Turn on two-factor authentication for email, payment, and social accounts; prefer phone pop-up confirmation, with SMS codes second

Two-factor authentication means that besides your password, you confirm once more that it is really you when you log in. With a pop-up on your phone that you tap to confirm, more than nine out of ten phishing account takeovers are blocked. An SMS code is easier to trick out of you than a pop-up. Old methods like answering “where did you last log in?” or “what is your backup email?” block as few as one in ten phishing takeovers.

Cost

No cost. Set it once per account; two or three minutes each.

Benefit

Google counted 350000 real account takeover attempts (also called account hijacking). One class uses device-based verification, such as a pop-up on your phone for you to confirm, or plugging in a security key. That class blocked “more than 94% of phishing-related hijacking attempts and 100% of automated hijacking attempts.” Phishing means tricking you into entering your password on a fake site; automated means machines trying leaked passwords in bulk. Another class uses knowledge-based verification, such as where you last logged in or what your backup email is. That class “blocked as little as 10% of phishing hijacking and 73% of automated hijacking.” Within device verification, an SMS code is weaker than a phone pop-up. Phishers got 4% of the SMS codes right; the pop-up was fooled only 1% of the time. In targeted attacks aimed at a specific person, SMS blocked only 76%, and the pop-up blocked 90%

Notes

The same study also found that this verification sometimes locks out the real user. 52% of genuine users did not get in on the first try, but 97% eventually did. Turn it on for email first, because most other accounts can recover passwords through email. Keep verification codes to yourself; what reading a code aloud for someone else can cost you is in Section 8, item 45 (reading verification codes).

Sources · 1

1. Doerfler P, Thomas K, Marincenko M, et al. (2019). Evaluating Login Challenges as a Defense Against Account Takeover. The World Wide Web Conference (WWW '19). doi.org/10.1145/3308558.3313481