Adding two-factor authentication to your life

If we accept that account information is regularly and inevitably going to be exposed, as the litany of recent breaches suggests, the next question is how to design a system’s security to survive it.

You can tell your users not to reuse passwords, but you cannot actually force them to do so (not knowing what they are). Also, at some level of scale that expectation is unrealistic without resorting to master password lists, increasing the stakes of that information’s exposure. “One password to rule them all” is great, if you don’t mind making everything dependent on your master list/system. Where would you keep it? On your laptop that never fails, that iPhone you never lose or that desktop at the job you’ll have forever? Allow yourself a half-second to consider keeping it on all of them before returning to the premise that we’re trying to improve security.

Mnemonic systems (e.g. based on something like the date of account creation: “YYYYMM[my initials]”) might be useful, with the downside of predictability. Picking an inscrutable mnemonic that nobody else knows is probably the best approach, but honestly, the world where users can be expected to be able to individually create, remember and reliably perform cryptographic functions in their heads is a totally different security universe than the one we live in.

One is not enough

The problem boils down to a static username and password alone being an insufficient threshold.  The only factor in this method of authentication is “something you know.” We’re very familiar with other methods of authentication, like car keys or ATM cards being “something you have”, but how do we add them to systems that are served up by browsers around the web? The established model is to give the user something to have, namely a password generator: for example, Amazon employs a very affordable ($13) Gemalto Ezio device for use with their hosting environment’s multi-factor authentication. If you are staking the operations of your library or your clients libraries on EC2, on a simple cost/benefit, you certainly should use Ezio. There are plenty of other similar options, including RSA’s SecureID, if you want to roll your own.

What goes into each device is essentially a small operating system, software and secure storage. The software is able to use a unique identifier from storage to produce a deterministic new string on a regular interval (typically every minute). But a newer model has emerged from the realization that users already have uniquely identified hardware with an OS, namely their mobile phones, needing only the software for completion.  Now you can save $15 and a few days shipping by just installing the app of your choice:

So while you’re waiting for work to approve or integrate mutli-factor, or just finish moving everything to the damn cloud already, you can at least secure your Google account (or even protect your Warcraft Paladin) against unwanted access.

For me, my Google account is the core of my online life, having used Gmail and Documents at two previous jobs already. Calendar, Picasa, Groups, Reader and the many sites featuring Google integration are all dependent on it. Almost all my online accounts are linked back to Gmail. Even the local community radio station I volunteer at automates its broadcast off of feeds assembled by Reader. So the chance to add another layer of security for free is one I am quite happy to utilize and recommend.

Details

Not every application that hits Google is equipped to handle multi-factor authentication. As a workaround, Google provides long-form application-specific passwords. This is a well-tailored solution inasmuch as it allows old apps to keep working without risk to the rest of your account.

Google can also remember authorization from a given machine for up to a month, so you won’t have to keep tapping the app every time you sit down on your main systems.  To avoid the problem of losing your phone, having your battery run out, etc. you should print off and stash some 1-time use verification codes.  There are also fallback options for sending codes to a secondary phone number.  Make sure you go through all the configuration steps before throwing the switch, or else you may effectively secure your accounts against yourself.

See Also

For additional reading, and as a next level of functionality for your servers, check out my emerging favorites, Duo Security for their mobile-based solutions including the ability to authenticate via touch-tone when their servers call your phone.  Very cool, no app needed!

About Joe Atzberger

Joe Atzberger (atz) is a library hacker in Palo Alto, CA. He worked with Galen at both LibLime and Equinox Software, Inc. as an open source developer on Koha and Evergreen. Joe currently works on Hydra and institutional digital repository infrastructure at Stanford.

2 Responses to Adding two-factor authentication to your life

  1. Dug Song says:

    Hi Joe,

    Thank you for the kind mention of Duo! We’re huge library fans – especially of the work Eli Neiburger has done at the Ann Arbor District Library (for instance, their open-source software, DRM-free music catalog, video game programs, etc.).

    A quick clarification – Amazon’s multifactor support for AWS actually only supports the Gemalto device, which is unfortunate given it’s been built to a standard protocol. For EC2 users, we’ve actually open-sourced our Unix integration and made it free for up to 10 admins to help fill the gap.

    We’ve also open-sourced our WordPress plugin and web integrations as well; Facebook, Google, Paypal, Chase, World of Warcraft, etc. shouldn’t be the only sites that can afford to offer strong two-factor auth to their users. I’m doubtful many library patrons care enough about the privacy of their checkout history to elect two-factor auth, but you never know!

    • Thanks for comment. Good point about EC2 requiring Ezio specifically. I should have been clearer that by “roll your own”, I meant on systems or applications you build, inside or outside EC2.

      Facebook’s new two-factor authentication is interesting, if for nothing else than the stream of confused, chat-speaking, paranoid-for-the-wrong-reasons user comments:
      https://www.facebook.com/note.php?note_id=10150172618258920

      I already signed up for a Duo account and hope to get a chance to play around more with it later.