2FA: Two Factor Authentication - Computerphile

[@Pyrazahn]

2 factor authentification: combine a thing you can forget with a thing you can lose.

[@conceitedxo]

@MadYellowAsian especially when you really try not to lose something you lose it

[@boruut2909]

I hope no one has put dementia on my schedule.

[@AlexTechie]

@MadYellowAsian What if I forget not to lose it?

[@brianwilliams8455]

You have nothing worthy enough of value to have this mindset

[@TrickyBoa]

Boruut this comment is under appreciated lol

[@PElder78]

There are actually 5 factors you can choose from: Something you know (password) Something you have (phone, token, whatever) Something you are (fingerprint, iris, etc) Somewhere you are (geolocation, proximity detection) Somewhen you are (only on specific days/times) The last two are rarely used, but ARE valid factors (a common thing for somewhere is being able to unlock your phone without a password as long as you're on your home wifi or within X distance of GPS coordinates).

[@PElder78]

Alexander McColl its more applicable to banking than you think. "When can the vault be opened?" "Only during business hours" (no rogue employees coming back after hours and openings the vault) "At least 30 minutes after the request" (fouling a bank robbery as if they are still there 30 mins later, they are caught)

[@zockertwins]

So if my car opens when I get close to it, this is authorisation by localization ?

[@jordanwaeles]

no, it's something you have (the wireless keyfob transmitter). Also a flawed pattern for cars, since it only uses something you have, and also allows for amplification attacks (bring an amplifier between your bedroom window and your car while you're sleeping with your keyfob => open and start the car)

[@zockertwins]

Isn't it both then ? You have to have the key and be in range of the signal.

[@darnell8897]

Methinks, the some*where* of your home wifi is essentially the some*thing* you have of the router itself.

[@YingwuUsagiri]

Mike Pound and Brailsford are two of the people I can listen to ad infinitum. I'd love people like them as teachers. Actually, that's exactly what they are doing right now.

[@Cr42yguy]

Niels Schellekens i was kind of sad when the video was over after about 13 minutes :(

[@barendts]

yeah, if he tells you it's unsafe, would you still use it?

[@Noodl]

I'm taking Mike's module in Computer Security next year :^) He's a lecturer at my uni

[@YingwuUsagiri]

That´s so cool! Do you ever talk about his videos in Uni? Would be an amazing tie in to learn more of the details!

[@Noodl]

Yeah definitely! Graham Hutton teaches a Haskell module, and a few times he suggested we check out his video on the Lambda calculus and other concepts. Steve Bagley and Max Wilson also reference their videos occasionally. There's some real interesting stuff on this channel.

[@DKRCecer]

"correcthorsebatterystaple" you say?

[@NyanSten]

The safest password there is

[@Diggnuts]

Indeed... I use it all the time!! ... Ummm. Whoops.

[@smartyguyyful]

Diggnuts not so safe any more!

[@jeffirwin7862]

Fash Pone you're safe, all I see is ********

[@OvertakeGT]

HuNT3r2 is uuncrackable!

[@cowboyfrankspersonalvideos8869]

Back in the mid 1980's when the company my partner worked for got computers in each office, someone in top management insisted they require all employees to use complex passwords, no real words were allowed and they had to be changed every week. Of course no one could remember these crazy passwords so management recommended they write them down on sticky notes and stick them on their monitors. That lasted about 3 months before some top secret government documents were stolen by someone on the cleaning crew.

[@thenaughtyapartment2619]

That's quite a story!

[@flowtoolz5554]

classic. when you compromise usability, you lose usability and security.

[@jeremia9077]

If you're using Unix time, Timezones shouldn't factor in, as Unix time *should* be the same no matter where you are; The "time" where you are is then calculated after that.

