2-Factor & Multi-Factor Authentication
- Johnson Nguyen
At the LF, we believe that protecting your work environment should be the top priority for all our users. With that, we recommend everyone setup 2FA on their accounts.
2FA can be via phone or 3rd party applications. Below are some of the 3rd party applications we recommend using
Understanding 2FA & Why we use it
2FA, or Two-Factor Authentication, is a security measure designed to add an extra layer of protection to your online accounts and services. It enhances the traditional username and password login process by requiring an additional piece of information to verify your identity.
2FA is particularly crucial for accounts containing sensitive data, such as email, online banking, social media, or any service where your personal information is stored. It provides an added layer of defense against identity theft, unauthorized access, and potential financial loss.
Enabling 2FA is relatively simple, and many online services and platforms offer this feature. It is strongly recommended to activate 2FA wherever possible to enhance your online security and protect your digital identity. We recommend using one, two or all of the methods below to keep your account and data safe
Using YubiKey
Using Yubikey U2F for 2-factor authentication
What is U2F?
U2F stands for "Universal 2nd-Factor" and solves many security and usability problems of other 2-factor authentication mechanisms. It was developed by FIDO, which is an industry alliance working to improve online security across multiple device and service vendors.
U2F was developed specifically for browser-based authentication and has built-in anti-phishing protection.
How is U2F better than receiving SMS codes?
SMS requires that you are able to receive text messages, which may be impossible under multiple conditions:
when traveling internationally
when working from areas with poor cell network reception
when your provider is having an outage
if your phone is out of battery
Additionally, SMS messages are not very protected and can be intercepted, spoofed, or misdirected.
Read more about downsides of SMS for 2-factor authentication.
How is U2F better than Google Authenticator?
Google Authenticator is a smartphone app that generates one-time passcodes that must be manually typed into a web form. It is an improvement over SMS, but still sometimes fails:
if your phone is out of battery
if time on your phone is out of sync
Additionally, it has important usability problems – as multiple sites are added to the smartphone app, it becomes increasingly difficult to find the right code to type in from a list of a dozen entries.
How does U2F help against phishing attacks?
When setting up U2F authentication, a unique site key is stored on the U2F device. Attempting to use it on phishing sites will not work because of the key mismatch.
Read more about U2F and phishing attack prevention.
Is it difficult to use?
No, all you will need to do is insert the security key into your computer USB port and press the flashing button when prompted.
You only need to do it about once a month (or when logging in from a new device).
If you cannot use your U2F device for some reason (for example, when logging in from a tablet or a smartphone), you will be able to continue to use Google Authenticator as your fallback mechanism.
What browsers support U2F?
Google Chrome
Firefox (requires manual enabling)
Opera
If you are using Safari or some other browser, please consider switching to Chrome or Firefox for your work-related needs.
Where to get a U2F key?
If you are located in the San Francisco bay area, you can pick up your U2F device at The Linux Foundation office.
Otherwise, order yours online and reimburse it following the usual procedure:
You can purchase from Amazon or many other retailers as well. Please reimburse under "Office Supplies."
All Linux Foundation full-time staff is pre-approved for this purchase.
How to start using U2F?
Set up your U2F key with your LF Google account
You can just follow the steps in the video posted above, or do the following:
Go to google.com and click on the circle in the topmost right corner (usually, your face or initials)
Select "My Account"
Make sure this is your Linux Foundation account, not your personal one
Select "Signing in to Google"
Select "2-step verification"
You will be prompted to re-enter your password to continue
Scroll to where it says "Add Security Key"
Follow the prompts to set up your Yubikey
Set up authenticator app 2-step for fallback
You are no doubt worried what happens if you lose your yubikey, misplace it, or cannot access it for some reason. You can set up an Authenticator app on your phone as a fallback mechanism for accessing your Google account.
The process is exactly as above: choose "Add Authenticator App" and follow the instructions as provided by Google. You can alternatively set up the "Google Prompt" mechanism if your mobile device supports it, and if Google offers you that option. It's more convenient than having to manually type a code but still requires that you have a network connection in order to work.
This is the 2-step verification mechanism you should use when logging in from a smartphone, a tablet, or any other device that does not have a USB port.
Remove SMS method from your account
For maximum account security, you should remove SMS-based verification – leaving it enabled still allows an attacker to exploit SMS weaknesses to gain access to your account.
Go to the "2-step Verification" page if you're not already there
Click the pen icon next to "Voice or Text message"
Click on "Remove Phone"
Need help?
As always, Helpdesk will be happy to assist you with any problems. Please contact Service Desk via support.linuxfoundation.org or drop into #it-support on Slack.
Other sites that support U2F
You can use the same YubiKey to set up 2-step verification on many other sites that support it, including your personal Google account. Some examples:
Facebook
Dropbox
GitHub
See dongleauth.info for a complete and updated list.
Using 1Password
Save your QR code
To save your QR code using 1Password in your browser
Open and unlock 1Password in your browser.
Select the Login item for the website.
Click and choose Scan QR Code.
To save your QR code in the 1Password apps
Instructions for
Open and unlock 1Password.
Select the Login item for the website, then click Edit.
Click Add More, then choose One-Time Password.
You may need to scroll down to see these options.
Click to scan the QR code from your screen or clipboard.
If you can’t scan the QR code, most sites will give you a string of characters you can copy and paste instead.
Click Save.
To save your QR code on 1Password.com
Sign in to your account on 1Password.com.
Select the Login item for the website and click Edit.
Click “label” in a new section, and enter “One-time password”.
Click
to the right of the field and choose One-Time Password.
On the website, choose to enter the code manually. Copy the code, then paste it in the One-Time Password field.
If the website only supports QR codes, you’ll need to scan it using a 1Password app.
Click Save.
Confirm your one-time password
To confirm that you’ve saved your QR code, the website will ask you to enter a one-time password. Copy and paste the code from 1Password.
Using Authy
Using Google Authenticator