Two-factor authentication, or 2FA, is a security protocol that requires logging in with both a password and a second verification method to confirm your identity. The second factor usually involves something in your possession, like a smartphone or a physical key. When 2FA is enabled, you’ll need to enter your password as usual, then tap in an additional code or insert a security key — which makes it harder for someone else to pose as you online.
It’s no surprise that here at Allstate Identity Protection, we take password security pretty seriously. See our helpful guide chock-full of tips for creating strong passwords.
For important accounts, many security experts recommend enabling another layer of protection: two-factor authentication, also known as 2FA.
In this article, we’ll explain why two-factor authentication is an essential part of online security — and how it plays a role in protecting your identity.
What is two-factor authentication?
Two-factor authentication is a security protocol that involves logging in with both a password and a second verification method to confirm your identity.
When 2FA is enabled, you’ll enter your password as usual. Then you’ll be prompted for something else. Some systems require you to enter a unique code that is sent to your smartphone. Other methods involve tapping a piece of hardware against your device, pressing a button on a verification app, or using biometrics — like your fingerprint or a retina scan — to prove that you are the rightful owner of the account or device.
Since 2FA involves an extra step, it can make the login process slower. However, it’s often a worthwhile tradeoff for the peace of mind that two-factor authentication offers.
How does two-factor authentication protect me?
Say you have 2FA enabled and a cybercriminal gets ahold of a password of yours. Unless the thief also hijacks your smartphone or somehow nabs your security key, your account will probably stay protected.
You should be pinged about any login attempts, which puts you one step ahead of a would-be hacker.
How to set up two-factor authentication
There are many types of two-factor authentication. Here are the basics on how to enable some of the most common forms.
Text messages
Two-factor authentication can happen via text message, which is also known as SMS 2FA.
Once SMS 2FA is enabled for an account, you’ll still input your username and password to log in. Next, the system will send a text message to your phone with a one-time security code.
You’ll enter that code and continue with the login process. By doing this, you confirm that you have your phone in your possession and that you received the text message that was sent to you — and that’s considered the second step in the authentication process.
It’s important to note that SMS 2FA can be less secure than other two-factor authentication methods because in some cases, text messages can be intercepted. For example, hackers may look for vulnerabilities in cell networks. Or, a fraudster may perform a SIM swap attack, which could allow them to redirect your text messages to their phone.
Still, enabling SMS 2FA is usually quick and easy, and it’s more secure than using a password alone.
Security keys
For a two-factor authentication method that's not linked to your phone or computer, consider a 2FA security key. To start, users must purchase a physical key that often looks like a flash drive, such as a YubiKey or Google’s Titan Security Key.
There are various ways to authenticate with a security key. You insert the key into a USB port or simply tap the key against your device to complete the login process.
With this method, the physical security key acts as the second step to authentication. You must be able to provide a username and password, and must also have possession of the security key to access your account.
Before you buy any hardware, it’s a good idea to look into the services that work with the security key and make sure that your most-visited sites and apps are covered.
Authenticator app
Another approach is to install a third-party authenticator app on your smartphone or device. Then, you can add the authenticator app as your 2FA security method on an application and web-based service that you frequently use.
Many of the big service providers — including Google, Facebook, Instagram, and major banks — offer this capability. Once you download an authenticator app, the instructions for how to set it up for each account can usually be found under the ‘Settings’ tab on their individual sites.
Once setup is complete, users enter their password and then either press a button in the app or enter a one-time security code generated by the app to log in.
As we mentioned, text messages can be intercepted — so an authenticator app, such as Google Authenticator, is generally considered to be a more secure bet.
Biometrics
Have you ever used a facial recognition scan to unlock your phone, or scanned your fingerprint to access an account or system? If so, you’ve used biometric authentication — a security system that uses unique biological characteristics to verify your identity.
When biometric two-factor authentication is enabled, you may be prompted to use a fingerprint, voice, or retina scanner, or even signature recognition software to confirm your identity.
For service providers that offer this method of 2FA, setup instructions can usually be found under the 'Settings' section of the site or app.
How secure is two-factor authentication?
While 2FA offers enhanced security, it’s not totally foolproof.
Criminals are always looking for new ways to access personal information and accounts. There’s always a possibility that a hacker could find a way to access your SMS code or physical key, or even use a phishing attack to trick you into sharing 2FA credentials.
Even so, enabling 2FA is more secure than just using a password — which should give you additional peace of mind.
Is two-factor authentication enough?
What’s the difference between two-factor and multi-factor authentication (MFA)?
Two-factor authentication is a type of multi-factor authentication that requires two pieces of evidence to confirm your identity. But multi-factor authentication can involve even more — like, say, a password, a one-time security code, and a security question.
For even more protection, consider using an authentication system with more factors. But know that no security method can guarantee against fraud and identity theft.
If you’re an Allstate Identity Protection member, you can rest assured that our identity specialists are available 24/7 should your identity become compromised.
You can think of us as an additional layer of protection — and the more layers, the better.