[@yvrelna]

Jeremia Dominguez Time zone could still be a problem though. If someone misconfigured their machine to use a different timezone than what it really should be, but set their real time clock so that they're seeing a "correct" time, then the machine will think that it's in a different Unix time than the actual Unix time. A common misconfiguratio for example would be someone who adjust for daylight savings by moving the real time clock rather than by choosing the correct timezones for their area. Or a technically challenged user who fixes their computer's clock by moving the real time clock when moving to a different country.

[@zenorbi]

I always think of timezones as a date format parameter, unless of course I need the calculate the beginning of the day, 8 am specifically, or something like that.

[@jackt6112]

I would think if the device is using NTP or cellular network time to remain synched, rather than manually putting in the time, they cannot miss.

[@TheAkashicTraveller]

@@jackt6112 You can also get an, actualy extremely acurate, time from GPS since it actualy calculates your position and time based on the position and clock of the satelites.

[@abstractapproach634]

@@birsp So is that in the kernel (not hardware right) it must use it's own best clock (its crystal reference clock) and it's best measure of how fast its clock is. Still, without a regular internet connection it would get off after a while. *I'm glad you brought this up, interesting stuff* So does the crystal go even when the machine is off? Or is there some other unit by which it counts, probably less precisely l, when it's off. Hmmmmmmmmm, I'm sure it depends on the hardware (I doubt RPI will keep time without a connection but I will test this. Forgetting myvwifi signal now, I let you guys know if I have the right time tomorrow.

[@ToastiLP]

I always found 2FA to be quite convinient, since it takes only bout 10 seconds to get my phone, open the app and type it in and I rarely have to do it. All the while it removes a huge security risk. Anyway that's what I thought until I lost my phone's data and had to reset everything.

[@Slada1]

red toasti Just store 2FA keys on paper. Even with them, no one can access your account without your password.

[@longingheart77]

I love you guys! I can work under my british accent watching your videos and also get some knowledge about my passion wich is computer programming. Keep up your fabulous work !

[@alexmiszkiel5791]

I'm glad Mike sorted the ghost cube on the shelf! He's a great lecture as one of my highest grades was in his security lecture :D

[@aarcaneorg]

In one of the episodes, Data impersonates Picard's voice to commandeer the enterprise.

[@grn1]

Don't remember that episode.

[@Yakobo15]

@@grn1 Data's creator is dying and sends a signal telling him to come see him basically, but it turns data into "cannot be stopped" mode and locks everyone out of the ship in like a minute.

[@grn1]

@@Yakobo15 That sounds vaguely familiar now. Guess I'll have to go back and rewatch TNG sometime.

[@Ganorthic]

for some reason i watch exclusively the videos where DR Mike is talking

[@KaeVF]

I love that the password was "correct horse battery staple".

[@evenprime1658]

meh boy mike has the most loveable facial expressions and way of speaking.. like idk its just soo nice to just watch

[@stxllr4687]

Thanks dude, this was very helpful, you're carrying my CS exam right now. :)

[@AnimilesYT]

The video is 12:34 long. Well done :D

[@joshs2475]

The perfect example of a bad password. lol!

[@code-dredd]

It marks 12:33, but close enough?

[@user-iu1xg6jv6e]

That time when it accepted "12345678" but entering "mypenis" failed saying "too short"!

[@EgoShredder]

"password" ? Oh no you have just revealed your main err password as used by thousands! ;-)

[@Swipe650]

Pound that thumbs up button for Dr Mike

[@jeffirwin7862]

No wonder he's a hash expert

[@michael-gary-scott]

+Jeff Irwin AMAZING! 10/10 punnage!

[@kestrelwings]

There is a problem with one version of 2 factor. A number of people have run into an issue where a hacker gets control of their phone number and then goes to various websites and clicks "reset password." Not only is the hacker in, but the original user is frozen out. Sometimes the hacker calls up the phone company, claims to work in a store and they are selling a new phone to a customer. If the operator is stupid, she may transfer the phone number to the hacker's phone.

