How to Secure Your Accounts With Better Two-Factor Authentication

Hopefully by now you’ve heeded the repeated warnings from your friends and loved ones (and friendly, beloved internet writers) to use two-factor authentication to secure your digital accounts. That’s where access to Facebook or Twitter or your online bank—anything that supports it, really—requires not just a password but also a special code. Not all two-factor is created equal, however. For better protection, you’re going to want an authenticator app.

Yes, the easiest way to implement two-factor is with SMS, receiving a text with an access code every time you try to log into a secured account. While certainly better than nothing, getting your 2FA from SMS has plenty of potential downside. Specifically, it leaves you exposed if someone hijacks your smartphone’s SIM, a longtime problem that has only gotten worse of late. By stealing your phone number, hackers can redirect any two-factor notifications to their own devices, allowing them much easier entry to your accounts.

“Unfortunately, it isn’t that hard for thieves to impersonate you to your mobile phone carrier and hijack your mobile phone number—either with a phone call to customer support or walking into a phone store,” says Lorrie Cranor, a computer scientist at Carnegie Mellon University and former FTC technologist who had her own SIM stolen in 2016. Authenticator apps are not vulnerable to this problem, and thus are a more secure way to do two-factor verification.

Instagram, in particular, has seen a surge of troubling SIM attacks, largely because it only supports text-based two-factor for now. The company confirmed that it’s working on the obvious solution: Letting you use an authenticator app instead.

“Authenticator apps are not vulnerable to this problem” of SIM hijacking, says Cranor. “They’re a more secure way to do two-factor verification.”

The good news? Most of the sensitive accounts you use today already offer stronger 2FA. And there’s no shortage of third-party authenticator apps that’ll enable it for you. Here’s how to get set up, and make your sign-ins that much more stress-free.

The Basics

The most popular authenticator apps are Google Authenticator and Authy, but password managers 1Password and LastPass offer the service as well, if that helps you streamline. If you"re heavy into Microsoft"s ecosystem, you might want Microsoft Authenticator. While they all differ somewhat in features, the core functionality is the same no matter which one you use.

Rather than send you an SMS, each of these apps shows you a randomly generated six-digit code that refreshes roughly every 30 seconds, and stays constantly synced with whichever service you’re trying to log into. The benefits of tying those codes to a physical device, rather than your phone number, extend beyond security; apps like Google Authenticator generally continue to work even without an internet or cell connection. If 2FA has ever locked you out of Facebook on a flight, here’s some relief.

Most services you would want to secure offer this type of token-based 2FA; Instagram is more of the exception than the rule at this point. You can see a comprehensive list for yourself here. As for which app to use, Google Authenticator offers a barebones experience backed by a company with a sterling security record, while Authy offers more features, like being able to pull codes from not just your smartphone but your desktop or tablet. It also lets you back up your codes to the cloud, enabling a seamless migration when you inevitably upgrade your smartphone. With Google Authenticator, when you switch your main device, you have to sync your accounts over again.

For that reason, we’ll use Authy for a quick walkthrough of how to actually use a more secure 2FA app. The steps are basically the same on Google Authenticator, but it covers a little more ground.

Lock It Down

Step one: Download the app. See? This is easy. No sweat.

Once you open Authy, it’ll ask for your phone number, and then send you a registration code via either phone call, SMS, or another device. From there, it’s a blank slate until you start pairing it with the accounts you want to secure.

Here comes the drudgery. You’ll need to go to every single account you want to pair your authenticator app with; there’s no omnibus route, and no automated way to transition from SMS to Authy or Authenticator. The silver lining: While you have to repeat the set-up process many, many times across all corners of the internet, it’s quick and relatively painless.

Let’s use Dropbox as an example. Once you’re signed in on the web on your desktop, click the ID icon in the upper right corner. From there, go to Settings, then Security. Toggle on Two-step verification, then head to Edit, under Preferred Method. Click Use a mobile app, and you’ll see a QR code. Tap Add Account on Authy, point your smartphone at the screen, and congrats! Your Dropbox account is locked down tight.

Now onto the rest: Twitter, Facebook, Gmail, Evernote, and on and on. Each uses slightly different wording for its menus, but go to the settings and click on words like "privacy" and "security" until you find the available two-factor options.

If you"re using Google Authenticator, that"s basically all you need to know. And to be absolutely clear, that no-frills approach works great for most people. If you want more features, though, you can take some extra steps with Authy.

