rantings & ravings (october 2022)

When you attempt to access a secured system, whether that be a digital system, like a computer, or a physical system, like a facility, you need to provide a factor.  A factor can be thought of as a password, like for a computer, or a keycard, like for a facility.  However, passwords can be surreptitiously obtained or even stolen, and keys can be lost or stolen as well.  To combat against this, an additional factor can be combined with the first.  This is known as MFA, more specifically, 2FA.  MFA is multi-factor authentication and 2FA is two-factor authentication.  In the same way that all squares are rectangles, but not all rectangles are squares, 2FA is MFA, but not all MFA is 2FA.  While one term is a subset of the other, many people use these terms interchangeably.

Typically, a factor is going to be at least one of three categories, knowledge, possession, or inherence.  Or more simply, something you know, something you have, or something you are, respectively.  Knowledge could be considered something like a password or a PIN.  Possession could be considered something like a YubiKey, a HID Prox Smart Card badge, a code from an RSA SecurID fob (a type of hard token), or a code from Google Authenticator (a type of soft token).  Inherence could be considered something like your fingerprint or your face.  Most commonly, you'll find MFA to use knowledge with either possession or inherence.  For example, ideally, to access work resources on a computer from your home, you might provide two factors, often your password (knowledge) and a code from a hard or soft token (possession).

MFA provides additional security while also providing some peace of mind.  For example, if you've enabled it, should you accidentally be tricked into providing a bad actor your Google username and password, that bad actor cannot log into your account without also having authentication from Google Authenticator.  Since Google Authenticator is tied to your phone, the bad actor would also need to have access to your phone.  Another example could be if you misplaced your hard token outside work.  If required, anyone else who happens to find it can't simply login at a terminal as you, they would also need to know your password.  These are both examples of 2FA, since they're using only two factors.

You likely already use MFA outside of work if you bank online or are involved in cryptocurrency.  MFA is often a requirement to use these things.  MFA may also be optional elsewhere like for Amazon or Twitter.  It's a best practice to enable, wherever you can, at least SMS (text) based MFA, especially for e-mail accounts that are contact points for other services.  E-mail accounts are targeted by bad actors as access lets them see what services you use and can likely allow them to reset your access for those services.  This can lead to things like reputational damage and/or loss of financial assets.  If you can, use U2F, universal second factor.  U2F can let you provide a second factor for MFA where, in certain instances, you literally touch a USB device plugged into a computer.  For example, a YubiKey can be used for U2F.

Services that support MFA will have guides to help you setup MFA for that service.  Depending on how the service implements MFA, you may be able to use the same soft token app you use for work for these services or vice versa.