeted phishing -- it is virtually "phishing-proof". Most sites supporting U2F also support TOTP and backup codes. Cons: A physical key must be purchased. [22] The key must be carried at all times. Devices without a USB port may prevent logins. Browser support can be limited -- the W3C is working on standardizing the U2F protocol. Only a handful of U2F devices work with smartphones over Near Field Communication (NFC) [archive] and Bluetooth.
Authenticator application / TOTP 2FA (recommended) [23]	Pros: Easy to use and set up -- sites show QR codes [archive] containing the secret key that can be scanned into the application. [24] Codes can be scanned into multiple smartphones. Codes can be saved in a safe place or printed out as a backup. It is possible to use even without Internet access. Attackers who perform phone redirections cannot access 2FA codes. Cons: A smartphone is required. Account access can be lost if the phone dies or is stolen (unless a backup was saved/printed out). This is inconvenient if logging into multiple, different computers. [25] This implementation is vulnerable to smartphone malware.
Push-based 2FA (recommended) [26]	Pros: Prompts are sent to devices during a login -- it is easy to approve or deny the request and identify the estimated location for the login attempt. IP addresses for originating logins provides stronger phishing protection. It is more convenient to acknowledge a prompt, rather than type in a code. Cons: This implementation is not standardized -- it is not possible to choose from alternative authenticator applications. All push-based credentials cannot be consolidated into a single application. A working data connection is required on the phone. [27] This implementation is vulnerable to smartphone malware.
SMS-based text messages and voice-based 2FA (unrecommended) [28]	Pros: It is easy to set up. It can be used with a "non-smart" phone. Cons: Additional information (a phone number) is provided to a website/platform -- this makes anonymous use difficult and risks future potential breaches. Some websites use phone numbers for targeted advertising, conversion tracking and password resets. [29] Text messages are insecure: interception, redirection or forwarding of codes to other devices is possible. [30] Voice calls can be intercepted. Extra costs may be incurred by connecting to telephone networks to receive messages. Logins are impossible if the phone is not charged or a mobile network is unavailable. [31] If the phone is lost, account recovery can be difficult or impossible.
Biometric IDs (unrecommended)	Pros: Your own body is used as a physical token, such as your face, retina, fingerprint or voice (always available). [32] Cons: Biometric IDs cannot ever be changed if compromised. Physical equipment like scanners and cameras are required. Volunteering of biometric data is a privacy intrusion and risk.
Email-based 2FA (unrecommended)	Pros: This is convenient because an automated message with a code/link is sent to a registered email address when there is a login attempt. This method is easy to implement, intuitive, and works with computers and phones. Cons: An Internet connection is required. This method is insecure: Many people use identical passwords across accounts/devices. Email accounts are vulnerable to brute-force attacks [archive]. Emails can end up in junk or spam folders. Hackers often have passwords for both online accounts and email passwords.

Backups[edit]

Users tend to not backup 2FA backup codes since (popular) services do not enforce this procedure. ^[33] After configuring 2FA, it is strongly recommended to plan for the worst case scenario and have multiple 2FA backup codes. Otherwise account access will be lost if a smartphone is lost/stolen, or if a single copy of 2FA backup codes is misplaced.

Recommendations: ^{[34] [35] [36]}

• Always set up at least two devices which can generate 2FA one-time passwords.
  • For example, open the 2FA page of the relevant website. Next scan the QR code with the authenticator application on the first phone, then scan the same code with the authenticator application on the second phone.
• Always backup, print or write down 2FA backup codes in two different places -- these cannot be hacked or compromised without somebody breaking into your home. ^[37]
• Additional copies of 2FA backup codes can be stored in other locations:
  • In an encrypted file on your computer (including snapshots of QR codes).
  • In cloud storage if the option is available. ^[38] This is less secure but more convenient -- if a smartphone is lost all codes can be easily restored without re-scanning all the sites again.
• If services do not provide 2FA code backup options (like Apple), one workaround is to add a second, trusted phone number for the accounts, such as a spouse's phone, work phone etc.

Note: a common misconception is Google 2FA backup login codes cannot restore 2FA for services other than Google. This is incorrect, these codes allow logins into a Google account after having lost access to the 2FA device.

Authenticator Software Choices[edit]

Various factors should be considered before choosing an authenticator application, including: ^[39]

While all of these features are useful, the strongest preference should be given to free and open source products. Therefore, while Google Authenticator is the most popular product on the market, it is non-freedom software and does not have a backup function; it is unrecommended for these reasons.