[@gusutabopb]

"I mean you smash your phone the last thing you're thinking about is 'ah, I must save my Google authenticator passwords!'" (4:40) Really? That's the single thing I am the most scarred about losing my phone. Everything else is backed up to the cloud, so if I lose my phone the only real loss would be the physical device (which can be replaced with a a few hundred dollars) and the damn 2FA passwords (which I have over 20 of), which can be a REAL PAIN to recover. Theses days, I just keep a safe hard copy of the QR codes and instead of Google Authenticator, use Authy (which has some backup/recovery functionality).

[@glazare364]

I learned so many things that my university didn't really teach me in this channel Thank you guys

[@sillylittleboy93]

"put it aside for today" Man a biosecurity video would be so cool!

[@Deimos94]

Is it really 2FA iftheyI can say “I forgot my password” and now my phone is enouth to get anyone into my E-Mail account and therefore all other accounts?

[@MitsumaYT]

"Forgot my password" usually doesn't remove 2FA, you can not just get into anything by only having the 2FA key. There is always a weak point but 2FA is meant to give security by separation. An attacker would have to compromise two systems or get your phone otherwise which very much increases the security. Obviously there are ways to remove your 2FA key in many places but those usually require more extensive verification of the user or at the very least verification via email which should also have its own 2FA ideally. 2FA main benefit is also that even if some website leaks your password due to an attack on that site your stuff is still secure.

[@johanandersson8464]

That would just be a second single factor authentication method.

[@DrRChandra]

Timezones _shouldn't_ figure into it, because Unix time is always UTC. Any local time is derived from that according to those really complex rules Tom Scott explained. It may be a bit of a challenge on systems which do not keep their time in relation to that Unix time, but a lot of the popular OSes (e.g., Linux) do.

[@NigelThorne]

How does FIDO2 work? The flow of data is one way, so it's not a challenge/response mechanism. How does the server know the generated code is valid?

[@shanbatej]

Do keys make you secure? like hardward, like the yubikey 5c nfc?

[@JakeHillion]

I've had my phone replaced before and just completely forgot that I needed to store these somewhere. Slightly concerned that every service let me reset it with basically no additional verification...

[@TheAkashicTraveller]

I mean they still send you an email you have to get a code/link from to do so. Which admitedly isn't great. The ones that don't make it so easy warn you about keeping recovery codes just in case.

[@MrBluemoon74]

In StarTrek the thing to "have" is your personalized communicator. It has to be in the same room as the attemt is done from. More than once you see them tap their communicator first before they say their password. If you lost your communicator you probably can do it, but you have to "reprogram" the computer first.

[@Vietnamkid1993]

If both the device and the server are set internally in UTC, how do timezones affect this method? UTC doesn’t use timezones.

[@2FAS]

2FA gives an extra layer of protection and you can easily enable it for various services

[@DeathlyTired]

TOTP will forever be 'Top of the Pops'

[@xylexrayne8576]

11:03 Timezones DONT cause a problem. Unix time is in UTC time, and timezones are handled by the computer and it's own locale configuration. Unix time does not keep timezone data.

[@MaxMakerChannel]

So what can I do to stop the same thing that happened to you from happening to me regarding google authenticator?

[@kvelez]

0:43 2FA 2:15 Combination. 3:45 Multifactor authentication. 5:34 2FA as a subset.

[@epictimesnine]

@computerphile Correction: Retina scan, voice recognition, and password is still just 2FA because the first two are the same factor. 5:42

[@JNCressey]

Nah, clearly your eyes are 'something you *have.'* :D

[@flowtoolz5554]

how did we get from "more factors help" to "oh and the additional factor cannot just be random, let's look at this HMAC" ?

