3 MISTAKES You're Making with 2-Factor Authentication (2FA)

▶ Video sponsored by Trend Micro. Get 10% off using code ATS10.

If you care about your personal security and privacy online, download my free security checklist here:

🔹🔹🔹What You Should Watch Next🔹🔹🔹

We've got a lot of great privacy- and security-related content here on the All Things Secured YouTube channel (although we admit we're a bit biased). If you're wanting to increase your online cybersecurity, here's what's next:

🔹🔹Help Support All Things Secured (Recommended Services)🔹🔹

If you enjoy this kind of practical security and privacy content, one of the best ways you can help support this channel is by using these affiliate links to our favorite products and services. When purchasing through these links, you not only get the best available deal, the companies will also pay us a small commission. Thank you for your support!

*********************
Video Timestamps
*********************
0:00 - Common mistakes of 2FA
0:38 - Mistake 1: Using SMS Text for 2FA
2:11 - Secure your mobile device with Trend Micro
3:01 - Mistake 2: Limiting where you enable 2FA
4:05 - Mistake 3: Not creating proper 2FA backups
5:42 - The future of passwords and 2FA
*********************

2-factor authentication is a recommended security solution given by most online security experts, but it's not useful unless you're doing it right. In this video, Josh shares three common mistakes with two factor authentication and how you can fix the problems.

#trendmicro #premiumsecuritysuite #cybersecurity #antivirus

[ortytoon]

It's really odd that google accounts are more secure than bank accounts. I really hope that'll change some time relatively soon. fingers crossed 🤞🤞.

[warwagon]

As far as backing up I recommend putting the authenticator on every phone and tablet you own. I also recommend taking s a screenshot of that initial QR code that you scan in, giving it a site name and saving it to a couple disconnected USB flash drives and maybe a 3rd in a safety deposit box. This allows you to re-add those sites back into an authenticator should you have to.

[EIRE]

I've been using a dumb phone for years, and will continue to do so.
In fact, the demand and purchases of them have massively increased recently.
Cheap, cheerful, and reliable.

[bendono]

I am a little wary regarding biometrics. As I understand it, courts can compel someone to provide biometrics without concern of violating their rights. Passwords, on the other hand, may actually be forgotten (or better never known via password manager), so cannot be compelled. I guess it depends on the situation and if other security factors are also used in conjunction with it.

Also, I have had problems using fingerprints in the past. I had it implemented on my phone for a while, but quite frequently it would not recognize me. I also have it set on one of my bank accounts for ATMs. It too often does not recognize me forcing me to try multiple times. My work PC uses facial recognition, but it too frequently does not recognize me causing periodic downtime. It is problematic when the actual person gets locked out of their own accounts.

[Cloudsifter]

I should add that I'm sick of my credit union, and healthcare providers, not offering 2FA except via text and e-mail. The credit union also restricts how complex my password can be. I understand that their reasons for that (people will write it down or forget it), but I use KeePass (secured with a very strong dicepassword that I've memorized) and store very strong passwords within it. It is infuriating that I can secure my Amazon and e-mail accounts more than my financial and health accounts! Argh!

[MrWhipple]

You can prevent SIM swapping by locking your SIM card via your carrier. Verizon let me do this through my account on their website. I also have a PIN for my SIM card that requires me to enter it every time I reboot my phone. (It's a different PIN than the one to unlock my phone.)

Using unencrypted SMS for 2FA is still vulnerable to man-in-the-middle attacks, but it's pretty straightforward to mitigate the risk of SIM swapping.

[kublatom]

3:49 In my opinion, storing TOTP in the same password manager as your password doesn't follow the best practice. It should be stored/accessible on/via a different technology. In this case, if an attacker breaks your password manager's database, he/she/they has access to both of your factors.
The rest of the video is perfect and I like how you increase security awareness.

[calebmccool]

Hey Josh. Not sure if you've heard, but there's a huge YouTube channel called Think Media (2.33 million subscribers) whose podcast channel (85.5k subscribers) was hacked just a few days ago. In a recent video, they even explained they had 2FA - and it still got hacked. I thought to mention them because of the similar circumstances to what this video is about.

By the way, thanks for the video 🙏

[coweatsman]

Given that my phone fails to recognise my fingerprint 50% of the time I don't think I would want to rely on it solely.

[specialk]

My bank and CC bank only offer sms also. It is frustrating.

[terrytabor]

I have concerns regarding usage of biometrics that I'd love to see a video from you about;assuming you haven't addressed these issues already... My concerns revolve around end of life issues. That is, if everything important is protected by 2fa that requires biometrics to open, how will my executor be able to access these accounts upon my death.

I love your videos! Keep 'em coming!

[frankfurter]

You very often don’t provide adequate explanations for your statements. It isn’t clear to me at all why it was easy to login into Dorsey’s Twitter account by receiving 2FA codes. The phone company may negligently transfer your telephone number but it doesn’t know your twitter login password. Please elaborate.

[k]

I don't care to use SMS messages to get codes for another reason. What if somehow you lose access to that phone number? (suppose you change your number) Do you have a list of all the places you used it for access? I prefer to use a security key. Also, I have three of them on any account that allows it. I'm too paranoid to just have two.

[kappy]

Please explain how to get 2FA? Your explanation was very eloquent but “where does one start”? How do you scan a code when there is no code to scan?

[penultimatename]

Biometrics appear to be an excellent solution with one concern. I believe Finger recognition has an equivalent concern as Sim swap. In this case the smartphone is lost or stolen. Then someone lifts off the fingerprint on the phone. Kind of like sticking a paper on the back with the password in full view. One can argue this is extremely rare and nothing to worry about so no worries. Sim swapping a very rare occurrence is becoming part of the basic toolkit of hackers.

Facial recognition is probably safer unless one has the tendency to squeeze the phone against one's face.

[thedude]

One mistake of technicality, you incorrectly used the term 2FA once in the video. At around 5:55, you say using biometrics instead of 2FA. You correctly described biometrics as "something you are" just before that. The thing is, that "instead of 2FA" really should have been "instead of something you have". 2FA just means using two of the "something you know (pw)", "something you have (yubikey or phone/email)", and "something you are (biometrics)". 2FA does not mean using an authenticator, hardware key, or SMS/email. Password plus biometrics is just as valid of 2FA as password plus Yubikey.

[wrighty]

Just purchased two yubikey 5 nfc keys so will be watching plenty of YouTube trying to learn as much as I can why waiting on delivery of the keys

[MyNameisPuddintane]

Love the channel. Would also suggest backing up authenticator qr codes to encrypted drives or cryptomator and cloud.

[bromam]

Can the Yubico keys be used for ADVANCED DATA PROTECTION via Apple iCloud?

[coweatsman]

Mistakes people make with passwords are not changing them frequently enough, writing them down and using the same passwords for multiple accounts. Biometrics are unchangeable and are necessarily reused again and again and with fingerprints you leave them around everywhere.