The Times Australia
The Times World News

.
Beatbot

.

What is multi-factor authentication, and how should I be using it?

  • Written by Jongkil Jay Jeong, CyberCRC Senior Research Fellow, Centre for Cyber Security Research and Innovation (CSRI), Deakin University
What is multi-factor authentication, and how should I be using it?

Data breaches are becoming commonplace[1] in both small and big tech companies. The most recent victim was Australian telecommunications company Optus[2], resulting in unauthorised access to the identity data of roughly 10 million people.

Adding to the misery of the victims, this cyber-attack further unleashed a plethora of subsequent phishing and fraud attempts[3] using the data obtained from this breach.

Read more: The 'Optus hacker' claims they've deleted the data. Here's what experts want you to know[4]

Having more rigorous security measures when logging in can help to protect your accounts, and significantly reduces the likelihood[5] of many automated cyber attacks.

Multi-factor authentication (MFA) is a security measure that requires the user to provide two (also known as two-step verification or two-step authentication) or more proofs of identity to gain access to digital services. This typically requires a combination of something the user knows (pin, secret question), something you have (card, token) or something you are (fingerprint or other biometric).

For example, the Australian Tax Office recently tightened some rules for digital service providers on the mandated use of multi-factor authentication[6]. If you use certain services, you’re already familiar with MFA.

But not all MFA solutions are the same[7], with recent studies demonstrating simple ways to subvert more common methods which are used to lodge cyber-attacks[8].

Furthermore, people also prefer different MFA options depending on their needs and level of tech savviness.

So what are the options currently available, their pros and cons, and who are they suited for?

There are four main methods of multi-factor authentication

  • SMS: Currently the most common option involving a one-time password (such as a code) sent via text message. Although quite popular and easy to use, the password or code texted to you can commonly be hacked[9] by malicious apps on the phone or by redirecting the SMS to a different phone. The method also fails if your smartphone doesn’t have service or is powered off.

  • Authenticator-based: Another common method, in which an application installed on your smartphone (such as Google Authenticator) generates one-time passwords valid for a very short time span, such as 30 seconds. Although more secure than text messages, malicious apps can still steal these one-time passwords[10]. The method also fails if your smartphone is out of power.

  • Mobile app: Similar to authenticator apps, but a user is sent a verification prompt rather than a one-time password. This requires your smartphone to have an active internet connection and be powered on.

  • Physical security key: The most secure mechanism; it uses a hardware security key (such as YubiKey[11], VeriMark[12] or Feitian FIDO[13]) that needs to be connected to the device to verify identity – many of these look a lot like USB memory sticks. It’s the current leading method supported by companies like Google, Amazon and Microsoft[14], as well as government agencies worldwide[15].

A small usb-key like device with a golden y symbol on it
YubiKey is one example of a physical key you can connect to your device to verify your identity. Formatoriginal/Shutterstock

Each of these four methods varies in usability and security. For example, despite physical security keys offering the greatest level of security, the adoption rate is the lowest, with figures suggesting only a 10% uptake[16].

Read more: How hackers can use message mirroring apps to see all your SMS texts — and bypass 2FA security[17]

Preference matters

Not only do different multi-factor authentication types vary in security, they also have different levels of popularity. This results in a discrepancy between the most reliable MFA method (the physical security key) and what is actually the most widely used (SMS).

Our team from Deakin University’s Centre for Cyber Security Research and Innovation[18] recently conducted a study on the adoption of MFA technologies. We surveyed more than 400 participants belonging to different age groups, educational backgrounds, and experience with MFA.

Results from our study indicate that people’s preferences are impacted not just by their security needs, but also by usability. The majority of users cared most about the simplicity of the MFA method – this clearly explains why SMS-based solutions still dominate the landscape, even though there are safer alternatives.

In our follow-up study, users were given the most popular physical security keys for one month, to test unsupervised. Preliminary results suggest most users found the physical keys effective and intuitive to use.

However, the lack of platform support and setup instructions created a perception that these keys were difficult and complex to install and use, resulting in a lack of willingness to adopt.

One size does not fit all

We believe there needs to be careful consideration before any government agency or company mandates MFA, with a few key steps to consider.

Different people and organisations will have different needs, so in some cases a combination of methods could work best. For example, an SMS-based solution may be used in conjunction with a physical security key for access to critical infrastructure systems that need higher levels of security.

Additionally, user education and awareness is vital. Many people aren’t aware of the importance of MFA, and don’t know which methods are the safest.

By taking some personal responsibility and using highly effective methods such as physical security keys to protect our most vulnerable accounts, we can all do our part to make the web a safer place.

Read more: What does the Optus data breach mean for you and how can you protect yourself? A step-by-step guide[19]

Read more https://theconversation.com/what-is-multi-factor-authentication-and-how-should-i-be-using-it-191591

The Times Features

Finding the Best SMP Clinic in Perth: Tips and Recommendations

Hair loss can be a tough experience. It’s not just about losing hair; it can feel like you’re losing a part of your confidence, too. That’s why Scalp Micropigmentation, often cal...

How Does iCare And High-Quality Clinical Support Aid Patient Recovery?

Recovering from a workplace injury, automobile accident or managing a chronic condition can be overwhelming. Whether you're a patient or a family member, you may ask: “How can I ...

How can brands recognise the very important role that visual content plays in the real world?

For nearly three decades, Getty Images and iStock have developed unparalleled expertise in understanding the impact of visual content on our world. During this time, one truth ...

Long COVID appears to be driven by ‘long infection’. Here’s what the science says

Around 5–10%[1] of people with COVID infections go on to experience long COVID, with symptoms lasting three months or more. Researchers have proposed several biological mechan...

Evaluating Costs and Benefits of DIY Plumbing vs. Professional Services in Newcastle

Plumbing is an essential service for homes and businesses in Newcastle, ensuring the smooth flow of water and sanitation facilities. As residents and businesses strive to maintai...

Tasting Australia welcomes Journey Beyond as new presenting partner

One of the country’s longest running food and beverage festivals, Tasting Australia has announced Journey Beyond as the festival’s new presenting partner for 2025 and beyond. Th...

Times Magazine

Take Extra Care Through the Help of iPhone Camera Repairs

As technology continues to advance at a breakneck pace, it's becoming increasingly important to know how to repair your Apple iPhone camera. With the rise of social media and the importance of capturing life's moments, having a functioning camera on ...

New household battery incentives now available for NSW

Residents across the state can take advantage of the NSW Government's new incentive to make battery storage more affordable. Installing more batteries across NSW will enable homes and businesses to maximise their use of generated solar energy, lo...

Treats and Tails: The Ultimate Dog Treats Suited For Your Dogs

Dogs have long been adored pets, and they play a significant role in the lives of many families. One of the delights of owning a dog, as every dog owner knows, is the ability to show them love and affection via treats and other types of positive re...

5 Main Reasons Why People Switch to Standing Desks

Whether you want to create a home office or a space where you can enjoy your hobbies, purchasing the right office desk for you can be challenging. There are just too many options and sifting through them can be confusing enough to give you a head...

Upgrade Your Pet's Sleep Space: The Benefits of Washable Dog Beds for a Cozy Haven

Is your furry friend in need of a better night's sleep? Look no further! In this blog post, we will explore the benefits of washable dog beds and how they can transform your pet's sleep space into a cozy haven. Say goodbye to smelly, worn-out cushi...

Utilize Rip Rap Seawall for Shoreline Protection

A Rip Rap seawall is a type of coastal engineering structure that protects shorelines from wave erosion, which is composed of large stones or boulders placed in an interlocking pattern along the shoreline. The design of the seawall is to absorb and d...