b'SMART OPERATIONSHow to Protect Yourself UsingTwo-FactorAuthenticationcation code that is sent by SMS (shortmessageservice),aninstalledapp,email, or voice. The code, which expiresPeterafter a short period of time (usually 30to 90 seconds), must then be enteredPelland into the original application or websiteon what might very well be a second de-vice. This means that if somebody, forexample, stole your laptop computer,Many of us tend to resist anything that then also somehow stole the login IDwe think will make our daily routines and password for your online banking,more complicated. That is why there are they would also need to have stolenstill people reading this who use the same your phone and knew the password orpasswordcamping 123!, or something other means of unlocking that phonesimilarlyunsecureonjustabout before they could even think of transfer-everything. I have already written exten- ring funds out of your account.sively on the importance of using secure In my instance, in order to access mypasswords and a unique password for online banking, a thief or hacker wouldevery application or website, so I will try first have to know the unique usernamenot to beat a dead horse on that topic. formyaccount(whichaccordingtoWhat I want to address in this column DashlanesHowSecureIsMyPass-is why you should embrace two-factor word? website would, in itself, take 100authentication (2FA) over single-factor years to crack), then know the passwordauthentication (SFA) whenever possible. which would take 100 million years toOnline, SFA simply requires a password crack. Alternately, they could try to hackto gain access to a site or service. Two- into my LastPass password safe, with afactorauthentication,ontheother master password that I can easily re-hand, requires an added step. It may at member but that would otherwise takefirst sound like a new concept, but it has at least a billion years to crack (but whichbeen a part of our lives in one form or I still change on a regular basis), and thenanother for decades.run into a firewall when their IP addressFor example, when you use an ATM was not recognized and whitelisted. or your debit card, in addition to having In all honesty, about the only waydirect access to the card, you will need that a hacker could access my passwordto enter a personal identification num- safe would be to come into my officeber (PIN). When you pass through TSA and kill me while I was at my computerat the airport, you need to show not only with LastPass open. The only other wayyour boarding pass but another form of to access my bank account would be ifpositivephotoidentification.Andto my bank itself had been hacked (whichdrive away in a car, the door must be un- is why you want to proactively changelocked, but you will also need either the your passwords on a regular basis) or ifkey or key fob that matches that vehicle. I had carelessly used my debit card at aTwo-factor authentication is not that gasoline pump or ATM kiosk that had anew a concept after all, is it? card skimmer installed, fell victim to aIn todays modern applications, there phishing scam, or allowed malware toare several forms of two-factor authen- be installed on my computer or net-tication: work. These latter scenarios are just as Something you knowa pass- unlikely as the hacker coming into myword, the last four digits of your social office and killing me.security number, or the answer to a se- Is two-factor authentication incon-cretquestion.(Letmecautionyou venient? Absolutely, but it is far more in-against ever providing your social secu- convenient to have your funds or evenrity number to anybody other than the your personal identity stolen.Social Security Administration, the In- Manyonlineservicesnoweitherternal Revenue Service or your state tax offer the option or require the use ofauthority and possibly your bank. Let me 2FA. These include Amazon, Facebook,also caution you against ever playing Twitter, Dropbox, PayPal, Apple andoneofthosecommonsocialmedia Microsoft. Most have 2FA turned off bygames or quizzes where you might be in- default but provide instructions (usuallyadvertentlydisclosingtheanswerto easy to find under security settings) forwhat might also be a secret question.) enabling. If given the option, use it. If Something in your possessionan giventhechoicebetweenSMSoraRFID card, key fob, or your phone. smartphone app, an app is more secure. Something that is part of youbio- Yes, there is the added time required tometric factors such as fingerprint au- install the app, but once again we arethentication, voice recognition, facial talkingaboutminorinconveniences.recognition, or retinal scanning. The smartphone app is then typically Your locationwhich may be based paired to other devices through suchupon your IP address or GPS location. means as scanning a QR code that isTo be effective, 2FA should rely on a displayed on the first device.combination of two (or more) of these Is TFA totally secure from hackers? Ofauthentication factors. For example, be- course not. For this reason, three-factorcause a password and an answer to a se- authenticationiscommonlyusedincret question are both knowledge-based highly secure environments. Look at itbits of information, their combination this way, two generations ago, we com-results in a rather weak form of 2FA that monlydrovecarswithoutseatbelts.mostsecurityexpertswouldsimply When seatbelts were first introduced,consider SFA. theywereonlylapbelts,withoutaMostcommonlyusedtoday,2FA shoulder component. Today, most of ustakes the form of a one-time authenti- Smart Operationscontinued on page 4410 -October 2019Woodalls Campground Management'