Two-factor Authentication (abbreviated as 2fa) is a means of establishing access to online or network services that require the user to provide two different types of information.
Traditionally usernames and passwords have been used when connecting or authenticating to a service. Over the years, malicious users and groups have deployed various means in an attempt to trick or otherwise persuade users to enter their username and password in forms, websites, and emails. Once the bad actors have this information, they can then carry out questionable actions on behalf of that individual.
For example, phishing is a means by which an email is sent to users that often imply that an immediate response is needed. This sense of urgency causes many people to act out of fear that they may lose access to a service. Likewise, job announcements and other "opportunities" are also used in phishing attempts that again compromise a user's account.
2F Authentication (also referred to as Multi-Factor or MFA) adds another layer of security. In addition to a username and password (something you know), a second verification is needed (something you have).
2F solutions can include:
- SMS Text Message - A code is sent to a user's cell phone each time the requested site or service is accessed.
- Push Notification – Normally done thru an app installed on a smartphone or other mobile device, a notification would require the user to accept to complete the login process.
- Hardware Token – A device (usually USB) that connects to a computer and requires a push-button acceptance during the login process.
By employing 2F Authentication, accounts are protected from passwords that have been compromised as malicious actors would not have access to the smartphone or hardware token.