Lesson 23 – How to keep your account safe with Multi-factor authenticator

What is multi-factor authentication?

Classic authentication involves logging in with the help of a username and a password, as seen with email providers like Yahoo, Google, or T-Online. This is a single-factor login based on knowledge of credentials. Multi-factor authentication (MFA) extends the login process by at least one additional factor.

Knowledge, biometrics, and possession as authentication factors

 There are three main methods for authentication

Authentication

The third method of authentication is possession. This could be a special hardware USB stick that you plug into your PC to log in. Apple uses this type of authentication, for example, to register a new device. If a login occurs on a new device, a message appears on the already existing devices saying “Do you want to authorize this device?”. Thus, only possession/access to a specific item is required.

Two-factor-authentication (2FA)

When any two of these factors are combined, it’s called two-factor authentication, abbreviated as 2FA. You may have noticed this 2FA option for many logins on the internet, whether it be on Instagram, Facebook, or LinkedIn.

For banks, two factor authentication has long been the standard. Fifteen years ago, people used a printed TAN list at home to confirm logins and transactions. Printed TAN lists are now obsolete, but the principle remains the same. The paper has been replaced by a USB stick or smartphone app. Whether it’s Sparkasse or Volksbank, nowadays every user needs at least two apps for online banking on their smartphone. The regular banking app and an app that contains the code for 2FA.

Another example is payment with a smartphone. Here, a combination of possession and biometrics unlocks the card. The smartphone, with the bank card set up, represents possession. The login via facial recognition or fingerprint represents the biometrics. In contrast, smaller amounts of 25 to 50 euros can be paid with just the possession of an EC or credit card –– thanks to contactless payment. In this case, the mere possession of the card, for example, enables you to make a 25-euro card payment.

Three-factor authentication (3FA)

Three-Factor Authentication, abbreviated as 3FA, provides additional security. In addition to login credentials, two authentication codes are sent to different endpoints –– for instance, to an email address and a phone number. Alternatively, a password login can be followed by a fingerprint scan and security code entry. Any combination of knowledge, biometrics, and possession is possible here.

Using multiple devices to authenticate

For example, if an attacker gains access to a user’s smartphone, which contains both the login data and the app for 2FA/3FA, the additional factor is no longer a real safeguard.

Enhanced security with multi-factor authentication

Correctly implemented multi-factor authentication provides significantly more security. For example, if a user’s PC and browser have not been kept up to date for an extended period, they may have inadvertently installed ransomware that can record their keyboard and observe their browser history. The attacker can now log in anywhere the user has provided a username and password. Still, without the second factor, the hackers cannot do much with the access data. The more factors required to log in, the greater the effort required for the attacker. Access data, 2FA code, and facial recognition? Access data, email code, and notifications to your tablet? A remote hacker may require physical intrusion these cases, making the effort too great for hackers.

2-factor authentication on BISON

To use BISON services, 2FA is mandatory. BISON uses an SMS TAN similar to the Authenticator app. After the investor logs in with their access data, they receive a code via SMS, which must be entered. This process ensures that an attacker cannot access the account with just the login data.