For instance! Go to Settings and tap Accounts, then toggle on Authenticator Backups if you want to create encrypted backups in the cloud. The extra cautious may prefer to keep their codes on a single device, but the cloud backup makes it possible to use Authy on more than just your smartphone—there"s even a Chrome extension—and also makes switching to a phone much more seamless.

Speaking of which, to add more devices to your Authy account, go to Settings, then Devices, and tap Allow Multi-device. From there, you can authenticate whatever else you need. Authy also lets you protect the app with a 4-digit PIN, to keep people from accessing your tokens even if they steal your device.

One more miscellaneous tip: The services that offer two-factor will also generally offer one-time use backup codes. Print these out, especially if you"re traveling, and keep them in a safe place. If for whatever reason you can"t access your app or an SMS, it"s your last, best bet to keep from getting locked out of your account.

The 2FA Spectrum

Using an authenticator app for two-factor beats SMS, but it"s still not the absolute most secure way to go. To lock even your online accounts down even further, consider stepping up to a YubiKey, which adds a hardware layer of protection. (You can get a free YubiKey 4 with a new WIRED subscription.) If you"re an activist, journalist, or other potential target of attacks, Google Advanced Protection is the most secure option around.

As with so many things, it"s a matter of balancing security and convenience. But for most people, the few minutes it takes to set up an authenticator app are more than worth the benefit over sticking with SMS—especially once Instagram and other stragglers get around to offering it.

---

More Great WIRED Stories

Tech

South Korea regulator flags better deal for cryptocurrency industry

SEOUL (Reuters) - A better deal for South Korea’s cryptocurrency industry might be in the offing as the market regulator changes tack from its tough stance on the virtual coin trade, promising instead to help promote blockchain technology.

The regulator said on Tuesday that it hopes to see South Korea - which has become a hub for cryptocurrency trade - normalize the virtual coin business in a self-regulatory environment.

“The whole world is now framing the outline (for cryptocurrency) and therefore (the government) should rather work more on normalization than increasing regulation,” said Choe Heung-sik, chief of South Korea’s Finance Supervisory Service (FSS), told reporters.

The latest news suggests authorities might adopt a lighter regulatory touch, a step change from the justice minister’s warnings in January that the government was considering shutting down local cryptocurrency exchanges, throwing the market into turmoil.

FSS has been leading the government’s regulation of cryptocurrency trading as part of a task force.

Cryptocurrency operators see Choe’s comments as positive step for the industry’s plans for self-regulation.

“Though the government and the industry have not yet reached a full agreement, the fact that the regulator himself made clear the government’s stance on co-operation is a positive sign for the markets,” said Kim Haw-joon of the Korea Blockchain Association.

South Korea banned the use of anonymous bank accounts for virtual coin trading as of January 30 to stop cryptocurrencies being used in money laundering and other crimes.

Three local banks including Shinhan Bank, Industrial Bank of Korea, NH Bank, are currently offering cryptocurrency accounts to around five local virtual coin exchanges.

Choe said that Kookmin Bank and KEB Hana Bank may have also put in place an appropriate system, though they haven’t as yet started handling transactions.

“I hope they (the banks) no longer fear authorities once they have the right system,” Choe added.

An official from FSS told Reuters tough regulatory oversight of illegal trade in cryptocurrencies will remain in place.

Bitcoin BTC=BTSP, the world"s most heavily traded cryptocurrency, is now changing hands at a three-week high of $ 11,160 on the Luxembourg-based Biststamp exchange after falling as low as $ 5,920.72 in early February.

South Korean electronics giant Samsung has already started production of cryptocurrency mining technologies, local media reported in January.

Reporting by Dahee Kim; Editing by Eric Meijer & Shri Navaratnam

Our Standards:The Thomson Reuters Trust Principles.

Tech

iPhone Battery Scandal: Apple Had Way Better Options Than Slowing Down Your Phone

On Wednesday, Apple confirmed what many customers have long suspected: The company has been slowing the performance of older iPhones. Apple says it started the practice a year ago, to compensate for battery degradation, rather than push people to upgrade their smartphones faster. But even giving that benefit of the doubt, there are plenty of better ways Apple could have accomplished the same goal without betraying customer trust.

Earlier this week, John Poole, a developer at Geekbench, published a blog post indicating that a change in iOS is slowing down performance on older devices. According to Apple, factors like low charge, cold climates, and natural battery degradation can all affect the performance of its mobile devices, and the company confirmed that this policy was implemented last year to counteract these effects.

