The Ultimate Guide to Setting Up Your Smart Home - WIRED
We put together this smart-home guide to highlight your options, explain the jargon, and help you understand the consequences of the choices you make.
called two-factor authentication
Try to use devices that support multi-factor authentication (commonly <anchor>called two-factor authentication</anchor>) to reduce the risk of someone gaining access with stolen credentials. It'll require you to confirm your account with a text message or email (the latter is more secure). Some devices allow for biometric login using a fingerprint or facial scan on your phone, which is secure and convenient. These features are not always on by default, so take the time to set them up.
How to Secure Your Accounts With Better Two-Factor Authentication | WIRED
Open Navigation Menu
Menu

Story Saved

Close Alert

How to Secure Your Accounts With Better Two-Factor Authentication

More Chevron

Jul 22, 2018 7:00 AM

# How to Secure Your Accounts With Better Two-Factor Authentication

Two-factor authentication is a must, but don't settle for the SMS version. Use a more secure authenticator app instead.

Play/Pause Button
Pause

Casey Chin

Save this storySave

Save this storySave

If you buy something using links in our stories, we may earn a commission. This helps support our journalism. Learn more. Please also consider subscribing to WIRED

Hopefully by now you’ve heeded the repeated warnings from your friends and loved ones (and friendly, beloved internet writers) to use two-factor authentication to secure your digital accounts. That’s where access to Facebook or Twitter or your online bank—anything that supports it, really—requires not just a password but also a special code. Not all two-factor is created equal, however. For better protection, you’re going to want an authenticator app.

Yes, the easiest way to implement two-factor is with SMS, receiving a text with an access code every time you try to log into a secured account. While certainly better than nothing, getting your 2FA from SMS has plenty of potential downside. Specifically, it leaves you exposed if someone hijacks your smartphone’s SIM, a longtime problem that has only gotten worse of late. By stealing your phone number, hackers can redirect any two-factor notifications to their own devices, allowing them much easier entry to your accounts.

“Unfortunately, it isn’t that hard for thieves to impersonate you to your mobile phone carrier and hijack your mobile phone number—either with a phone call to customer support or walking into a phone store,” says Lorrie Cranor, a computer scientist at Carnegie Mellon University and former FTC technologist who had her own SIM stolen in 2016. Authenticator apps are not vulnerable to this problem, and thus are a more secure way to do two-factor verification.

Instagram, in particular, has seen a surge of troubling SIM attacks, largely because it only supports text-based two-factor for now. The company confirmed that it’s working on the obvious solution: Letting you use an authenticator app instead.

“Authenticator apps are not vulnerable to this problem” of SIM hijacking, says Cranor. “They’re a more secure way to do two-factor verification.”

The good news? Most of the sensitive accounts you use today already offer stronger 2FA. And there’s no shortage of third-party authenticator apps that’ll enable it for you. Here’s how to get set up, and make your sign-ins that much more stress-free.

The Basics

The most popular authenticator apps are Google Authenticator and Authy, but password managers 1Password and LastPass offer the service as well, if that helps you streamline. If you're heavy into Microsoft's ecosystem, you might want Microsoft Authenticator. While they all differ somewhat in features, the core functionality is the same no matter which one you use.

Rather than send you an SMS, each of these apps shows you a randomly generated six-digit code that refreshes roughly every 30 seconds, and stays constantly synced with whichever service you’re trying to log into. The benefits of tying those codes to a physical device, rather than your phone number, extend beyond security; apps like Google Authenticator generally continue to work even without an internet or cell connection. If 2FA has ever locked you out of Facebook on a flight, here’s some relief.

Lorrie Cranor, CMU

Most services you would want to secure offer this type of token-based 2FA; Instagram is more of the exception than the rule at this point. You can see a comprehensive list for yourself here. As for which app to use, Google Authenticator offers a barebones experience backed by a company with a sterling security record, while Authy offers more features, like being able to pull codes from not just your smartphone but your desktop or tablet. It also lets you back up your codes to the cloud, enabling a seamless migration when you inevitably upgrade your smartphone. With Google Authenticator, when you switch your main device, you have to sync your accounts over again.

For that reason, we’ll use Authy for a quick walkthrough of how to actually use a more secure 2FA app. The steps are basically the same on Google Authenticator, but it covers a little more ground.

Lock It Down

Step one: Download the app. See? This is easy. No sweat.

Once you open Authy, it’ll ask for your phone number, and then send you a registration code via either phone call, SMS, or another device. From there, it’s a blank slate until you start pairing it with the accounts you want to secure.

Most Popular

- Gear

By Carlton Reid

- Gear

By Boone Ashworth

- Security

By Kate O'Flaherty

- Gear

By Christopher Null

Here comes the drudgery. You’ll need to go to every single account you want to pair your authenticator app with; there’s no omnibus route, and no automated way to transition from SMS to Authy or Authenticator. The silver lining: While you have to repeat the set-up process many, many times across all corners of the internet, it’s quick and relatively painless.

