Information security experts have long agreed that the most reliable form of two-factor authentication with a one-time code is an authenticator app. Most services offer this method as a second level of account protection, while in some cases, two-factor authentication using a code from an app is the only available option.<\/p>\n
But the reasons why one-time codes are considered so safe is rarely discussed, so legit questions arise as to whether it\u2019s really a good option, how reliable it is, what dangers are worth considering, and what you need to keep in mind when using this two-factor authentication method. The main purpose of this post is to answer those questions.<\/p>\n
Generally, such apps operate as follows: the service in which you\u2019re authenticating and the authenticator itself share a number \u2014 a secret key (it is contained in a QR code that you use to enable authentication for this service in the app). The authenticator and the service simultaneously use the same algorithm to generate a code based on this key and the current time.<\/p>\n
When you enter the code that your app has generated, the service compares it with what it generated itself. If the codes match, everything is fine, and you can access the account (and if not, you can\u2019t). Also, when you connect the authenticator app via a QR code, a lot of information is transferred in addition to the secret key. This includes the one-time code\u2019s expiration period (usually 30 seconds).<\/p>\n
The most important information \u2014 the secret key \u2014 is transmitted just once, when the service pairs with the authenticator, and then both parties remember it. That is, with each new login to the account, no information is transmitted from the service to your authenticator at all, so there\u2019s nothing to intercept. In fact, authenticator apps don\u2019t even need internet access to perform their main function. All that a hacker can theoretically get is the actual one-time code that the system generates for you to enter. And this code is valid for just half a minute or so.<\/p>\n
We\u2019ve already discussed in more detail how authenticator apps work in a separate post<\/a>. Read it if you want to know about authentication standards, the information contained in QR codes to connect those apps, and about services that are incompatible with the most common authenticators.<\/p>\n Let\u2019s summarize the main advantages of one-time code authentication from an app:<\/p>\n As you can see, the system is well thought out. Its developers have done everything in their power to make it as secure as possible. But no solution is completely safe. So even when using authentication by code from an app, there are some risks to consider and precautions to take. That\u2019s what we\u2019ll talk about next.<\/p>\n\n I mentioned above that authenticating with one-time codes from an app is great protection against password leaks. And in a perfect world, it would be. Unfortunately, we don\u2019t leave there, There\u2019s a crucial nuance, which stems from the fact that services usually don\u2019t want to lose their users because of such a small annoying detail like losing the authenticator (which can happen to anyone); therefore, they usually provide an alternative way to log into accounts: sending a one-time code or confirmation link to an associated e-mail address.<\/p>\n This means that if a leak has occurred and attackers know both the password and the e-mail address it\u2019s linked to, they can try to use this alternative method to log in to the account. And if your e-mail is poorly protected (especially if you use the same password for it and don\u2019t enable two-factor authentication) it\u2019s very likely that hackers would be able to bypass entering a one-time code from an app.<\/p>\n What\u2019s worth doing about it:<\/p>\n Someone might look over your shoulder when you\u2019re using an authenticator app and see the one-time code. And not only one code, as authenticators often display several codes in a row. So the intruder could log in to any of those accounts if they saw the code. Of course, hackers would not have much time to take advantage of what they caught sight of. But it\u2019s better not to take any chances \u2014 30 seconds might be enough time for a nimble-fingered cybercrook\u2026<\/p>\n The situation is more dangerous if someone manages to get their hands on an unlocked smartphone with an authenticator. In this case, that someone could well take the opportunity to log into your accounts without much haste or trouble.<\/p>\n How to minimize such risks:<\/p>\n Most phishing sites designed for mass attacks are quite primitive. Their creators are usually satisfied with stealing logins and passwords, followed by selling them dirt cheap wholesale somewhere on the dark web. Of course, two-factor authentication is perfect protection against such hackers: even if someone gets your login credentials, they\u2019re completely useless without a one-time code from an app.<\/p>\n However, on more carefully and plausibly crafted phishing sites, particularly those designed for targeted attacks, phishers can also imitate the two-factor authentication verification mechanism. In this case, they\u2019ll not only intercept the login and password, but also the one-time code. After that, the attackers will quickly log into the victim\u2019s real account, while the phishing site may issue an error message and suggest retrying.<\/p>\n Unfortunately, despite its apparent simplicity, phishing remains an extremely effective trick for criminals, and it can be difficult to protect yourself against sophisticated versions of scams. The general advice here is as follows:<\/p>\n To put it mildly, people don\u2019t really like going through the full authentication process. Therefore, services try not to bother their users unnecessarily. In fact, in most cases, you only have to be fully authenticated with a password and confirmation code when you log in to your account on each device for the first time. Or maybe a further time \u2014 if you\u2019ve accidently cleared the cookies from your browser.