2-Step Verification

7 05 2014

Strong efforts have to be undertaken to secure data in the digital world. Even your identity can be countermined if you think about a hacked social media account where a bad guy publishes using your name.

Sometimes hackers behave like terrorists and try to destroy everything they are able to. A victim could suffer humiliation, identity theft, and lifetime suspension from services and social networks.

See this article to understand what I mean

How Apple and Amazon Security Flaws Led to My Epic Hacking

There are many different approaches to secure accounts …

  • 1 Using strong passwords
    that means passwords consisting of characters, special characters, and numbers.
    Apps like 1Password by AgileBits Inc., USA, are able to randomly generate complex passwords up to a length of 30 characters. Good idea but from then on you are bound to access accounts via the integrated browser of this app if you don’t want to write the password down on a sheet of paper. If you temporarily do not have access to your device there is no chance to access your account.
  • 2 2-Step Verification
    Your personal device is needed to receive a code with which you then identify yourself.
  • 3 Additional hardware
    to generate a code which has to be entered on a website. A transaction authentication number (TAN) is used by some online banking services as a form of single use one-time passwords to authorize financial transactions. TANs are a second layer of security and are used in different kinds

    • Classical TAN
      numbers generated by a bank and printed on a sheet of paper
    • Indexed TAN
      called iTAN where the user is not asked to use an arbitrary TAN from the list but to enter a specific TAN as identified by a sequence number (index). As the index is randomly chosen by the bank, an arbitrary TAN acquired by an attacker is usually worthless.
    • iTAN with CAPTCHA
      Prior to entering the iTAN, the user is presented a CAPTCHA, which in the background also shows the transaction data and data deemed unknown to a potential attacker, such as the user’s birthdate. This is intended to make it hard (but not impossible) for an attacker to forge the CAPTCHA.
      This variant of the iTAN is method used by some German banks adds a CAPTCHA to reduce the risk of man-in-the-middle attacks. Some Chinese banks have also deployed a TAN method similar to iTANplus. A recent study shows that these CAPTCHA-based TAN schemes are not secure against more advanced automated attacks.
    • Mobile TAN
      mTANs are used by banks in many countries. When the user initiates a transaction, a TAN is generated by the bank and sent to the user’s mobile phone by SMS. The SMS may also include transaction data, allowing the user to verify that the transaction has not been modified in transmission to the bank.
    • Simple TAN generators
      The risk of compromising the whole TAN list can be reduced by using security tokens that generate TANs on-the-fly, based on a secret known by the bank and stored in the token or a smart card inserted into the token.
    • ChipTAN
      is a TAN scheme used by many German banks. It uses a TAN generator which only works if the bank card for the account is inserted into it. The TAN generated is specific to the current transaction. There are two variants: In the older variant, the transaction details (at least amount and account number) must be entered manually. In the modern variant, the user enters the transaction online, then the TAN generator reads the transaction details via a flickering field on the computer screen (using a photodetector). It then shows the transaction details to the user for confirmation before generating a TAN.
  • Smart Card
    An example for a smart card you all know is the SIM card (subscriber identity module).

or this suggestion, using a complex password and a simple trick to not forget it

20140130-205135.jpg

If you are lucky and have just one bank account you just need one additional device to identify yourself or to verify a transaction. All these more sophisticated methods are not used by companies engaged in eCommerce. Instead, some companies still allow to buy with an eMail address and the password 1234.

Apple and passwords …

Ronald Carlson published interesting stats on tapscape.com (Jan 25, 2014) about how companies handle security:

Dashlane, a company that sells a password manager of the same name, has assessed the world’s top 100 websites for password security and published the results (pdf) for all to see. Unsurprisingly, Apple comes out on top with a perfect password security score of 100, while a long list of “trusted” companies, like Amazon, do less well:

The roundup assesses the password policies of the top 100 e-commerce sites in the US by examining 24 different password criteria that Dashlane has identified as important to online security, and awarding or docking points depending upon whether a site meets a criterion or not. Each criterion is given a +/- point value, leading to a possible total score between -100 and 100 for each site — Dashlane.