[@YesicaHollinger]

Thanks for the analysis! 🔍 Just a small off-topic question: 😅 I only have these words 🤔. (behave today finger ski upon boy assault summer exhaust beauty stereo over). I don't know what they are. What should I do with them? 🤷‍♀️

[@vN2w3Z59BM]

Please enable captions, I'm a deaf

[@carlcarlos5265]

Yeah listen to that guy

[@vN2w3Z59BM]

@Pure Hungarian well, 3 years ago or before they did not activate them

[@user-cx2bk6pm2f]

Who is this guy?? He should be an educator. Fantastic speaking and explanatory skills! And btw, to whom is he speaking? Is he being interviewed/ Why else does he looks past the camera?

[@АнатолийАнатолий-п1д]

You could have stored all your TOTP keys in a separate database of a password manager and, once you phone has broken down, you'd ask a friend for a substitute phone for a few weeks if they have a spare obsolete model, and you'd install the password manager there and the TOTP base. Your story about the two weeks without TOTP is actually what happens when you know enough to set up a password manager and use a password database regularly but forget to set up proper backup system BEFOREHAND. If you TOTP base exists only on your phone and doesn't get backed up regularly and often enough, then when you phone breaks you'll lose it, so find out how to better sync and backup stuff from your many clients. And better use cloud + encryption for one of the backup copies, but also have a few local ones. And maybe store the backups in such a way so that you'd have 3 (2 local and 1 in the cloud) up-to-date ones and 3 (2 local and 1 in the cloud) 1 day or so late, and also have version control for all your backups, that way, even if you do something wrong and the new backup isn't right, the version control will have the previous version and the 1 day late scheme will save you from re-writing a backup repo with a repo that has a corrupted index. Check out BorgBackup.

[@fllthdcrb]

12:24 In _ST:TNG,_ we've seen that the system can be fooled, although it does take some special circumstances. There's that one episode (4x03, "Brothers") where Data goes haywire and hijacks the _Enterprise_ by imitating Picard's voice. And then he turns the security against the crew by locking all command functions with a security code much longer than most humans would be able to remember.

[@Ken.-]

Including the ship's computer. What was on screen didn't match what Data was saying.

[@ben_clifford]

I have also wondered the same thing about Star Trek. Recently, I've been trying to figure out if it's really a password that the commander is speaking, or maybe some sort of verification code that they didn't use something like "initiate self-destruct" in a sentence.

[@TheAkashicTraveller]

Maybe it's actually a very long one time password that's being whispered to them by their communicators. Would also explain how they remember them.

[@Seegalgalguntijak]

Also, biometric markers, no matter if it's a fingerprint, a face image, voice print or gait recognition, are never useful as an authenticator - because an authenticator (as in "your password") must have the ability to be changed, but you can't change your biometric markers. Which makes them useful only as the identifyier, that is the "user name" part of the authentication process. So if you swipe your finger or hold your face into a camera, and it recognizes who you are and then asks you for authentification (no matter how many factors), that would be acceptable for a service that is allowed to know you real identity. However, if it knows who wants to log in and then uses your biometric marker to log you in automatically, that is just stupidly unsafe. And yes, we all do it - I even installed fingerprint-gui on my laptop as a convenience feature, instead of having to type my password for every time I want to sudo something. But that works only locally, not over the interent.

[@jeffreyd508]

Those 16 digit codes that we are given when we set up 2FA on an app such as Binance, or similar. Can we re-view them/check if they are correct somehow?

[@skate2late]

The one time generated password might just be a regular password in the sense that it uses a pre shared key, but at least this pre shared key is not susceptible to any sort of social engineering or phishing attack, like a normal password is

[@dethbolt000]

@Comupterphile. I am wrong for presuming that 2FA to work, I must have a KEY that corresponds to my Facebook profile to gain access? My situation is that my account was hacked and then the activated the 2FA feature that I hadn't previously used. Facebook confirmed that I was hacked, but since I was logged out on my other devices, I can't access the key. I've contacted FB, but they've been giving me a hard time... They won't deactivate/bypass the feature and won't send me text authentication instead... What can I do?

