Skip to main content

Here’s why people are saying two-factor authentication isn’t perfect

When two-factor authentication was first introduced, it revolutionized device security and helped make identity theft much more difficult – at the slight cost of minor inconvenience added to logins.

But it’s not perfect, nor has it solved all of our hacking and data theft problems. Some recent news has provided more context for how hackers have been sidestepping two-factor authentication and eroding some of our trust in it.

Two-factor authentication over a laptop.
Image used with permission by copyright holder

What exactly is two-factor authentication?

Two-factor authentication adds an extra layer of security to the login process for devices and services. Previously, logins had a single factor for authentication — typically, a password, or a biometric login like a fingerprint scan or Face ID, occasionally with the addition of security questions. That provided some security, but it was far from perfect, especially with weak passwords or autofilled passwords (or if login databases are hacked and that info starts showing up on the dark web).

Two-factor authentication addresses these issues by adding a second factor, another thing a person hasto do to guarantee that it’s really them and they have authority to access. Typically, that means being sent a code via another channel, like getting a text message or email from the service, which you then have to input.

Duo Authentication Example.
Image used with permission by copyright holder

Some use time-sensitive codes (TOTP, Time-Based One Time Password), and some use unique codes associated with a specific device (HOTP, HMAC-based One Time Password). Certain commercial versions may even use additional physical keys that you need to have at hand.

The security feature has become so common, you’re probably used to seeing messages along the lines of, “We’ve sent you an email with a secure code to enter, please check your spam filter if you haven’t received it.” It’s most common for new devices, and while it takes a little time, it’s a huge jump in security compared to one-factor methods. But there are some flaws.

That sounds pretty secure. What’s the problem?

A report came out recently from cybersecurity company Sophos that detailed a surprising new way that hackers are skipping over two factor authentication: cookies. Bad actors have been “cookie stealing,” which gives them access to virtually any kind of browser, web service, email account, or even file.

How do these cybercriminals get these cookies? Well, Sophos notes that the Emotet botnet is one such cookie-stealing piece of malware that targets data in Google Chrome browsers. People can also purchase stolen cookies through underground marketplaces, which was made famous in the recent EA case where login details ended up on a marketplace called Genesis. The result was 780 gigabytes of stolen data that was used to try and extort the company.

While that’s a high-profile case, the underlying method is out there, and it shows that two-factor authentication is far from a silver bullet. Beyond just cookie stealing, there are a number of other issues that have been identified over the years:

  • If a hacker has gotten hold of your username or password for a service, they may have access to your email (especially if you use the same password) or phone number. This is especially problematic for SMS/text-based two-factor authentication, because phone numbers are easy to find and can be used to copy your phone (among other tricks) and receive the texted code. It takes more work, but a determined hacker still has a clear path forward.
  • Separate apps for two-factor authentication, like Google Auth or Duo, are far more secure, but adoption rates are very low. People tend to not want to download another app just for security purposes for a single service, and organizations find it a lot easier to simply ask “Email or text?” rather than require customers to download a third-party app. In other words, the best types of two-factor authentication aren’t really being used.
  • Sometimes passwords are too easy to reset. Identity thieves can gather enough information about an account to call up customer service or find other ways to request a new password. This often circumvents any two-factor authentication involved and, when it works, it allows thieves direct access to the account.
  • Weaker forms of two-factor authentication offer little protection against nation-states. Governments have tools that can easily counter two-factor authentication, including monitoring SMS messages, coercing wireless carriers, or intercepting authentication codes in other ways. That’s not good news for those who want ways to keep their data private from more totalitarian regimes.
  • Many data theft schemes bypass two-factor authentication entirely by focusing on fooling humans instead. Just look at all the phishing attempts that pretend to be from banks, government agencies, internet providers, etc., asking for important account information. These phishing messages can look very real, and may involve something like, “We need your authentication code on our end so we can also confirm you are the account holder,” or other tricks to get codes.

Should I keep on using two-factor authentication?

Absolutely. In fact, you should go through your services and devices and enable two-factor authentication where it’s available. It offers significantly better security against problems like identity theft than a simple username and password.

Even SMS-based two-factor authentication is much better than none at all. Infact, the National Institute of Standards and Technology once recommended against using SMS in two-factor authentication, but then rolled that back the next year because, despite the flaws, it was still worth having.

When possible, choose an authentication method that’s not connected to text messages, and you’ll have a better form of security. Also, keep your passwords strong and use a password manager to generate them for logins if you can.

Security and Privacy settings open on a MacBook.

How can two-factor authentication be improved?

Moving away from SMS-based authentication is the big current project. It’s possible that two-factor authentication will transition to a handful of third-party apps like Duo, which remove many of the weaknesses associated with the process. And more high-risk fields will move into MFA, or multi-factor authentication, which adds a third requirement, like a fingerprint or additional security questions.

But the best way to remove issues with two-factor authentication is to introduce a physical, hardware-based aspect. Companies and government agencies are already starting to require that for certain access levels. In the near future, there’s a fair chance we’ll all have customized authentication cards in our wallets, ready to swipe at our devices when logging into services. It may sound weird now, but with the steep rise of cybersecurity attacks, it could end up being the most elegant solution.

Editors' Recommendations

Tyler Lacoma
If it can be streamed, voice-activated, made better with an app, or beaten by mashing buttons, Tyler's into it. When he's not…
Here’s why people are saying to avoid the $1,199 M2 MacBook Air
The keyboard of the MacBook Air.

Apple's latest MacBook Air with the new M2 chip has been controversial, to say the least. The new MacBook Air features a refreshed design and is the successor to the M1, Apple's new M2 system-on-a-chip.

But since the new M2 MacBook Air dropped, tech reviewers, experts, and regular people are saying you should avoid the base configuration of this new machine due to some pretty substantial performance issues. For a more affordable laptop, this is a frustrating bind that potential MacBook Air buyers are being put in.

Read more
Hackers stole passwords from 140,000 payment terminals using malware
The Wiseasy point of sale system on a table.

An Android-based payment system has been affected by hackers who have been able to infiltrate its database and gain access to 140,000 payment terminals globally, according to TechCrunch.

The brand, Wiseasy, is well known in the Asia-Pacific region, with its payment terminals used in restaurants, hotels, retail outlets, and schools. Its accompanying Wisecloud cloud service is used for remote management and configuration for its customer's terminals.

Read more
Cyberattacks have nearly doubled since last year, report says
Cybersecurity is a constant battle.

A recent analysis by fraud-buster and cybersecurity company Seon found that cyberattacks have nearly doubled since last year. Given that the number of people using the internet worldwide is creeping upward quite slowly by comparison, that means the odds that you'll be affected are increasing rapidly. It's time to double-check your security settings.

The most common cyberattacks reported were ransomware, phishing, and malware. Ransomware refers to software that threatens you with data loss or the sharing of personal information if a payment isn't made. Malware is similar but takes direct action to gain unauthorized access to your data, storage, and computer-processing power.

Read more