You hear about it more and more often: data breaches at companies and government agencies. In the past month, data breaches were discovered at the municipalities of Utrecht and Almelo. It’s suspected that the personal data was stolen using malware. Fortunately, the two data breaches mentioned don’t appear to involve login credentials. A strong password can’t protect you against data breaches, but a good infrastructure can.
MFA
At Trusted-ID, we often talk about multi-factor authentication (MFA), and we’re pleased to see that software packages are increasingly offering the option to use MFA. Login credentials are particularly vulnerable to cybercrime, and criminals can cause extensive, often financial, damage while posing as you. MFA provides an extra layer of protection, an additional factor that can verify your identity. This extra layer is especially welcome due to the advent of increasingly sophisticated computers that can crack passwords faster and faster.
“LETTER, LETTER, LETTER, LETTER, LETTER, NUMBER, NUMBER, NUMBER, NUMBER” – 79 MATCHING PASSWORDS FOUND!
Not only will quantum computing be able to recover potential passwords incredibly quickly in the near future, but today there are applications available that search for passwords on command. These applications operate based on, among other things, known password lists, which are often leaked (therefore, never use the same password in multiple locations). In such applications, a malicious actor (or security expert) can search for passwords based on length and the type of character used. A search term might be: “letter,letter,letter,letter,letter,letter,number,number,number,number.” The password “secure2016” can be recovered this way. Perhaps the scariest part is that these applications are available to anyone, if you know where to look.
TOKENS
The problem is clear. Passwords, especially those consisting of predictable symbol combinations or used repeatedly, are weak and pose increasing risks without additional security. This second security factor is already used by most people. Consider online banking: when you want to make a transaction, you’re likely to have a “token” that generates a one-time code that must be entered on your screen before the transaction can proceed. A token can take the form of a device that automatically generates a code for each transaction and is specifically designed for that purpose. Consider two major banks in the Netherlands: one provides every online banking customer with a device that reads the debit card and sends a one-time code to the user to log in or complete a transaction. The other transforms a customer’s phone into a token by sending a one-time code to that smartphone.
In short, 2FA (two-factor authentication) is a combination of what you know (your password) and what you have (a token). If your password is leaked or stolen, an additional factor can still deny access to your accounts, because an intruder doesn’t have access to the token.
Not only can it involve what you know (your password) and what you have (a physical token), but a third factor can be added: where you are (a physical location). A physical location can be your presence at the office, whether or not at certain times (e.g., nine to five).
By using multi-factor authentication, accounts with less complex passwords become much more secure, which is no unnecessary luxury with all the data leaks these days.
Check if any of your accounts have been compromised in a data breach: https://haveibeenpwned.com