[@Shadow81989]

Yeah, if only we had a video on time zones... perhaps with a guy in a red t-shirt? (imho the best video EVER!)

[@danfoad]

Turned down an offer for studying Computer Science at Nottingham, these videos really make me regret that choice

[@fabriziodutto7508]

@10:56 About time zones problem: that's why EPOCH or UTC is used, for this kind of applications... :-) My big concern on data exchange nowadays is focused on different character encoding troubles...

[@mocire]

so my master password is 11 characters long with symbols, upper and lower case letters and digits. would this be considered strong or weak?

[@scepts]

why wouldnt 2fa be read first then the password. So that people couldnt social engineer your password?

[@DJayDiamond]

Is there any need for this if you use really long randomly generated passwords which can't be cracked or stolen in a password manager? Also if you have a recovery code stored somewhere if 2fa fails on you then all an attacker needs is that code right?

[@RailgunRat]

Interesting topic! I'm curious about the difference between 2-Step Verification and 2-Factor Authentication, and what criteria define them? For instance, hackers have been able to take over people's phone numbers and intercept the security texts - thereby fullfilling the possession factor without physical accesss to your phone. (I've seen claims, that texts therefore only count as 2SV and not 2FA, but I don't know, if this definition is correct.) And would an app like Google Authenticator be impervious to this kind of trickery?

[@mortenmoulder]

I love when Mike explains cryptography. It would be nice to see more about OTP and the XOR function behind it.

[@boboertyusa]

I noticed some apps like discord have backup codes displayed on the actual app just in case you do not have access to your authenticator apps. Is this a security flaw? It seems like it could be. Feels like it defeats the purpose.

[@danya023]

These are recovery codes, and other apps suggest that you should print them out and store them in a safe place. The threat of always showing them is that someone who has access to a device you're logged in on can get a 2FA code to use to log in on a new device, while the utility is that if you haven't printed them during setup like it asks you to, you can do that at some later time. Considering that people with a security posture such that they think enabling 2FA is worth it are also likely to lock their devices, I'd say this is an acceptable trade-off but that's mostly a matter of preference.

[@j2simpso]

I watched the video but still don't get what he's saying. How does replacing something only you know (password) with something anyone can get (thanks to the magic of SIM jacking) any more secure?

[@Cornerback3141]

If you're concerned about SMS two factor authentication, you can use an authenticator app like the Google Authenticator in the video. That way you have to have access to the actual device with the app, not just access to text messages.

[@wigsnes]

Talk about DES and AES

[@Left4Cake]

Discord had one time password to diable the 2FA should you loose it ideally they are kept someplace phyiscally safe or in such a way that if someone finds it they have no idea what these numbers are like you call the file gameshark-codes.txt or something

[@_AN203]

4:48 That is why there is one time use code sent to your account after you use MRS so you can use it to login back and copy the 2fa secret to the auth app

[@bluekeybo]

Love Dr Pound! More videos with him please!

[@qwertz12345654321]

for some reason this reason doesnt play with sound for me :( other videos work just fine..

[@johng.1703]

it's not so much identify you are who you say you are, it is more knowing some information that is harder to know. for instance if you have access to a mobile phone, you have access to ALL the apps on that phone, be that an authenticator app, a stored password database, that doesn't mean the person is you. but it is harder for some other person on the other side of the world having access.

[@mmahgoub]

What is the appropriate way to store the secret key when using Google Authenticator?

[@nathancornwell1455]

Ever since i seen a white-hat hacking expo were a security expert showed that he could intercept text messages, i dont use my phone for password recovering or 2FA unless its the only option.

[@garretmkiii]

Steamguard... :/ Why every time? Sheesh.