  • 55 % still accept notoriously weak passwords, such as “123456” or “password”
  • 51 % of websites, including Amazon, Dell and Best Buy, make no attempt to block entry after 10 incorrect password entries
  • 64 % have highly questionable password practices
  • 61 % do not provide any advice on how to create a strong password during signup and 93 percent do not provide an on-screen password strength assessment
  • 10 % scored above the threshold for good password policies (i.e. 45 points or more in the roundup)
  • 8 sites, including Toys “R” Us, J.Crew and 1-800-Flowers.com, send passwords in plain text via email

The research study puts Apple on #1 with a score of 100, Microsoft on #3 with 65, Nike on #10 with 45, Toys R Us got a score of -60, and MLB -75 which means that this e-commerce offer was the leader of the bottom 10.

Thanks to Ronald Carlson for sharing Web Password Security, Apple Protects Users Best, Amazon Less So on Google+.

Securing web-based services …

It’s indispensable to secure access to web-based services to increase reliance. This must be an integral part when building up customer relationships.

My article describes two ways to securely access accounts offered by Apple and Google. While Apple’s solution is limited to account access and purchases within Apple’s ecosystem Google’s solution supports 2-Step Verification for a whole range of services even from other vendors like Dropbox, Facebook, or WordPress.

Today companies make it easy to register for services.

Usually you need an E-Mail address (as a username) and a password. Instead of separating username, password, and email address for communication purposes nearly all companies reduce these three properties to just two which makes it easier to use their services but it goes along with less security.

To increase security the so-called 2-Step Verification was developed.
The basic idea is that apart from a password a second input is required to successfully access an account. Additionally access is limited to so-called trusted devices, devices you personally own and have access to.

2-Step Verification means “something you know” (like a password) and “something you have” (like a smartphone). Once you activated 2-Step Verification you have to use both, your password and an authorized device to sign in. To increase usability Apple as well as Google let you authorize a device to not asking for an authentication code again.

With 2-Step Verification security is drastically increased but not perfect at all. The only way to further increase the level is to use biometric identifiers (like a fingerprint) which are actually not supported for mobile devices. A standardized solution implemented in all operating systems would be a great step forward.

Many authentication processes could be made much more easier if “something you are” (fingerprint, iris) would replace “something you know” and it would increase security drastically if all these three methods are combined to identify yourself.

Biometric identifiers are the distinctive, measurable characteristics used to label and describe individuals. Biometric identifiers are often categorized as physiological versus behavioral characteristics. A physiological biometric would identify by iris scan, DNA or fingerprint. Behavioral biometrics are related to the behavior of a person, including but not limited to: typing rhythm, gait, and voice. Some researchers have coined the term behaviometrics to describe the latter class of biometrics.
More traditional means of access control include token-based identification systems, such as a driver’s license or passport, and knowledge-based identification systems, such as a password or personal identification number. Since biometric identifiers are unique to individuals, they are more reliable in verifying identity than token and knowledge-based methods; however, the collection of biometric identifiers raises privacy concerns about the ultimate use of this information.
(Wikipedia)

Apple did a first step with a fingerprint scanner implemented in it’s flagship iPhone 5S, released in October 2013.

Apple’s solution …

For a comprehensive description of the 2-Step Verification process visit:

Frequently asked questions about 2-Step Verification for Apple ID

or see this concept map which contains all information in a visualized layout.

20140507-082044.jpg

On your iOS device 2-Step Verification will look like this:

20140130-205257.jpg

Unsurprisingly Apple did not follow the open standard Google, Microsoft, and many others use. So this optional security feature is just made for Apple services and devices that means for Apple’s ecosystem. It requires you to verify your identity using one of your devices before you can:

  • Sign in to My Apple ID to manage your account
  • Make an iTunes, App Store, or iBookstore purchase from a new device
  • Get Apple ID-related support from Apple

The complete process …

I published a How To for the complete activation process on Snapguide com.

http://snapguide.com/guides/activate-and-use-apples-2-step-verification/

Note
You can view this public guide via Safari but I suggest to download the app Snapguide from Apple’s App Store (universal, free). The iPad version enjoys all the advantages of a perfect user experience.

Google’s solution …

Sorry. But as usual Google spreads information about the internet and it’s hard to find out a simple description which contains all the information a normal user needs to understand this additional layer of security. So here is a description I found on MacWorld for configuring 2-Step Authentication:

2-Step Verification by Google

My opinion: This is not the way to let users accept the efforts made by the company. It seems to be quite difficult to explain this approach to more security to a broad number of unexperienced users.

