Written By: Security.org Team | Published: August 27, 2020

Protecting your online accounts with a password is enough security…right? Wrong. With more than 14 million Americans being victim to identity theft in 2019, often a result of hackers stealing your username and password, consumers are increasingly turning to two-factor authentication (2FA) or multi-factor authentication to prevent cybercrime.

What does this mean, and what are best practices? For starters, if you’ve ever used a fingerprint to open your phone or confirmed your identity by entering a code texted to you as part of logging into a site, you’ve engaged in a second form of authentication.We’ll go over all of that and more in this guide to authentication.

What Is Authentication?

Let’s get back to basics with a quick definition of authentication and what that actually looks like in the online world.

Definition

Authentication, simply put, is the validation of a user’s identity online, but it can look a few different ways depending on the account’s capabilities and the user’s preferences.

Types of Authentication

When it comes to authentication, it usually appears in one of the following buckets:

Password only

The most common method, most people secure accounts with usernames and passwords only. However, if someone gets your username and password, it’s important to make sure that they still can’t gain access by implementing some advanced authentication methods, namely two or multi-factor authentication.

Two-factor authentication (2FA)

Two-factor authentication typically comes in the form of a passcode sent to a mobile device, sometimes referred to as a one-time PIN.

Multi-factor authentication (MFA)

Multi-factor authentication takes things a step further and comes in many forms, such as biometrics like fingerprint or facial recognition1, security questions, the CVV on the user’s credit card or even physical devices like a USB token or card reader2. However, biometric authentication is definitely the most common type of MFA that you’ll see.

Multi-Factor Authentication Examples

Even though you may or may not have heard of authentication before reading this guide, it’s super common and available in various online accounts. Here are a few common examples:

Financial accounts

Given the sensitivity of the information stored, many bank and financial institutions require two-factor authentication in order to access users’ online accounts. This usually means receiving a text, e-mail or phone call confirming your identity after entering a password.

Face and Touch ID

Anyone with a recent iPhone or iPad will know Face ID or Touch ID, a form of multi-factor authentication.

Ring Doorbell Camera

After multiple hackings of Ring cameras’ live feeds, Ring added two-factor authentication to the Ring— Always Home app, requiring users to enter passcodes in addition to their usernames and passwords3.

If you’re not sure if an online account has advanced authentication options, go into settings and then look for a section on privacy; you will be able to enable it there, most likely.

Authentication Pros and Cons

Authentication protects users accounts from people that have their usernames and passwords, but each type of authentication has its unique benefits (and cons, for that matter).

Password only

The easiest and quickest way to access an account is from a regular password; just type it in and enter your account.
However, not all passwords are stored in an encrypted vault, which could raise a security risk4. In addition if a hacker gets a user’s password through a phishing attempt, they can access the account if there’s not any more authentication implemented.

Two-factor authentication

2FA blocks many types of cyber attacks, from phishing and spear phishing to brute force and dictionary attacks.
That being said, it makes logging in take a bit longer and it depends on a third party device5, so if that device malfunctions, you may have trouble accessing your own account. Plus, if your device is stolen, access might (literally) fall into the wrong hands.

Multi-factor authentication

The benefits of MFA are fairly obvious; with fingerprint or face ID, you never have to worry about not having a device, and they’re hard if not impossible to forge. They’re also quick; and, you don’t have to worry about remembering a password6.
On the other hand, biometrics can’t be changed if the device or account is compromised, and they tend to be available only on pricier devices like iPhones. Also, some people may object to having large tech companies store their fingerprints or retina scans, so for the privacy-minded, MFA may be somewhat of a nightmare.

Authentication Best Practices

While the majority of the best authentication practices lie with the developers themselves, there are a few ways that users like you can use it to your advantage:

  1. No plaintext: No matter how convenient it may be, never store your passwords in plain text or email or text them to somebody; instead, use an encrypted password manager to save and share your passwords.
  2. Password hygiene: Jumping off of that, make sure each online account has its own unique, complicated and long password7; no using your address for all of your accounts or god forbid, the word “password” itself!
  3. Check your privilege: And no, we’re not talking about social justice. When creating privileges for accounts or documents, use the least amount of privilege as you need, like being a contributor rather than an administrator. That way, if your account is hacked, the hacker won’t be able to do as much damage to your files.
  4. Default to deny: Lastly, set up your Google Drive or any shared cloud storage space to “default to deny”, meaning that you have to grant people access for them to view and change your files8. Think of it as “guilty until proven innocent” but for accessing things like documents and spreadsheets.