KeePassXC can be considered as a replacement for Google Authenticator on desktop computers such as Windows, Qubes OS (recommended), Linux (recommended) or macOS. It is also functional in an offline virtual machine (VM). Other possible options are outlined in the table below, although this is not a complete list; proper research should be conducted beforehand.

Table: Authenticator Products Comparison ^{[43] [44]}

Software	Pros	Cons
Authy [archive]	free includes encrypted backups supports crypto-wallets easy to use / simple interface syncs across multiple devices can be used on mobile and desktop works without an Internet connection supports multiple services and password managers PIN or fingerprint locks are also available	not open source
Google Authenticator [archive]	free works with most services simple import / export functions easy to use works without an Internet connection feature for checking recent account activity available on iOS, Android and Blackberry	not open source no syncing between devices no backup feature no PIN / password lock feature lacks various other features
andOTP [archive]	free open source supports HOTP supports any service using TOTP works without an Internet connection supports encrypted backups / restore options utilizes database encryption has a panic button [45] supports rooted devices simple user interface	no iOS support - only Android is supported no import and sync functions
LastPass [archive]	free encrypted backup support push notification verification supports TOTP and push-based notifications for various services supports backups	not open source missing some application features
Duo Mobile [archive]	security checkup feature supports numerous third-party resources [46] encrypted backups push notifications	not open source no offline feature is available limited utility user interface security keys cannot be manually entered
Aegis [archive]	free open source no Internet connection required security features including PIN, password and fingerprint lock tap to reveal function [47] supports HOTP and TOTP methods allows imports from other popular authenticator applications a simple, easy-to-use interface auto-backup and export options possible to alter the code length and time	no sync features are available
FreeOTP [archive]	free open source simple user interface supports TOTP and HOTP possible to select the length of the TOTP code and how long it remains active	no security features like PIN, passcode etc. to unlock secure codes outdated application - no updates since 2016 backups, multi-device sync and other simple functions are unavailable
Microsoft Authenticator [archive]	free available for Android, iOS and Windows 10 mobiles available as a desktop application supports passwordless authentication with Microsoft applications has an in-built password manager supports certificate-based authentication supports cloud backups / other backup and restore options has a PIN / biometric lock feature supports every TOTP service sends security notifications if your account is signed in from a new location / device, or if the password is changed possible to review recent account activity multi-device sync feature	not open source no direct export option some features require Internet access

Other Factors[edit]

As noted in the previous section comparing common authenticator software, TOTP is the most commonly supported protocol; only a handful of free and open source alternatives support HOTP as well. As a reminder, prefer free and open source applications, even though Google dominates the market. ^[48]

With respect to U2F hardware options that authenticate by using unique hardware tokens, YubiKey ^[archive] is considered the best option. Although relatively expensive, YubiKey supports HOTP, TOTP and U2F. It also supports multiple connection options (USB-C, USB-A and Lightning) and can be used with most online services. It is virtually phishing-proof because the tokens are directly bound to the destination website/service. ^[49] Other options like Kensington VeriMark USB ^[archive] and Google Titan Security Key ^[archive] are unrecommended because they rely upon Windows devices and have limited functionality compared to YubiKey, such as only supporting U2F and not other protocols; far fewer services support U2F compared to TOTP.

For reasons of practicality, most users will prefer to utilize software authenticators relying upon TOTP when accessing real-life, non-anonymous accounts. For instance, bank accounts can be better secured via TOTP generation on multiple, non-anonymous devices such as Android and iPhone devices.

Further reading:

• YubiKey
• What You See Is What You Sign (WYSIWYS) ^[archive].

Warnings[edit]

Threat Model[edit]

Table: 2FA Threat Model

2FA Protection Level	Description
Full protection	2FA is effective when: A user email address is compromised due to either the email provider being hacked or a rogue employee. In this case the attacker could potentially impersonate the user, or use the password recovery option of external services such as other email services, financial services, (social media) accounts, and so on. However, the attacker would not have the necessary 2FA one-time passwords. Users fail victim to (spear) phishing, for example when a login password (and maybe even the 2FA code) is sent by email to an attacker. By the time the attacker receives the message, the 2FA code will be either missing (if not sent by the user) or if lucky, may have already expired. Account logins are only protected by weak passwords, because 2FA acts to make login security stronger. Shoulder surfing [archive] leads to disclosure of the password; the password in isolation does not allow logins.
Partial protection	2FA might work when: Password databases of third party services -- such as banks and cryptocurrency exchanges -- are compromised (because the 2FA database is not compromised by the attacker). In these cases there is still a probability of losing funds, but the risk is lower. An email provider is compromised -- such as a server compromise by an attacker or a rogue employee -- leads to unauthorized access to an email address, which is often enough to reset passwords. Depending on the third party service policies, changing 2FA credentials might not be easy. In these cases, an account compromise of the third party service might be preventable.
Ineffective protection	2FA is ineffective if: The user's device is already infected by malware. In that case a trojan horse can simply take over the login session without the user's knowledge. Users are tricked into giving up OTP tokens via an OTP Interception Service [archive]. [50]