The flaws …

Apple …

  • 2-Step Verification is still not available in all countries.

Google …

  • After you turn on 2-Step Verification, non-browser applications and devices that use your Google account (such as the Gmail app on your phone), will be unable to connect to your account. Google solves this by generating application-specific passwords to allow these applications to connect to your account. Although this must be done only once for each device and application it’s an additional hassle to manage these settings.

Common flaws …

  • What will users do to keep usability on an acceptable level.
    They first declare their device as a trusted device. That means this device has direct access to all services because the apps generating security codes are fully accessible. Furthermore Google’s authentication provokes to grant access to all the installed applications by using application-specific passwords and setting the option “Remember Password”.
  • Security is still bound to the unlock code of your device.
    The progress coming up with 2-Step Verification is limited because it doesn’t secure your device but only reduces the chance to successfully hack an account.

Some FAQs …

01 What to do if the phone doesn’t have a carrier signal but is on WiFi?

Google
You can install a standalone app called Google Authenticator (it’s also available in the App Store), so your cell phone doesn’t need a signal.
Apple
You can use the app Find My iPhone to get a verification code.

02 What to do if the phone runs out of power, is broken, or is stolen?

Google
You can print out 10 one-time backup codes and put them in your wallet. Use those one-time codes to log in even without your phone.
Go to your 2-step verification settings page. Under the “Advanced” section, you’ll have the choice to remove a device. The device will automatically sign out of your account, and you’ll be prompted for a verification code next time you try to sign in from them.

Apple
While activating 2-Step Verification you will get a so-called Recovery Key which has to be printed out. This code can be used in the event that none of your trusted devices are available. You have to sign in to My Apple ID and remove the stolen or sold device from the trusted devices. Access from this device to your Apple ID (Settings – iTunes+App Stores – Apple ID) or purchases from Apple’s stores are no longer possible.

03 What to do if an authentication within an app like Apple Mail fails?

Google
For apps you can create so-called ‘application-specific passwords’ (ASPs) that your app can use instead of your regular password. You can revoke ASPs at any time.
Apple
Not applicable

The worst case …

If you lost two or more of the required sign-in items (your Apple ID password, access to one of your trusted devices, your Recovery Key) you cannot regain access to your Apple account. You will need to create a new Apple ID. You can do so on one of your devices or on the web at My Apple ID.

Costs …

If you use SMS as the transmission service for verification codes you will be charged by your provider. The sender of the SMS is located in UK (+44).

To clarify costs you should ask your provider. Best practice is to activate Find My iPhone. The app is ready for receiving verification codes. It’s obvious that this transmission only works if you are connected to the internet.

The main features …

These are the main features of Apple’s 2-Step Verification

  • 2-Step Verification is bound to your Apple ID.
  • You can use any device capable of receiving SMS.
  • If you loose two or more sign-in items you cannot regain access to your account.
  • If you sell your device or if it’s stolen immediately go to My Apple ID and remove this device from the list of trusted devices.

Summary …

Use 2-Step Verification to improve security and to avoid compromising your identity which can cause severe problems with law if it’s obvious that you did not follow well-known security advices.

The digital world offers great benefits but increased security always goes along with decreased usability. That’s the price we have to pay. Be sure it’s a good investment.

The solution of both companies, Apple and Google, do not meet the requirements of their users. You cannot keep a recovery key or up to 10 backup codes in mind but your biometric identifiers are always with you. So let’s wait for the next step of a more innovative technological progress where you have access to all your accounts just with ‘something you are’.

Related links …

Apple …

Security made by Apple

Emergency Guide

The Apple ID

Apple ID: Frequently asked questions about 2-step Verification for Apple ID

Apple ID: Can’t sign in with 2-Step Verification

Google …

Google: 2-Step Verification

Google: Install Google Authenticator

Google: Sign in using Backup Code

Overview …

Overview about 2-Step Verification of other companies

Thanks for dropping by.


Actions

Information

2 responses

7 05 2014
Luke

Great summary and article. I use Sticky Password for managing my passwords.

Like

7 05 2014
iNotes4You

Thanks for your appreciation.

Like




%d bloggers like this: