The Easy Way to Secure Your Smartwatch Payments with Multi Factor Authentication and Prevent Unauthorized Transactions

By Isabella Storyclaire

last updated September 17, 2024

Contributions sourced from

Guide to Authentication: Protecting Yourself From Identity Theft with Two-Factor or Multi-Factor Authentication

Protecting your online accounts with a password is enough securityright? Wrong. Millions of Americans fall victim to identity theft each year, often a result of hackers stealing username and password. Thats why consumers are increasingly turning to two-factor authentication (2FA) or multi-factor authentication to prevent cybercrime.

What does this mean, and what are best practices? For starters, if youve ever used a fingerprint to open your phone or confirmed your identity by entering a code texted to you as part of logging into a site, youve engaged in a second form of authentication. Well go over all of that and more in this guide to authentication.

What Is Authentication?

Lets get back to basics with a quick definition of authentication and what that actually looks like in the online world.

Definition

Authentication, simply put, is the validation of a users identity online, but it can look a few different ways depending on the accounts capabilities and the users preferences.

Types of Authentication

When it comes to authentication, it usually appears in one of the following buckets:

Password only

The most common method, most people secure accounts with usernames and passwords only. However, if someone gets your username and password, its important to make sure that they still cant gain access by implementing some advanced authentication methods, namely two or multi-factor authentication.

Two-factor authentication (2FA)

Two-factor authentication typically comes in the form of a passcode sent to a mobile device, phone number, or email, sometimes referred to as a one-time PIN (OTP).

Multi-factor authentication (MFA)

Multi-factor authentication takes things a step further and comes in many forms, such as biometrics like fingerprint or facial recognition¹, security questions, the CVV on the users credit card, or even physical devices like a USB token or card reader². However, biometric authentication is definitely the most common type of MFA that youll see.

Multi-Factor Authentication Examples

Even though you may or may not have heard of authentication before reading this guide, its super common and available in various online accounts. Here are a few common examples:

Financial accounts

Given the sensitivity of the information stored, many bank and financial institutions require two-factor authentication in order to access users online accounts. This usually means receiving a text, e-mail, or phone call confirming your identity after entering a password.

Face and Touch ID

Anyone with a recent iPhone or iPad will know Face ID or Touch ID, a form of multi-factor authentication.

Ring Doorbell Camera

After multiple hackings of Ring cameras live feeds, Ring added two-factor authentication to the Ring Always Home app, requiring users to enter passcodes in addition to their usernames and passwords³. Many security camera brands have followed suit, but a large chunk of brands still rely on passwords only for securing live feeds and recordings.

If youre not sure if an online account has advanced authentication options, go into settings and then look for a section on privacy; you will be able to enable it there, most likely.

Authentication Pros and Cons

Authentication protects users accounts from people that have their usernames and passwords, but each type of authentication has its unique benefits (and cons, for that matter).

Password only

The easiest and quickest way to access an account is from a regular password; just type it in and enter your account.

However, not all passwords are stored in an encrypted vault, which could raise a security risk

⁴

. In addition, if

a hacker

gets a users password through a

phishing

attempt, they can access the account if theres not any more authentication implemented.

Two-factor authentication

2FA blocks many types of cyberattacks, from phishing and spear phishing to brute force and dictionary attacks.

That being said, it makes logging in take a bit longer and it depends on a third-party device

⁵

, so if that device malfunctions, you may have trouble accessing your own account. Plus, if your device is stolen, access might (literally) fall into the wrong hands.

Multi-factor authentication

The benefits of MFA are fairly obvious; with fingerprint or face ID, you never have to worry about not having a device, and theyre hard if not impossible to forge. Theyre also quick; and, you dont have to worry about remembering a password

⁶

On the other hand, biometrics cant be changed if the device or account is compromised, and they tend to be available only on pricier devices like iPhones. Also, some people may object to having large tech companies store their fingerprints or retina scans, so for the privacy-minded, MFA may be somewhat of a nightmare. Reliability is another concern; biometric scans are fairly new technology to consumer products, so its not uncommon for some devices to mis-authenticate a log-in attempt.