Let’s use Dropbox as an example. Once you’re signed in on the web on your desktop, click the ID icon in the upper right corner. From there, go to Settings, then Security. Toggle on Two-step verification, then head to Edit, under Preferred Method. Click Use a mobile app, and you’ll see a QR code. Tap Add Account on Authy, point your smartphone at the screen, and congrats! Your Dropbox account is locked down tight.

Now onto the rest: Twitter, Facebook, Gmail, Evernote, and on and on. Each uses slightly different wording for its menus, but go to the settings and click on words like "privacy" and "security" until you find the available two-factor options.

If you're using Google Authenticator, that's basically all you need to know. And to be absolutely clear, that no-frills approach works great for most people. If you want more features, though, you can take some extra steps with Authy.

For instance! Go to Settings and tap Accounts, then toggle on Authenticator Backups if you want to create encrypted backups in the cloud. The extra cautious may prefer to keep their codes on a single device, but the cloud backup makes it possible to use Authy on more than just your smartphone—there's even a Chrome extension—and also makes switching to a phone much more seamless.

Speaking of which, to add more devices to your Authy account, go to Settings, then Devices, and tap Allow Multi-device. From there, you can authenticate whatever else you need. Authy also lets you protect the app with a 4-digit PIN, to keep people from accessing your tokens even if they steal your device.

One more miscellaneous tip: The services that offer two-factor will also generally offer one-time use backup codes. Print these out, especially if you're traveling, and keep them in a safe place. If for whatever reason you can't access your app or an SMS, it's your last, best bet to keep from getting locked out of your account.

The 2FA Spectrum

Using an authenticator app for two-factor beats SMS, but it's still not the absolute most secure way to go. To lock even your online accounts down even further, consider stepping up to a YubiKey, which adds a hardware layer of protection. (You can get a free YubiKey 4 with a new WIRED subscription.) If you're an activist, journalist, or other potential target of attacks, Google Advanced Protection is the most secure option around.

As with so many things, it's a matter of balancing security and convenience. But for most people, the few minutes it takes to set up an authenticator app are more than worth the benefit over sticking with SMS—especially once Instagram and other stragglers get around to offering it.

More Great WIRED Stories



Brian Barrett is the executive editor of news at WIRED, overseeing day to day coverage across the site. Prior to WIRED he was the editor in chief of the tech and culture site Gizmodo and was a business reporter for the Yomiuri Shimbun, Japan’s largest daily newspaper.

Executive Editor, News

Read More

xAI's generative AI tool, Grok AI, is unhinged compared to its competitors. It's also scooping up a ton of data people post on X. Here's how to keep your posts out of Grok—and why you should.

Kate O'Flaherty

Plus: Kaspersky’s US business sold, Nigerian sextortion scammers jailed, and Europe’s controversial encryption plans return.

Matt Burgess

APT42, which is believed to work for Iran’s Revolutionary Guard Corps, targeted about a dozen people associated with both Trump’s and Biden’s campaigns this spring, according to Google’s Threat Analysis Group.

Andy Greenberg

Social Security numbers, physical addresses, and more—all available online. After months of confusion, leaked information from a background-check firm underscores the long-term risks of data breaches.

Lily Hay Newman

The AI ethics nonprofit Humane Intelligence and the US National Institute of Standards and Technology are launching a series of contests to get more people probing for problems in generative AI systems.

Lily Hay Newman

Suspected Russian hackers have compromised a series of websites to utilize sophisticated spyware exploits that are eerily similar to those created by NSO Group and Intellexa.

Lily Hay Newman

Plus: China-linked hackers infiltrate US internet providers, authorities crack down on a major piracy operation, and a ransomware gang claims attacks during the Paris Olympics.

Lily Hay Newman

The Navy is testing out the Elon Musk–owned satellite constellation to provide high-speed internet access to sailors at sea. It’s part of a bigger project that’s about more than just getting online.

Jared Keller

WIRED is where tomorrow is realized. It is the essential source of information and ideas that make sense of a world in constant transformation. The WIRED conversation illuminates how technology is changing every aspect of our lives—from culture to business, science to design. The breakthroughs and innovations that we uncover lead to new ways of thinking, new connections, and new industries.

More From WIRED

Reviews and Guides

© 2024 Condé Nast. All rights reserved. WIRED may earn a portion of sales from products that are purchased through our site as part of our Affiliate Partnerships with retailers. The material on this site may not be reproduced, distributed, transmitted, cached or otherwise used, except with the prior written permission of Condé Nast. Ad Choices

###### Select international site

United StatesLargeChevron