Two Factor Authentication Analysis

What is two factor authentication

The traditional mode of logging in to an account involves entering a username and password. This is referred to as single-factor authentication. Two Factor Authentication (2FA) is a verification process that adds another level of authentication by mandating the user to key at least two out of the three different types of credentials before allowing access to an account. Usually these two factors address “what the users have” and “what the users know”. Broadly they can be outlined as follows:

• Something known to the user like a Personal Identification Number (PIN), password, or a pattern

• Something physical that the user carries with him/her like a hardware token (the ubiquitous RSA tokens used by most IT

The thief should have both pieces of the puzzle “ what the users have” and “what the users know”.

Why use a two factor authentication process

Our professional and personal lives are increasingly becoming digital. We execute our banking transactions online. Our personalities have moved online through social media platforms like Facebook and twitter. We are operating through global delivery models with teams distributed across the world, working and collaborating online. Each of these activities in turn generate loads and loads of confidential data, many of which can have far reaching implications when used by the wrong people. Hence, data theft and online fraud have become big business.

Different forms of data theft have evolved over time. Identity theft and phishing are just two of the many categories. For most types of online fraud, the criminal needs a foot in the door and accessing someone’s login credentials is one such step. Although 2FA is not fool proof, it does make it very difficult for the criminal because two different credentials will be needed wherever 2FA has been

This can be done through different ways including Malwares, Credit card reader skimming and account recovery. The last one works as a tool for breaking 2FA because it usually by passes 2FA completely.

2FA is also rendered useless wherever there is a loophole in the 2FA implementation. 2FA for many platforms can be circumvented, especially on the mobile platform. A senior security researcher at Duo security labs was able to log in to a Paypal account without having to authenticate using 2FA on the 2FA enabled account. The same security lab has also been able to bypass Google’s two step authentication process by misusing unique passwords that are used to connect individual applications to Google accounts.

2FA also has vulnerabilities when it comes to dependencies. Third party authentication tokens are dependent on the security of the issuer or manufacturer. If that gets compromised, so does the 2FA implemented using those devices. A case in point being the March 2011 breach of the RSA SecureID tokens. Mobile based 2FA authentications are susceptible to failure when the security of the mobile service provider is breached or when Malwares on the user’s phones intercept the authenticating SMS messages and send them to the