Skip to main content

Here’s why people are saying two-factor authentication isn’t perfect

When two-factor authentication was first introduced, it revolutionized device security and helped make identity theft much more difficult – at the slight cost of minor inconvenience added to logins.

But it’s not perfect, nor has it solved all of our hacking and data theft problems. Some recent news has provided more context for how hackers have been sidestepping two-factor authentication and eroding some of our trust in it.

Two-factor authentication over a laptop.
Image used with permission by copyright holder

What exactly is two-factor authentication?

Two-factor authentication adds an extra layer of security to the login process for devices and services. Previously, logins had a single factor for authentication — typically, a password, or a biometric login like a fingerprint scan or Face ID, occasionally with the addition of security questions. That provided some security, but it was far from perfect, especially with weak passwords or autofilled passwords (or if login databases are hacked and that info starts showing up on the dark web).

Two-factor authentication addresses these issues by adding a second factor, another thing a person hasto do to guarantee that it’s really them and they have authority to access. Typically, that means being sent a code via another channel, like getting a text message or email from the service, which you then have to input.

Duo Authentication Example.
Image used with permission by copyright holder

Some use time-sensitive codes (TOTP, Time-Based One Time Password), and some use unique codes associated with a specific device (HOTP, HMAC-based One Time Password). Certain commercial versions may even use additional physical keys that you need to have at hand.

The security feature has become so common, you’re probably used to seeing messages along the lines of, “We’ve sent you an email with a secure code to enter, please check your spam filter if you haven’t received it.” It’s most common for new devices, and while it takes a little time, it’s a huge jump in security compared to one-factor methods. But there are some flaws.

That sounds pretty secure. What’s the problem?

A report came out recently from cybersecurity company Sophos that detailed a surprising new way that hackers are skipping over two factor authentication: cookies. Bad actors have been “cookie stealing,” which gives them access to virtually any kind of browser, web service, email account, or even file.

How do these cybercriminals get these cookies? Well, Sophos notes that the Emotet botnet is one such cookie-stealing piece of malware that targets data in Google Chrome browsers. People can also purchase stolen cookies through underground marketplaces, which was made famous in the recent EA case where login details ended up on a marketplace called Genesis. The result was 780 gigabytes of stolen data that was used to try and extort the company.

While that’s a high-profile case, the underlying method is out there, and it shows that two-factor authentication is far from a silver bullet. Beyond just cookie stealing, there are a number of other issues that have been identified over the years:

  • If a hacker has gotten hold of your username or password for a service, they may have access to your email (especially if you use the same password) or phone number. This is especially problematic for SMS/text-based two-factor authentication, because phone numbers are easy to find and can be used to copy your phone (among other tricks) and receive the texted code. It takes more work, but a determined hacker still has a clear path forward.
  • Separate apps for two-factor authentication, like Google Auth or Duo, are far more secure, but adoption rates are very low. People tend to not want to download another app just for security purposes for a single service, and organizations find it a lot easier to simply ask “Email or text?” rather than require customers to download a third-party app. In other words, the best types of two-factor authentication aren’t really being used.
  • Sometimes passwords are too easy to reset. Identity thieves can gather enough information about an account to call up customer service or find other ways to request a new password. This often circumvents any two-factor authentication involved and, when it works, it allows thieves direct access to the account.
  • Weaker forms of two-factor authentication offer little protection against nation-states. Governments have tools that can easily counter two-factor authentication, including monitoring SMS messages, coercing wireless carriers, or intercepting authentication codes in other ways. That’s not good news for those who want ways to keep their data private from more totalitarian regimes.
  • Many data theft schemes bypass two-factor authentication entirely by focusing on fooling humans instead. Just look at all the phishing attempts that pretend to be from banks, government agencies, internet providers, etc., asking for important account information. These phishing messages can look very real, and may involve something like, “We need your authentication code on our end so we can also confirm you are the account holder,” or other tricks to get codes.

Should I keep on using two-factor authentication?

Absolutely. In fact, you should go through your services and devices and enable two-factor authentication where it’s available. It offers significantly better security against problems like identity theft than a simple username and password.

Even SMS-based two-factor authentication is much better than none at all. Infact, the National Institute of Standards and Technology once recommended against using SMS in two-factor authentication, but then rolled that back the next year because, despite the flaws, it was still worth having.

When possible, choose an authentication method that’s not connected to text messages, and you’ll have a better form of security. Also, keep your passwords strong and use a password manager to generate them for logins if you can.

Security and Privacy settings open on a MacBook.

How can two-factor authentication be improved?

Moving away from SMS-based authentication is the big current project. It’s possible that two-factor authentication will transition to a handful of third-party apps like Duo, which remove many of the weaknesses associated with the process. And more high-risk fields will move into MFA, or multi-factor authentication, which adds a third requirement, like a fingerprint or additional security questions.

But the best way to remove issues with two-factor authentication is to introduce a physical, hardware-based aspect. Companies and government agencies are already starting to require that for certain access levels. In the near future, there’s a fair chance we’ll all have customized authentication cards in our wallets, ready to swipe at our devices when logging into services. It may sound weird now, but with the steep rise of cybersecurity attacks, it could end up being the most elegant solution.

Tyler Lacoma
Former Digital Trends Contributor
If it can be streamed, voice-activated, made better with an app, or beaten by mashing buttons, Tyler's into it. When he's not…
Why Google Chrome Incognito Mode isn’t what it claims to be
Google Chrome icon in mac dock.

A seemingly obscure little class-action lawsuit filed in 2021 has exploded into the mainstream news lately, alleging that Google continues to track users when they’re using incognito mode on Chrome.

Of course, any savvy web user knows there’s no such thing as complete privacy on the internet, at least not without running Tor through a VPN tunnel while wearing a Guy Fawkes mask. But it seems what we expect of Google Chrome’s incognito mode and what Google actually does are two different things.

Read more
Passwords are hard and people are lazy, new report shows
A person using 1Password on a MacBook.

Despite ongoing efforts by security researchers and internet titans to push us to use stronger passwords and two-factor authentication to secure online accounts, people are lazy and continue to make serious mistakes that jeopardize their privacy and security, a new report shows.

A new survey that delves into password selection shows an alarmingly high number of people reuse passwords across multiple accounts. If you are doing this, you should be aware that it only takes one security breach to put all of your accounts at risk. Hackers know that this is a common practice and will try the same stolen passwords at every popular online service in hopes of gaining easy access.

Read more
Here’s why people are saying the Nvidia RTX 4090 isn’t worth waiting for
RTX 3080 graphics card on a pink background.

Nvidia's long-awaited RTX 4090 is expected to launch within a few months, ushering in a new era for the best graphics cards alongside AMD. We don't have any official news on the RTX 4090 yet, but the rumor mill hasn't been quiet.

A slew of leakers and industry insiders say Nvidia's next-gen GPU might not be worth waiting for, especially considering the current state of GPU prices.
It draws a ton of power

Read more