What is Two Step Verification and How Does It Impact Passwords?

Question. I’m very excited to have received your Password Book, and I’ve read it thoroughly. I’m retired, and not that bad with computers.  I called my bank to ask about two step verification or what you also call two factor authentication. It took a while, but they said that they have both a phone / app variant and they can also send me a token? What’s the difference and should I use these for my bank passwords?

Answer. Yes! Although it’s not perfect two-step verification or as it is also called, two factor authentication, is very important and valuable. I always recommend that you enable for all “first tier” accounts, which would mean a) your email account (e.g., Gmail, Microsoft Live Mail, Yahoo, etc.), your phone (e.g., T-Mobile, Android, Verizon, iPhone, etc.), and all bank / financial accounts. It works like this:

Step #1 you enter your user name and password (e.g., at your bank website)

Step #2 your bank texts you a code (or if they have sent you a token or enabled an app on your phone, you get this code via that mechanism).

You then reenter this code into your bank website. It’s called “Two step” because there are TWO STEPS! (Aren’t computer people brilliant)? You can also usually enable it to “remember a device” so that, for example, you don’t have to constantly get the text at your home computer. That said, for your bank account it is a good idea to ALWAYS require the two steps because if your computer is hacked and they can remotely log into your computer then the two-step verification process doesn’t work. Another security flaw is if scammers can seize control of your phone (e.g., by calling into Verizon, AT&T or T-Mobile and getting the dummies who work over there to “port” your phone number to a new device). So that’s why I recommend at your phone company you ALSO enable a “secret password” that’s required on call-in. A chain is only as strong as its weakest link.

In summary, definitely enable two-factor identification where you can. Just remember it’s not perfect, and you want to make sure that no thief gets a hold of the verification code.