As you are currently reading this, we can agree on the likely fact that you are interested to some extent in cybersecurity.
You thus might already be acquainted with the one authentication protocol deemed the strongest: MFA, multifactorial authentication.
It is said to be strong because it is easier to describe it that way rather than using its full name.
It is, so far, the steadiest widely used protocol. Foremost, it is useful to remind you that double authentication is not synonymous with multifactorial authentication.
It is only a possibility amongst other structures that can be used, as long as the use case calls for it, by a service provider.
Depending on the service provider, several methods of multifactorial authentication can be used.
They all rely on a handful of identification elements, whether they be textual information to be typed in a connection form, or a notification to validate to then access the platform.
Amongst all these elements, we can find any of the following:
1. The safety question: to be picked from 4 to 5 options by the user upon inscription, they have a free text field to craft a personal answer.
This is a difficult method to hack due to the fact you need both to figure out the question and the answer. It is convenient to the user as it requires personal yet trivial details to remember which makes them particularly hard to guess.
2. The code sent through text: you need to have your smartphone readily available to retrieve code and access whichever platform you are login in.
This method is hard to bypass without the linked device or having access to the user’s texts.
3. The temporary code: similar to the previous one, it gets generated whenever you attempt to log in and works for a limited time, ranging from 15 to 30 seconds, usually. It can be sent through email depending on the service and your login parameters.
The timeout aspect reinforces security. You do not only need to hack, you need to do it at a specific time and beat the clock.
4. The physical device: they have become more scarce nowadays due to smartphone usage. It can be a USB key, a numeric keypad or any other tangible device.
Smart devices can now replace standalone systems.
5. Biometric validation: usually meaning fingerprints.There is no need to elaborate on the difficulty of biometrical forgery.
(To be fair, retina scans are more widespread in Black Mirror’s universe than in ours, but they do belong in this category.)
Quick answer is: because the credential pairing (login and password) is not sufficient to counter cyberattacks anymore.
Those have become sophisticated and imitate official messaging to a fault, leaving inattentive users vulnerable to credential theft.
To illustrate, here are a couple of techniques used to steal credentials:
Despite the obvious practicality of this protocol, all institutions do not use it.
Apart from the technical resources required, there is a debate about its user experience dimension.
Its rather lengthy connection process does not make for an easy day-to-day use.
Hopefully, improvements have been made: for instance, you can choose to use MFA as the first login protocol for a defined duration period with a timeout effect.
Regain full control over logins
Once the timeout has been reached, you need to start another session.
