Dual Authentication: A Necessary Extra Layer of Security

Okta's cloud-based authentication gives users high-assurance with simple-to-use factors like biometrics and push notifications.

Okta

Updated: 06/15/2022 - 1:22

Time to read: 9 minutes

Dual authentication, also called two-factor authentication or 2FA, can improve online security by requiring more than just a password to gain access.

Cybersecurity is increasingly important as more of our lives move to the digital world. Sensitive data and information can easily fall prey to malicious cybercriminals and bad actors.

Dual authentication requires the use of an additional authentication method with your login credentials, usually a biometric factor or security token. This extra layer of security can make it harder for unauthorized users to access your accounts and information.

Two-factor authentication better controls access to sensitive systems and confidential data.

What is dual authentication?

In short, dual authentication uses two forms of authentication methods to verify identity. In addition to 2FA and two-factor authentication, it’s also sometimes referenced as two-step verification and dual factor authentication.

This is a step up from single-factor authentication (SFA), which allows access to a system or account with just a login and password. Login credentials can be breached, hacked, or stolen. As a result, multi-factor authentication (MFA) methods that require more than one form of authorization are more secure.

Dual authentication requires the use of two of the three recognized factors for identification verification:

Something you know, usually a password or PIN
Something you have, like a cell phone, credit card, or hardware token
Something you are, such as a biometric marker like a fingerprint or facial scan

Dual authentication methods use two of these authentication factors to access a system or service.

How dual authentication works

To use dual authentication, a user must provide two authorization factors, and each one must be from a different category.

For instance, a password and answer to a secret question are both considered knowledge-based authentication factors and therefore do not count as two-factor authentication methods. Instead, you will need to provide a password and then a second factor, like a fingerprint, to gain access and verify your identity.

Each vendor or application can have a different method for enabling two-factor authentication, but the general multistep process looks like this:

Application or website prompts a user to input login credentials.
The user enters knowledge-based information, which is typically a username and password.
If a password is not required, the website is often using a unique security key that is validated and authenticated by the website’s server.
The website or application will then request the second form of authentication through a second login step.
The user will provide something that they have or possess, which can include a facial recognition scan, fingerprint scan, ID card, security token, or smartphone.
A user may be prompted to enter a one-time code that is generated during the previous step to their specified device.
Both authentication factors are verified, and access is granted.

A user will need to be able to provide both forms of authentication to access the service or product, so even if one of these is compromised, access remains secure.

The issue with passwords

Passwords are the least secure form of security that there are for a variety of reasons. With more advanced cybercriminals and evolving hacking methods, there is an inherent need for more secure systems and accounts.

One of the most common forms of cybercrime in 2020, according to the FBI, was phishing attacks. A phishing scam gets access to a user’s login credentials, including passwords, and therefore gains access to privileged data and information.

Passwords are weak form of user authentication for the following reasons:

Human nature: It has been proven that simple and easy-to-remember passwords are also easy to guess and therefore steal, but human users continue to stick to things they can remember. Passwords are commonly too simple or are placed in easy-to-find locations — easy for the user but also easy for potential unauthorized users.
Broad usage: Often in an attempt to make things easier, a user will use the same password or password combination across a variety of platforms and accounts. This makes it easy for hackers to gain access to much of a user’s digital footprint with the theft of a single password.
Not changed often enough: For added security, passwords should be changed regularly to keep them from being breached or hacked. Most of the time, users will not take this step, however.
Password fatigue: Users often start out with good intentions using passwords that are secure and changed often, but it can be difficult to keep up with so many changing passwords. A user will often revert back to a weak password instead.
Insecure storage: Passwords can be stored in digital or physical locations that are not secure. Therefore, even if the password is strong, it is also vulnerable to theft.

The FTC (Federal Trade Commission) received well over 2 million reports of fraud in 2020 with losses closing on $3.5 billion.

Human error is one of the most common causes of internet fraud and cybercrime, giving criminals access to sensitive and confidential information. Passwords are one of the easiest things for a bad actor to steal, mimic, guess, or breach. Because of this, they should not be used as the primary, or sole, method of protecting data on the internet.