[@silkwesir1444]

there actually is an episode of Star Trek: The Next Generation, where Captain Picard falls victim to a phishing attack! ("Ship in a Bottle", season 6). i find that especially noteworthy as back when it was made it was the early 1990s, before such a practice became something of note. idk if the term "phishing" even was invented back then, though it might have been... of course, the voice imprint as second factor doesn't help a lot if you can record the audio of him saying the password (or when you can outright synthesize the voice)...

[@wirelessbaguette8997]

I know I'm several months late, but I wish you'd touched a bit more on the increased vulnerability to phishing MFA can lead to. If you know you have MFA set up for an account, receiving an email which states "a login attempt was made, if it wasn't you, click here to change your login information" might make you more likely to follow the link without checking the email address itself or other signs of phishing. Then you've clicked the link and filled in your "old" login info and now the phisher has that info.

[@Mister1Slime]

Best password ever Mike (correcthorseb)

[@JaydentheMathGuy]

Nobody: Computerphile: Ah let’s start talking about passwords-

[@cfsscfsshk]

Warm reminder: if you are using iPhone, you can turn off message previews under notifications -> messages -> Show previews (scroll to bottom) -> set to "When Unlocked". To prevent people get your phone and allow them to get the one time code. Now at least they also need to know your pin to unlock the phone first.

[@nosouponhead]

Why does it matter how the OTP is created? As long as it's > 8 characters and it's only going to be used once, it shouldn't matter how you create it.

[@OmarQunsul]

Which previous video was he referring to?

[@klaxoncow]

Surely, though, the Star Trek computer simply tracks everyone's location? This has happened in many episodes where a member of the crew would ask the computer "Where's Riker?" and it would give them his current location on board the ship. So you'd have the idea that, when you get on board, the ship identifies who you are - say, by biometrics (which, of course, if they take the transporter to board the ship, then you've got the perfect biometric that the transporter buffer has them stored right down to the atom, to confirm who they are on an atomic level) - and then, whilst on board, the computer's always tracking everyone with its internal sensors. Once it knows that that heat signature is Commander Riker, then it can follow that heat signature around the ship with its sensors to be aware of where Riker is at all times. And if that heat signature starts ordering commands, then it knows that it's Riker already. So, really, the voice recognition is just a double check - just in case, in tracking people wandering about the ship, it didn't at some point get confused as two people got very close together and mixed them up - which leaves you with the idea that the password is actually a sanity check. And by sanity check, I literally mean a check of that crew member's sanity. It's not authentication, but rather a deliberately inconvenient "are you sure?" prompt, so they can't set off the self-destruct accidentally, but have to really very deliberately mean it.

[@ls72n9kd]

I notice you use Samsung Android. Do you know “how safe” is Apple’ Notes and Numbers encrypting passwords?

[@jamesedwards3923]

Look up the OPAL gudielines and they failed. Apple has closed source encryption. However, their code is solid enough if third parties are hired to break it. Governments that have special licensing contracts with Microsoft get to review the code. It is how the technology is implemented that is the concern. Your point is valid.

[@christopherdaniel4636]

Please, I down load 2factor authenticator and start using it without registering, and now the one time password is no more in the app, it all wipe off. How can I get the app working again.

[@RiscTerilia]

Surely Unix Epoch is the same in all time zones though?

[@lucasnathan80]

Do you have a video about how fingerprint authentication works?

[@azkamil]

Now please tell us about push based (to mobile phone) 2 factor authentication, e.g from Microsoft

[@OvertakeGT]

Please enable Captions....

[@cryptosistersuk621]

Hi, I think this is a great video for my followers and so is it ok to share?

[@arunaslasiunas6699]

I am Only using Google prompt and Backup Codes so i am safe right?

[@markelliottdriver]

I just got buggered by Duo. Phone broke and was unable to restore backup. Now I'm locked out of Facebook. Buggered.

[@6612770]

To survive through the repair scenario, always keep an 'old phone' in your cupboard that will work with your current SIM card.

[@sauron1427]

Nice xkcd reference xD

[@lucianodebenedictis6014]

The timezones are real!