Authentication Statistics

Authentication may not be the latest dance craze, but it’s definitely popular and growing more so year after year.

Industry Usage

Let’s talk about the big picture. In 2019, the Advanced Authentication Market in the U.S was valued at $9.75 billion, and by 2025, that number is expected to balloon up to $20.73 billion9, an increase of over 112 percent. As of 2018, North America led the global multi-factor authentication market; authentication company Duolingo estimates that it will reach $20.41 billion by 2025, pretty close to previous estimates about the industry.

Why exactly is the authentication market growing as fast a weed in your garden? A few reasons, including:

  • Increased financial fraud
  • Cyberattacks
  • More usage of digital payment apps through smartphones and other wireless devices
  • More investments in cloud technologies.

Consumer Usage

That’s it for the authentication industry statistics, but what about consumers themselves? Through our research, we discovered some interesting statistics:

  • As of a 2017 survey, 28 percent of respondents used 2FA, 54 percent of whom began using it voluntarily as opposed to mandatorily from a job.
  • Two-thirds of people who had used security keys or push notifications found it quick and convenient.
  • Out of the 1.8 percent of the survey’s respondents who had used 2FA in the past and then stopped, seven out of the eight respondents said the driving factor was inconvenience.
  • Older people were less likely than younger people to use 2FA; students, employed people and men were the most likely groups to use 2FA.
  • 86 percent of the respondents used 2FA through email or SMS, 52 percent used it through an authenticator app and 39 percent used a phone call10.
  • In 2019, 57 percent of the employees at businesses worldwide used MFA; this number was up from 12 percent of all global employees in 2018.
  • 95 percent of the employees who used MFA used a software-based solution like an app, while four percent used a hardware-based solution and only one percent used biometrics.
  • Out of the businesses where employees used MFA, 33 percent worked in education, 32 percent worked in the banking/ finance industry, 31 percent worked in telecommunications and 27 percent each worked in tech/software or the government.
  • MFA is used more commonly at large businesses compared to small businesses.
  • The most popular MFA options among businesses were LastPass Authenticator at 39 percent, Duo Security at 31 percent and Google Authenticator at 24 percent11.
  • 59 percent of executives say that they plan to implement or expand MFA within three to six months, while another 26 said they plan to implement or expand it in the next year12.
  • According to the Pew Research Center, 52 percent of online adults have used 2FA on their accounts, which accounts for 59 percent of online adults ages 30 to 49, 53 percent of online adults ages 18 to 29, 49 percent of online adults ages 50 to 64 and 38 percent of online adults 65 and older.

While different studies and surveys have produced slightly different numbers as to the consumer usage of authentication, one thing that everyone can agree on: authentication isn’t going anywhere, and it’s getting more popular as time goes on.

Recap

Authentication is a quick and easy way that you can majorly up your account security, and considering that, according to our recent survey on identity theft, almost half of Americans have experienced credit card fraud, securing your accounts has never been so important. As a means of avoiding identity theft and preventing unauthorized access to your online accounts, authentication is the way of the future.

References

  1. https://www.okta.com/identity-101/authentication-vs-authorization/
  2. https://www.imperva.com/learn/application-security/2fa-two-factor-authentication/
  3. https://support.ring.com/hc/en-gb/articles/360024511592-Two-factor-security-authentication-with-Ring-products
  4. https://habiletechnologies.com/blog/pros-cons-using-authentication/
  5. https://www.imperva.com/learn/application-security/2fa-two-factor-authentication/
  6. https://www.nr.no/directdownload/4380/Abie_-_Different_Ways_to_Authenticate_Users_with_the_Pros.pdf
  7. https://cloud.google.com/blog/products/gcp/12-best-practices-for-user-account
  8. https://its.unl.edu/bestpractices/authentication
  9. https://www.mordorintelligence.com/industry-reports/advanced-authentication-market
  10. https://duo.com/assets/ebooks/state-of-the-auth.pdf
  11. https://lp-cdn.lastpass.com/lporcamedia/document-library/lastpass/pdf/en/LMI0828a-IAM-LastPass-State-of-the-Password-Report.pdf
  12. https://www.microsoft.com/security/blog/2020/03/05/it-executives-prioritize-multi-factor-authentication-2020/