Why aren’t passwords sufficient?
Passwords are a good first layer of protection, but attackers can guess or intercept passwords. Additional security measures can protect you even if an attacker does obtain your password. You can strengthen that first layer of protection by avoiding passwords based on personal information or words found in the dictionary; building passwords from combinations of numbers, special characters, and lowercase and capital letters; and not sharing your passwords with anyone else. (See Choosing and Protecting Passwords for more information.)
What additional levels of security are available?
Multi-factor authentication, simultaneously using multiple pieces of information to verify your identity, is becoming more common. (You may see multi-factor authentication (MFA) advertised as two-factor authentication.) Even if an attacker obtains your password, he may not be able to access your account if it’s protected by MFA. The theory behind this approach is similar to requiring two or more forms of identification or two keys to open a safe deposit box. You should turn on MFA where it’s available. Authentication categories include something you know (e.g., answers to secret questions or passwords); something you have (e.g., a token or other item in your possession); and something you are (e.g., a biometric measure such as a fingerprint).
Something you know – This includes passwords or pre-established answers to questions. (See tips below for setting up good answers to these “secret questions.”)
Something you have – This could be a small physical token such as a smart card, a special key fob, or USB drive. You might use this token in conjunction with a password to log into an account. However, software-based tokens are also common. These software-based tokens can generate a single-use login personal identification number (PIN). Other variations include SMS messages, phone calls, or emails sent to the user with a verification PIN. These token PINs can often be used only once and are voided immediately after use. So, even if an attacker intercepts the exchange, the attacker will not be able to use the information again to access your account.
Something you are – Biometric identification can include scanning of eyes (retinas or irises) or fingerprints, other facial recognition, voice recognition, or authentication through signatures or keystroke movements. A common example of biometric identification is the fingerprint scanner used to sign in users on many modern smartphones.
Another form of verification is the use of personal web certificates. Unlike certificates used to identify web sites (see Understanding Web Site Certificates), personal web certificates are used to identify individual users. A website using personal web certificates relies on these certificates and the authentication process of the corresponding public/private keys to verify that you are who you claim to be. (See Understanding Digital Signatures and Understanding Encryption.) Because information identifying you is embedded within the certificate, an additional password is unnecessary. However, you should have a password to protect your private key so that attackers can’t gain access to your key and represent themselves as you. This process is similar to MFA, but it differs in this way: the password protecting your private key is used to decrypt the information on your computer and is never sent over the network.
What if you lose your password or certificate?
Perhaps you’ve forgotten your password or you’ve reformatted your computer and lost your personal web certificate. Most organizations have procedures for giving you access to your information in these situations. For the best security, keep information on your account up to date. This includes alternate email addresses or phone numbers that can help verify your identity if you forget your password.
In the case of certificates, you may need to request that the organization issue you a new one. In the case of passwords, you may just need a reminder. No matter what happened, the organization needs a way to verify your identity. To do this, many organizations rely on secret questions.
When you open a new account (e.g., email, credit card), some organizations will prompt you to provide them with the answer to a question. They may ask you this question if you forget your password or request information about your account over the phone. If your answer matches the answer they have on file, they will assume that they are actually communicating with you. In theory, secret questions and answers can protect your information. However, common secret questions ask for mother’s maiden name, social security number, date of birth, or your pet’s name. Because so much personal information is now available online or through other public sources, attackers may be able to discover the answers to these questions.
Realize that the secret question is really just an additional password. When establishing the answer, you don’t have to supply real information. In fact, if you’re asked to provide a pre-established answer, dishonesty may be the best policy. Choose your answer as you would choose any other good password, store it in a secure location (e.g., in a password manager), and don’t share it with other people.
While additional security practices offer you more protection than a password alone, they should not be considered completely effective. Increasing the level of security only makes it more difficult for attackers to access your information. Be aware of MFA and other security practices when choosing a bank, credit card company, or other organization that will have access to your personal information. Don’t be afraid to ask what kind of security practices the organization uses.
