All about two-factor
authentication (2FA)

Two-factor authentication (2FA) is a method of confirming users’ claimed identities by using a combination of two different pieces of information or factors

What is two-factor authentication?

Two-factor authentication (also known as 2FA or two-step verification) is a method to confirm a user’s claimed online identity by using a combination of two different types of factors. A password is typically considered one factor, and with 2FA that is combined with another factor to increase login security. Factors used for 2FA include:

teal password illustration

Something you know

Password or PIN

teal mobile phone illustration

Something you have

A physical device such as a phone or authenticator.

teal fingerprint illustration

Something you are

A fingerprint, iris or facial scan

teal pin and credit card illustration

An example of two-factor authentication

A good example of two-factor authentication is the withdrawing of money from an ATM; only the correct combination of a bank card (something that the user possesses) and a PIN (something that the user knows) allows the transaction to be carried out.

The problem with passwords

teal password and monitor illustation
Passwords are easily breached

The typical validation method most individuals and business users use today is a single factor password. But usernames and passwords are stored on a server and can be easily breached as cyber criminals become more organized and adept.

multiple password illustration

Too many passwords

With increasing use of email, social media, and online banking and shopping, most people have a lot of places they need to log in. In fact, most consumers have 150 online accounts and therefore many usernames and passwords to remember! As a result, online users resort to creating several complex passwords – or worse; they use the same password across multiple sites.

computer environment and password illustration
Passwords are used repeatedly

With many users re-using passwords across sites, once a cybercriminal gets their hands on a user’s credentials, those credentials may work across multiple accounts. Two-factor authentication is the best defense users have to protect accounts when their passwords have been stolen.

reported in 2017
from weak/stolen passwords
of a breach ($148/ record)

Two-factor authentication has become the standard

Most service providers such as Google, Facebook and Apple already support 2FA and consider it an integral part of the authentication process.

Types of two-factor authentication

teal security key illustration
Hardware Security Keys

Hardware Security Keys

Security

Hardware security keys offer the highest levels of online security, logging into many services with just one key.

Ease of Use

Hardware security keys can offer passwordless login, with no code to enter. Hardware keys typically require no network connectivity, and does not rely on battery power.

Cost

Hardware security keys are significantly cheaper than a mobile phone, and in the case of a lost or stolen key, a backup is much cheaper than replacing a mobile phone.

teal mobile phone and text illustration
Text Message (SMS 2FA)

Text Message (SMS 2FA)

Security

Not very secure as this approach is vulnerable to phone number porting scams. Also, per NIST Cybersecurity Framework guidelines, the SMS 2FA approach offers a poor security level.

Ease of Use

Requires users to retype of copy and paste the one time code which can be confusing or time consuming. This approach typically relies on users having a mobile phone. In order to receive the code the devices needs to have network connectivity and sufficient battery life.

Cost

Using a mobile phone as the authenticating device can be very expensive. And, in the case of a lost or stolen device, replacing the phone can be very costly again.

mobile authenticator app illutstration
Authenticator Apps

Authenticator Apps

Security

More secure than text messages but not as secure as hardware security keys based on public key cryptography.

Ease of Use

Requires users to retype or copy and paste the one time code, which can be a confusing and time consuming.

Cost

Authenticator apps are often free to download, however it relies on users having a mobile phone. While codes can be available even when the phone is offline, it is reliant on the mobile phone battery life. In the case of a lost or stolen device, replacing the phone can be very costly.

mobile pin illustration
Mobile Push 2FA

Mobile Push 2FA

Security

More secure than text messages but not as secure as hardware security keys based on public key cryptography.

Ease of Use

This approach typically relies on users having a mobile phone. In order to receive the code the devices needs to have network connectivity and sufficient battery life.

Cost

Using a mobile phone as the authenticating device can be very expensive. And, in the case of a lost or stolen device, replacing the phone can be very costly again.

YubiKey 5 Series family shot
Find the right Yubikey

Take the quick Product Finder Quiz to find the right key for you or your business.

YubiKey standing on rock
Get protected today

Browse our online store today and buy the right YubiKey for you.