<\/p>\n After successfully logging in, the service saves a small cookie<\/a> on your computer, which contains a long and very secret number. This file is what your browser will present to the service for authentication from now on. So if someone manages to steal this file, it can be used to sign into your account. No password or one-time code will be needed for this at all.<\/p>\n Such files (along with a bunch of other information like browser-saved passwords, cryptocurrency wallet keys and other similar goodies) can be stolen by Trojan stealers<\/a>. If you\u2019re unfortunate enough to get a stealer on your computer, there\u2019s a very good chance that your accounts will be hijacked, even with all the other precautions.<\/p>\n To prevent this from happening:<\/p>\n Access to your accounts can also be lost due to protection being too strong. Like if after you\u2019ve prohibited getting into your accounts without a code from an app, you somehow lose the authenticator. In this case, you might permanently lose your accounts and information in them. Or at least you\u2019re assured of a few fun days of tearful correspondence with support for access restoration<\/a>.<\/p>\n There are in fact quite a few circumstances where you might lose your authenticator:<\/p>\n All these are unpredictable events, so it\u2019s better to prepare for them in advance to avoid any unpleasant consequences:<\/p>\n Let\u2019s summarize. Two-factor authentication itself seriously reduces the risk of your accounts being hijacked, but it doesn\u2019t guarantee complete security. It\u2019s therefore worth taking extra precautions:<\/p>\n We explain how two-factor authentication with one-time codes works, what the benefits and risks are, and what else you can do to better protect your accounts.<\/p>\n","protected":false},"author":2726,"featured_media":20787,"comment_status":"closed","ping_status":"closed","sticky":false,"template":"","format":"standard","meta":{"_acf_changed":false,"footnotes":""},"categories":[1226,9],"tags":[1047,1931,1021,1183,187,76,2151],"class_list":{"0":"post-20786","1":"post","2":"type-post","3":"status-publish","4":"format-standard","5":"has-post-thumbnail","7":"category-technology","8":"category-tips","9":"tag-2fa","10":"tag-authenticators","11":"tag-kaspersky-password-manager","12":"tag-leaks","13":"tag-passwords","14":"tag-phishing","15":"tag-stealers"},"hreflang":[{"hreflang":"en-ae","url":"https:\/\/me-en.kaspersky.com\/blog\/authenticator-apps-and-security\/20786\/"},{"hreflang":"en-in","url":"https:\/\/www.kaspersky.co.in\/blog\/authenticator-apps-and-security\/25345\/"},{"hreflang":"en-us","url":"https:\/\/usa.kaspersky.com\/blog\/authenticator-apps-and-security\/27957\/"},{"hreflang":"en-gb","url":"https:\/\/www.kaspersky.co.uk\/blog\/authenticator-apps-and-security\/25638\/"},{"hreflang":"es-mx","url":"https:\/\/latam.kaspersky.com\/blog\/authenticator-apps-and-security\/26070\/"},{"hreflang":"es","url":"https:\/\/www.kaspersky.es\/blog\/authenticator-apps-and-security\/28521\/"},{"hreflang":"ru","url":"https:\/\/www.kaspersky.ru\/blog\/authenticator-apps-and-security\/34781\/"},{"hreflang":"x-default","url":"https:\/\/www.kaspersky.com\/blog\/authenticator-apps-and-security\/47426\/"},{"hreflang":"fr","url":"https:\/\/www.kaspersky.fr\/blog\/authenticator-apps-and-security\/20291\/"},{"hreflang":"pt-br","url":"https:\/\/www.kaspersky.com.br\/blog\/authenticator-apps-and-security\/20916\/"},{"hreflang":"de","url":"https:\/\/www.kaspersky.de\/blog\/authenticator-apps-and-security\/29890\/"},{"hreflang":"ru-kz","url":"https:\/\/blog.kaspersky.kz\/authenticator-apps-and-security\/25948\/"},{"hreflang":"en-au","url":"https:\/\/www.kaspersky.com.au\/blog\/authenticator-apps-and-security\/31660\/"},{"hreflang":"en-za","url":"https:\/\/www.kaspersky.co.za\/blog\/authenticator-apps-and-security\/31367\/"}],"acf":[],"banners":"","maintag":{"url":"https:\/\/me-en.kaspersky.com\/blog\/tag\/2fa\/","name":"2FA"},"_links":{"self":[{"href":"https:\/\/me-en.kaspersky.com\/blog\/wp-json\/wp\/v2\/posts\/20786","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/me-en.kaspersky.com\/blog\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/me-en.kaspersky.com\/blog\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/me-en.kaspersky.com\/blog\/wp-json\/wp\/v2\/users\/2726"}],"replies":[{"embeddable":true,"href":"https:\/\/me-en.kaspersky.com\/blog\/wp-json\/wp\/v2\/comments?post=20786"}],"version-history":[{"count":1,"href":"https:\/\/me-en.kaspersky.com\/blog\/wp-json\/wp\/v2\/posts\/20786\/revisions"}],"predecessor-version":[{"id":20788,"href":"https:\/\/me-en.kaspersky.com\/blog\/wp-json\/wp\/v2\/posts\/20786\/revisions\/20788"}],"wp:featuredmedia":[{"embeddable":true,"href":"https:\/\/me-en.kaspersky.com\/blog\/wp-json\/wp\/v2\/media\/20787"}],"wp:attachment":[{"href":"https:\/\/me-en.kaspersky.com\/blog\/wp-json\/wp\/v2\/media?parent=20786"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/me-en.kaspersky.com\/blog\/wp-json\/wp\/v2\/categories?post=20786"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/me-en.kaspersky.com\/blog\/wp-json\/wp\/v2\/tags?post=20786"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}How secure is 2FA with a one-time code?<\/h2>\n
\n
Leaks, e-mail hacking and workarounds<\/h2>\n
\n
Physical access and people looking over your shoulder<\/h2>\n
\n
Phishing sites<\/h2>\n
\n
Stealing malware<\/h2>\n
\n
The lack of authenticator backups<\/h2>\n
\n
\n
How to stay safe<\/h2>\n
\n