As much sense as that explanation may make, Apple could have made plenty of choices that would have benefited consumers instead of penalizing them. These same choices could have also saved the company from the public shaming it suffered this week.

Fresh Juice

In a statement to WIRED, Apple confirmed Poole"s findings, saying it was purposely slowing down older iPhones to compensate for the effects of age on their batteries. "Lithium-ion batteries become less capable of supplying peak current demands when in cold conditions, have a low battery charge or as they age over time, which can result in the device unexpectedly shutting down to protect its electronic components," the company says.

While many have speculated that the company has been doing this for years, Apple says the feature was implemented last year for the iPhone 6, iPhone 6 Plus, and iPhone SE. Now, with iOS 11.2, the iPhone 7 and 7 Plus are getting the same treatment, and the company intends to bring other devices into the fold down the road.

Rather than secretly hamstring the iPhone"s CPU, though, Apple could have simply educated users about the limitations of lithium-ion batteries, says Kyle Wiens, CEO of iFixit, a company that sells repair kits and posts repair guides for consumer electronics. While Apple does say in the iPhone user manual that batteries degrade over time and should be replaced, you"d have to dig through a few links outside of the manual to learn that by 500 charge cycles, your phone"s battery will hold a charge of about 80 percent.

Another tactic Apple could employ is selling battery replacement kits to consumers, letting them pop a fresh battery into their aging iPhone. It would be an easily understandable solution to an easily understandable problem, rather than software manipulation that feeds into a long-running, planned obsolescence conspiracy theory. But Apple has actively fought against laws that would require it to provide a way for users to repair their devices. According to a report from HuffPost, Apple argues that allowing consumers to replace the battery could make the iPhone more vulnerable to hacks, and that letting people peek inside would make the iPhone easier to counterfeit.

"Apple won"t sell batteries to consumers, people should be furious about that," Wiens says. "Your battery is a maintenance item, and everyone should expect to replace their battery fairly frequently."

Apple does cover one battery replacement under its one-year warranty program, but only for "defective batteries," a term that isn"t clearly defined on the company"s site. If your phone is out of warranty and you don"t have an AppleCare+ plan, the company offers a battery replacement for $ 79 plus a $ 6.95 shipping charge. The problem, Wiens says, is that Apple doesn"t advertise this policy to consumers, leaving iPhone users to believe that the only solution is to buy a costly iPhone.

Choices Choices

Direct battery fixes certainly would have made the most sense. But even allowing that a software tweak was the only way Apple could have proceeded—untrue, but just for argument"s sake—it had a much better option than making its software solution covert.

Rather than quietly push out an update that crimped older iPhones, it should have made that throttling opt-in. As it stands, there"s no way to avoid having your phone slowed down once the battery reaches its limits. By giving users the choice, and giving them the information necessary to make their own decision, Apple could avoid the frustrations many have expressed over the policy.

While making the throttling opt-in could cause performance issues for users who opt-out, it would give users a sense of control over the situation and avoid making them feel like they"re being tricked into buying a new phone. As it stands, Apple"s move comes off as deceptive.

Instead of leaving users confused about why their phones are suddenly slowing to a crawl, Apple could take user education a step further by providing a battery health monitor in the Settings app. That way, an iPhone owner could figure out if the battery is the issue, or if something else is going on.

Lay Down the Law

The damage, unfortunately, is already done. But it"s also unlikely that Apple will behave differently going forward. At the very least, the company almost certainly won"t shift gears and start selling battery replacement kits to consumers. For starters, the iPhone"s casing uses proprietary Pentalobe screws, which make it hard for average users to get inside to swap the battery.

Apple has also lobbied against right-to-repair legislation, which would allow third-party repair shops and typical consumers to more easily fix their broken phones. Proposed right-to-repair laws typically require companies to publish their repair manuals, as well as make the necessary repair tools available for purchase rather than requiring a specialist to make these repairs.

Wiens says that, ideally, right-to-repair legislation would pass and ensure consumers have the ability to fix their devices on their own terms without having to deal with warranties or acquire difficult-to-find tools.

Apple"s throttling is misleading, and it"s far from the best way the company could have handled the situation. Still, lithium-ion batteries are riddled with problems users should be aware of. The company isn"t likely to change its stance on the matter, but if you"ve noticed your iPhone getting slower over the last year, at least you know it wasn"t all in your head—and that a battery fix might bring your iPhone back up to speed.

Tech