Types of dual authentication products

There are two main categories of dual-factor authentication products: tokens that users receive upon logging in, and software or infrastructure that recognizes and authenticates users based on the correct usage of the token.

There are many different types of services and devices that can implement two-factor authentication. An authentication token can be embedded into software or applications, or it can be a physical piece of small hardware.

These are some common examples of dual authentication products:

Hardware tokens: An actual piece of hardware, this is generally a key fob, ID card, or a small USB device. The dual authentication process will either read the code directly off the device, or a user inputs the unique code from the token.
Software tokens: This uses a software-generated time-based, one-time password (TOTP), and it is often called a soft token. With software tokens, users typically must first download and install an app required for this form of authentication. After the initial login, a code is generated and shown on the app on the same device, thus enhancing security.
SMS-based: With this form of 2FA, after the user inputs a username and password, the application or website will send a one-time passcode (OTP) to the user’s phone through a text message. The user is then prompted to enter the code in order to gain access. Voice-based 2FA uses similar technology, but it sends a verbal code instead of a text message.
Push notifications: A more advanced form of dual authentication has websites and applications sending direct push notifications to users who are attempting access. Upon receipt, the owner of the device can approve or deny the access with a simple touch instead of needing to input an entire code back into the system.

This is only applicable to devices that are internet-connected and able to download applications. They are user-friendly and highly secure.

Biometrics: The use of biological and personal information, such as fingerprints, retinal scans, and facial recognition, can serve as a form of two-factor authentication. A user will scan their fingerprint on a built-in fingerprint scanner or use the device’s camera for authorization.

Who uses dual authentication?

Many websites and applications, as well as companies and organizations, rely on two-factor authentication to keep systems and services more secure.

Often, a user will need to activate or set up 2FA to use it. Most online service providers, many websites, and applications all have the option for dual authentication.

These are examples of major companies using two-factor authentication:

Companies and organizations often require two-factor authentication to access secure platforms and databases. They may require the use of a hardware token or biometrics in addition to login credentials.

Online platforms, including applications and websites, often implement dual authentication factors for added security as well.

Dual authentication & mobile platforms

The world is moving more and more digital every day. As a result, much of the authentication verification process is performed on mobile platforms.

Dual authentication often uses a smartphone, for example, which often contains biometric capabilities, for two-factor authentication. A smartphone can commonly read fingerprints, take pictures, and scan your face for facial recognition.

Phones can send and receive text messages, and they can be used for SMS-based dual authentication as well as voice-based authentication factors. Smartphones often track GPS location, which can be used to verify a user and implement 2FA based on user information. Mobile devices can also send and receive push notifications that a user can receive on the go.

Authentication in the future

As cybersecurity becomes even more important and relevant, methods of authentication and identity verification are even more vital.

The use of passwords are some of the most common authentication factors still today, again, they are the least secure. Companies and services are moving toward at least two-factor authentication models. Many are at least starting to consider multi-factor authentication (MFA), which can require all three authentication types.

This can mean that in addition to a password and username, a user will also be prompted to use a physical token AND a biometric marker. Biometric authentication is expanding to include the use of biometric identifiers as well, which can read typing speed and the way a user manipulates the device, touchscreen, or mouse, including keystroke length and website surfing patterns.

Humans are inherently creatures of habit, and biometric identifiers can help to determine if a user is who they say they are. Factors including the type of device, time of day services are accessed, and geolocation can also be used as authentication factors.

Organizations are also exploring passwordless authentication capabilities that can help to maintain IT security while eliminating the need for users to input an insecure password. Blockchain, zero trust security principles, decentralized identity, and self-sovereign identity are all options to be considered that do not require passwords yet maintain control of the login process within an organization.

Additional resources

On a mobile platform, dual authentication often requires the use of an authenticator application. These apps are free and downloaded to an internet-connected device.

When prompted to enter a soft token, the authenticator application generates the code or push notification. Examples include the following:

Dual factor authentication provides extra security and a higher level of trust in confidentiality and privacy. While using at least two forms of authentication involves an extra step, processes are evolving to even smoother and more user-friendly experiences through mobile platforms.