[@QuietDuplicity]

xkcd reference? I mean I'm pretty sure I've seen the xkcd time zone comic strip you're talking about but I thought they were referencing their own time zone video they did a couple years ago.

[@zikcify]

I'm fairly sure he was talking about the password at 1:05

[@EmeraldMack992]

Correcthorsebatterystaple

[@YuvrajHanspal]

11:00 timezones - the bane of programmers existence!!!!

[@zakariahajji9336]

Can I have please the names of the books over his head ?

[@mothercromby]

Could you make a video about why implementing SMS 2FA is now considered poor practice?

[@deulalune]

SMS 2FA is poor practice because anyone can grab your phone number and use a sim swap

[@brainplot]

I'm curious to know how he logged into his Twitter account again, since it seems like there's no way around it, if you've lost your phone with Google Authenticator on it

[@wariolandgoldpiramid]

There was a time when I lost access to Patreon, due to losing the Google Auth code for it. Now, today, they use text message codes, but back on then, they used Google Auth codes. In order to get access, I had to send them an email. They asked me for the last four digits and expiration date of the credit card I used, and they disabled 2FA after I gave them the correct details.

[@arunaslasiunas6699]

Use backup Codes

[@Seegalgalguntijak]

A friend of mine had his Android phone break on him, which then made it impossible to log back into his Google account from his PC becaue he couldn't acknowledge the second factor on his phone. He had to get another phone first and then he could use his account and his email again. He turned off 2FA after that experience.

[@username65585]

Authy allows you to have your 2FA be shared between multiple devices.

[@foobargorch]

Don't use google authenticator, without writing down backup codes or something like that, because there is no way to back up the shared secret after it has been configured, which means if you factory reset your phone the codes you've got set up are gone, even if your settings are backed up. Even if you have backup codes, this is still a total pain in the ass to go and reset everything, and set up new codes everywhere... There are a number of open TOTP apps on F-Droid, as well as commercial services which provide better usability (though in my opinion they all fall short in terms of trustworthyness).

[@monkeyseemonkeydo432]

Is he related to Rimmer from red dwarf?

[@nuckymcnuck]

I hate to be pedantic, but TOTP HMAC is 2SV, not 2FA. There is a second step to logging in, not a second factor to logging in. A true second factor would be a Yubikey. The only XFA, where X > 2, that I know of that actually works is MIRACL.

[@Eysc]

Same happened to me with Google authenticator, never again, use Authy if you lose your phone just initiate session on other defice to get access to your 2fa

[@xpaganda]

Twelve and a half minutes to explain that 2-FA is 2-Fluoroamphetamine?

[@BrendanxP]

12:34 I like it

[@jeremia9077]

Oh, another problem is SMS authentication. A website recently had a hacking incident, where someone called up the website owner's phone company, convinced them they were the owner of the phone, and had the number moved to another SIM card. So when they tried to reset the person's password and received an SMS to verify their identity, the message was sent to the attacker's phone instead. This probably would not have happened if the 2-factor authentication wasn't through SMS, and instead through something like Google's Authenticator App, but it just shows that the biggest point of weakness in any security system you can think of is the Human element. Aka, Social Engineering.

[@logangraham2956]

also if you don't have a cell phone and the company does 2fa through text message then that is completely pointless because you can't recieve text messages.

[@gdthegreat]

best channel. best content. your explanation is best. but please give subtitles for this video.

[@wood-eye]

What if you don't have a phone?

[@frankhaugen]

Best passwords I've used, (I don't use this exact, but the same concept), follows this general idea: Land0Of1The1Free2And3Home5Of8The13Brave! A sentence from something that is easy to remember, the words Titleized, separated by numbers from a sequence you know, end by a special character. Super easy to remember, extremely hard to crack

[@SuperLoopholes]

I'm sad that the password in the graphic wasn't hunter2