Security Issues[edit]

In general, 2FA increases the difficulty of being hacked and it is considered the best practice for keeping accounts and systems secure. Users with higher security needs can employ MFA -- three or more levels of authentication -- to further decrease the chances of a successful attack. As noted in the Implementations section, it is safest to rely on FIDO U2F / physical keys or if that is unavailable, authenticator applications / TOTP 2FA or push-based 2FA. All other methods are unrecommended.

It is worth reiterating that SMS-based 2FA should be avoided due to the risk of SIM Swap Scams and malicious SMS re-routing ^[archive] as mentioned on the Account and Mobile Security wiki page. Although SMS and automated phone calls with one-time codes remain a popular 2FA method, there are many examples where hackers tricked mobile phone carriers into transferring somebody else's phone to their own; they then have access to authentication for that phone number. ^[20] Another related risk is the rise of automated bots that call users and request MFA codes or one-time passwords to "prevent fraud" on various accounts. ^[51]

For example, in 2019 the Twitter CEO had his account hacked while using a 2FA method. Around the same time, over 23 million YouTube users utilizing 2FA were hacked because a reverse proxy toolkit was built to intercept 2FA SMS codes. Similarly, the Binance cryptocurrency exchange had their 2FA system compromised and lost tens of millions in the process. These hacks reinforce the risk of SIM-swaps for 2FA; hackers use various methods to change a victim's phone number so that subsequent messages or phone calls are redirected to a new phone. All in all, SMS and phone call-based 2FA systems have too many weaknesses to warrant its recommendation. ^[20]

Historically, other 2FA breaches have resulted from malware compromises. For example in 2020 an authenticator application in Android was discovered to be malware, stealing 2FA codes in the process. TrickBot malware is another example where one-time codes utilized by banking applications (sent via SMS/push notifications) have been intercepted. Finally, social engineering situations can emerge whereby hackers contact targets and pose as the bank or other service, requesting the security code that was just sent to "confirm their identity." ^[20]

Anonymity Issues[edit]

Users risk possible de-anonymization if using the following applications on a non-torified device:

• Authy ^[archive] requires an Internet connection.
• Symantec VIP ^[archive] requires an Internet connection.
• Google Authenticator ^[archive] / andOTP ^[archive] did not use the Internet at the time of writing, but this might change with an (automatic) update.

If anonymity is required, it is strongly recommended to only run 2FA software in non-networked or torified machines.

Practical 2FA Example[edit]

Readers are welcome to add further practical examples of 2FA to this section.

Debian Packages[edit]

• libpam-barada ^[archive]: Pluggable authentication module (PAM) to provide two-factor authentication based on HMAC-Based One-time Password (HOTP).
• libpam-google-authenticator ^[archive]: The Google Authenticator project has implementations of one-time passcode generators for several mobile platforms, as well as a PAM. ^[52]
• libpam-blue ^[archive]: PAM module for local authentication with bluetooth devices.
• libpam-oath ^[archive]: Open AuTHentication (OATH) Toolkit libpam_oath PAM module. ^[53]
• libpam-otpw ^[archive]: OTPW for PAM authentication. ^[54]
• libpam-p11 ^[archive]: A PAM module for using PKCS#11 smart cards.
• libpam-poldi ^[archive]: A PAM module allowing authentication using a OpenPGP smartcard. ^[55]
• libpam-fprintd ^[archive]: A PAM module for fingerprint authentication through fprintd.

See also:

• Debian wiki: Fingerprint authentication ^[archive]
• YubiKey:
  • Qubes wiki: YubiKey ^[archive]
  • The Qubes' YubiKey package ^[archive] for configuring YubiKey login support could be ported to Debian.

See Also[edit]

• Phone Number Validation vs User Privacy
• Account and Mobile Security

Footnotes[edit]

---

---

	100px
Fosshost	About Advertisements

---

Search engines: YaCy | Qwant | ecosia | MetaGer | peekier | Whonix ™ Wiki

---

Follow:

Support:

Donate:

Priority Support | Investors | Professional Support

Whonix ™ | © ENCRYPTED SUPPORT LP | Freedom Software / Open Source (Why?)

The personal opinions of moderators or contributors to the Whonix ™ project do not represent the project as a whole.