How secure is two factor authentication (2FA)

The simplest answer would be: 2FA is more secure than one factor authentication. The objective is always how to make it harder for the attacker to impersonate someone. As technology evolves, threats are constantly increasing and security must find new and innovative ways to block these threats. One of the key factor in a successful security strategy is user’s adhering to the strategy. Mobile technologies can be the best ally to any identity protection security strategy.

The fundamentals behind identity security is the combination of different elements called factors to ensure the validity of an individual’s identity. These factors must be any of something you know (logical), something you are (bio-metrics) and something you have (physical device). So combining 2 out of 3 elements is considered minimal security in nowadays. To answer this question depends really on which of the 3 elements are combined.

Who you are in itself is considered to be the most secured. You can surely relate to these mission impossible movies where Tom Cruise disguises himself and has to modify his voice to match someone else’s and penetrate in highly secured places. Nothing is 100% but what are the probabilities that Tom will want to impersonate you? This is why we now refer to two factor as the combination of a simple element combined with something you have say a cell phone.

Can the cell phone be considered a secured enough element in the two factor authentication process? Well it really depends how its used. There are cases of hackers redirecting SMS messages from popular social network users and banks to capture the secret meant to protect the individual’s identity.

There are other instances where it has been shown that hackers could potentially exploit an inherent flaw in cell phone communications (SS7) and redirect phone calls. So the reality is since anything is possible, and say that you are being targeted, there are ways to circumvent the security mechanisms in place. For the common Joe and Jane, 2FA will be way better and more secure than simply using your username and a password you never change.