Authentication Best Practices

While the majority of the best authentication practices lie with the developers themselves, there are a few ways that users like you can use it to your advantage:

No plaintext: No matter how convenient it may be, never store your passwords in plain text or email or text them to somebody; instead, use an encrypted password manager to save and share your passwords.
Password hygiene: Jumping off of that, make sure each online account has its own unique, complicated, and long password⁷; no using your address for all of your accounts or god forbid, the word password itself!
Check your privilege: And no, were not talking about social justice. When creating privileges for accounts or documents, use the least amount of privilege as you need, like being a contributor rather than an administrator. That way, if your account is hacked, the hacker wont be able to do as much damage to your files.
Default to deny: Lastly, set up your Google Drive or any shared cloud storage space to default to deny, meaning that you have to grant people access for them to view and change your files⁸. Think of it as guilty until proven innocent but for accessing things like documents and spreadsheets.

Authentication Statistics

Authentication may not be the latest dance craze, but its definitely popular and growing more so year after year.

Industry Usage

Lets talk about the big picture. As per our last checking, the Advanced Authentication Market in the U.S. was valued at $9.75 billion; in six years, that number is expected to balloon up to $20.73 billion. North America has led the global multi-factor authentication market since at least 2018.

Why exactly is the authentication market growing as fast as weeds in your garden? A few reasons, including:

Increased financial fraud
Cyberattacks
More usage of digital payment apps through smartphones and other wireless devices
More investments in cloud technologies.

Consumer Usage

Thats it for the authentication industry statistics, but what about consumers themselves? Through our research, we discovered some interesting statistics:

28 percent of respondents have used 2FA, 54 percent of whom began using it voluntarily as opposed to mandatorily from a job.
Two-thirds of people who had used security keys or push notifications found it quick and convenient.
Out of the 1.8 percent of the surveys respondents who had used 2FA in the past and then stopped, seven out of the eight respondents said the driving factor was inconvenience.
Older people were less likely than younger people to use 2FA; students, employed people, and men were the most likely groups to use 2FA.
86 percent of the respondents used 2FA through email or SMS, 52 percent used it through an authenticator app and 39 percent used a phone call¹⁰.
The use of MFA by employees in businesses worldwide skyrocketed in 2019 to 57 percent; nearly 400 percent higher than the year prior. Use of MFA in businesses has grown steadily since then.
95 percent of the employees who used MFA used a software-based solution like an app, while four percent used a hardware-based solution and only one percent used biometrics.
Out of the businesses where employees used MFA, 33 percent worked in education, 32 percent worked in the banking/ finance industry, 31 percent worked in telecommunications and 27 percent each worked in tech/software or the government.
MFA is used more commonly at large businesses compared to small businesses.
The most popular MFA options among businesses were LastPass Authenticator at 39 percent, Duo Security at 31 percent, and Google Authenticator at 24 percent¹¹.
59 percent of executives say that they plan to implement or expand MFA within three to six months, while another 26 said they plan to implement or expand it in the next year¹².
According to the Pew Research Center, 52 percent of online adults have used 2FA on their accounts, which accounts for 59 percent of online adults ages 30 to 49, 53 percent of online adults ages 18 to 29, 49 percent of online adults ages 50 to 64 and 38 percent of online adults 65 and older.

While different studies and surveys have produced slightly different numbers as to the consumer usage of authentication, one thing that everyone can agree on: authentication isnt going anywhere, and its getting more popular as time goes on.

Recap

Authentication is a quick and easy way that you can majorly up your account security, and considering that, according to our recent survey on identity theft, almost half of Americans have experienced credit card fraud, securing your accounts has never been so important. As a means of avoiding identity theft and preventing unauthorized access to your online accounts, authentication is the way of the future.

References

https://www.okta.com/identity-101/authentication-vs-authorization/
https://www.imperva.com/learn/application-security/2fa-two-factor-authentication/
https://support.ring.com/hc/en-gb/articles/360024511592-Two-factor-security-authentication-with-Ring-products
https://habiletechnologies.com/blog/pros-cons-using-authentication/
https://www.imperva.com/learn/application-security/2fa-two-factor-authentication/
https://www.coursehero.com/file/66097704/Abie-Different-Ways-to-Authenticate-Users-with-the-Prospdf/
https://cloud.google.com/blog/products/gcp/12-best-practices-for-user-account
https://its.unl.edu/bestpractices/authentication
https://www.mordorintelligence.com/industry-reports/advanced-authentication-market
https://duo.com/assets/ebooks/state-of-the-auth.pdf
https://lp-cdn.lastpass.com/lporcamedia/document-library/lastpass/pdf/en/LMI0828a-IAM-LastPass-State-of-the-Password-Report.pdf
https://www.microsoft.com/security/blog/2020/03/05/it-executives-prioritize-multi-factor-authentication-2020/

How to secure your authentication mechanisms

In this section, we'll talk about how you can prevent some of the vulnerabilities we've discussed from occurring in your authentication mechanisms.

