When Two Factor Authentication (2FA) Fails

There is plenty of information available on the Internet that explains 2FA, so I found one which gives a reasonable rundown of what it is. I recommend you read that first and then look at this article, as I am assuming that the reader has a rough idea of what it is, especially if you have not been exposed to it yet.

Defining The Problem

There was a time that a simple 6 character password was all that was required to “lock” or authenticate yourself on a program, a website, a bank or any secure device. In fact even a 4 digit PIN was considered adequate.

Unfortunately, criminals soon worked out that these systems were extremely easy to “crack” with very simple hacking tools.

I have watched the world scramble to try to improve security for these devices and applications, in an effort to make the systems harder to crack. Over the last decade, many solutions have been proposed. In many cases, the solutions were poorly implemented and worse still, not implemented at all.

Are Single Password-Only Systems Adequate?

Yes, absolutely. Single password-only systems can still provide 2023 level security.

Requirement 1 – Standard User Data Entry Interface

The user must be presented with a login panel with a UserID field and a password field on one screen. Then a standard way for moving from the UserID field to the password field by pressing the TAB key or Right Arrow or Down Arrow.

Requirement 2 – User Password Creation Set and Published

When the password is generated or the user is required to decide on a new password, they should be told up-front in bold, before they try to enter a password, that the password must be 15 characters long, consisting of upper case + lower case + special characters. It would make it impossible for anybody to use the most common password of “123456”. Furthermore, it would make it extremely easy for a password manager to store, create and maintain the passwords and assist people in using the manager seamlessly across all applications.

This was never done and so password-only systems currently in service, are doomed to fail. The criminals will always have the upper hand here.

Two Factor Authentication (2FA) – Implementation Failures

To solve the failure of the single password-only system, Two Factor Authentication was developed. Furthermore, it is gradually being deployed through-out the technological world. The design is brilliant and extremely flexible and I would fully support wide-scale mandatory deployment in all business, financial and network security systems except for one thing. Unfortunately, implementation has been poorly thought out.

What You Know + What You Have

The easy of visualising it is by understanding that it is a combination of “What You Know” and “What You Have”.

There are two major flaws to current implementations by many major banks, software companies and governments.

Failure Mode 1

The item you have must never be allowed to be the same device that contains the system that you are trying to access. The mobile phone is a great example. What security do you think is provided by sending an SMS message to your phone, to complete the authentication process if the person who is trying to get illegal access to the system on your phone, has your phone? Now you have nullified the benefit of 2FA.

For some people, even Email would be a bad choice for 2FA, since most phones also have an email client built-in which can be accessed by anybody who is illegally trying to use your phone.

Failure Mode 2

If second authentication mechanism is any way reliant on a telecommunications network, or require you to be online, you are dependant on the provider of that network to provide a 24/7 service, 365 days per year. This is clearly a problem when this is no longer a guarantee. During an outage, you will not be able to authenticate yourself. Many Australians who were trying to access non-Optus services found this out last week when they found that they were not able to receive SMS authentication messages on their mobile phones if they had a Optus provision for the mobile service.

Can Two Factor Authentication Be Made To Work Better?

Time-based One-time Password (TOTP) is one of the many alternative second factor authentication mechanisms available. TOTP was also included in the whole 2FA design from the start. I have found a resource that best explains in layman’s terms.

This works exceptionally well and does not require a network connection. Most smart watch and sports watch manufacturers could put this as a standard function on their watches. I use it myself on my watch for a number of websites that support this mode of 2FA.

TOTP applications can run on virtually anything that contains a real-time clock. Virtually any modern appliance has one!

If as much effort was put into pushing consistent, practical security measures such as this, as it put into the “upgrades” that are pushed out every day, we could make a significant impact on cybercrime, overnight.

Password Managers

I know that I mentioned Password Managers in this article and still believe that if you want to go online safely, then using one, is a requirement, not an option. Remembering good quality passwords should not be possible, as that is what “good quality passwords” means. The choice of password manager is more complex that what is commonly described by the reviewers, even in the best technical magazines, as they are usually written from the perspective of a people who is able to permanently connect to an online system, wherever they are, via a PC, phone, tablet, etc. For many people, this is not a valid assumption.

I will go into a more detail on a workable password manager solution in another article.

In the meantime, go with any reputable service you choose, but make sure that your password data can be exported from that service/application and that you keep a digital copy of all your passwords on a portable memory device at home, in your fireproof safe.