Authentication is a complex topic and, as we have demonstrated, it is unfortunately all too easy for weaknesses and flaws to creep in. Outlining every possible measure you can take to protect your own websites is clearly not possible. However, there are several general principles that you should always follow.

Take care with user credentials

Even the most robust authentication mechanisms are ineffective if you unwittingly disclose a valid set of login credentials to an attacker. It should go without saying that you should never send any login data over unencrypted connections. Although you may have implemented HTTPS for your login requests, make sure that you enforce this by redirecting any attempted HTTP requests to HTTPS as well.

You should also audit your website to make sure that no username or email addresses are disclosed either through publicly accessible profiles or reflected in HTTP responses, for example.

Don't count on users for security

Strict authentication measures often require some additional effort from your users. Human nature makes it all but inevitable that some users will find ways to save themselves this effort. Therefore, you need to enforce secure behavior wherever possible.

The most obvious example is to implement an effective password policy. Some of the more traditional policies fall down because people crowbar their own predictable passwords into the policy. Instead, it can be more effective to implement a simple password checker of some kind, which allows users to experiment with passwords and provides feedback about their strength in real time. A popular example is the JavaScript library zxcvbn, which was developed by Dropbox. By only allowing passwords which are rated highly by the password checker, you can enforce the use of secure passwords more effectively than you can with traditional policies.

Prevent username enumeration

It is considerably easier for an attacker to break your authentication mechanisms if you reveal that a user exists on the system. There are even certain situations where, due to the nature of the website, the knowledge that a particular person has an account is sensitive information in itself.

Regardless of whether an attempted username is valid, it is important to use identical, generic error messages, and make sure they really are identical. You should always return the same HTTP status code with each login request and, finally, make the response times in different scenarios as indistinguishable as possible.

Implement robust brute-force protection

Given how simple constructing a brute-force attack can be, it is vital to ensure that you take steps to prevent, or at least disrupt, any attempts to brute-force logins.

One of the more effective methods is to implement strict, IP-based user rate limiting. This should involve measures to prevent attackers from manipulating their apparent IP address. Ideally, you should require the user to complete a CAPTCHA test with every login attempt after a certain limit is reached.

Keep in mind that this is not guaranteed to completely eliminate the threat of brute-forcing. However, making the process as tedious and manual as possible increases the likelihood that any would-be attacker gives up and goes in search of a softer target instead.

Triple-check your verification logic

As demonstrated by our labs, it is easy for simple logic flaws to creep into code which, in the case of authentication, have the potential to completely compromise your website and users. Auditing any verification or validation logic thoroughly to eliminate flaws is absolutely key to robust authentication. A check that can be bypassed is, ultimately, not much better than no check at all.

Don't forget supplementary functionality

Be sure not to just focus on the central login pages and overlook additional functionality related to authentication. This is particularly important in cases where the attacker is free to register their own account and explore this functionality. Remember that a password reset or change is just as valid an attack surface as the main login mechanism and, consequently, must be equally as robust.

Implement proper multi-factor authentication

While multi-factor authentication may not be practical for every website, when done properly it is much more secure than password-based login alone. Remember that verifying multiple instances of the same factor is not true multi-factor authentication. Sending verification codes via email is essentially just a more long-winded form of single-factor authentication.

SMS-based 2FA is technically verifying two factors (something you know and something you have). However, the potential for abuse through SIM swapping, for example, means that this system can be unreliable.

Ideally, 2FA should be implemented using a dedicated device or app that generates the verification code directly. As they are purpose-built to provide security, these are typically more secure.

Finally, just as with the main authentication logic, make sure that the logic in your 2FA checks is sound so that it cannot be easily bypassed.