Two-Step Login, Starting With Email

A password is no longer enough

Last week's list of 773 million email addresses was a reminder of something that has been true for a while: passwords leak, and old ones keep circulating for years.

Two-step login changes what a leaked password is worth. After the password, the account asks for something only you have, usually a code from your phone, so the password alone opens nothing.

It goes by several names: two-step verification at Google, two-factor authentication at Facebook, multi-factor authentication in Office 365. They all mean the same thing.

Turning it on takes a few minutes per account. The real work is deciding which accounts, which method, and what happens when somebody's phone goes missing.

Which accounts come first

• Email, because every other account resets its password through it.
• The domain registrar, which controls where your website and email point.
• Hosting, including the control panel and the website's own login.
• Google, covering My Business, Analytics, Search Console and G Suite.
• Facebook, for every person with a role on the business page.
• Banking and the payment processor, using whatever the bank offers.

The second is the one most businesses never think of. The registrar account is rarely logged into, so its security goes unexamined, yet whoever controls it can take the website and email elsewhere in an afternoon.

Start with email

Email comes first because it is the master key. A password reset for the registrar, the hosting account or the bank arrives there, so protecting everything else starts with protecting it.

G Suite and Office 365 both let the administrator require two-step login for every user. Turning that on for the whole business works better than asking nicely.

Apps, texts and keys

There are three common methods, and they are not equally good.

A text message with a code is the most familiar, and far better than nothing. Its weakness is the phone number: a criminal who talks a mobile carrier into moving your number to a new SIM card receives your codes.

An authenticator app creates a fresh six-digit code every half minute on the phone itself, with no message sent. Google and Microsoft both offer free ones, and most services accept codes from either.

A security key, a small device plugged into the computer or tapped against the phone, is stronger still. It suits the one or two accounts that would hurt most to lose.

Recovery codes

When two-step login is switched on, most services offer a set of recovery codes: single-use codes that get you in when the phone is not available.

They are the most important part of the setup, and the part most people skip.

Print them, label each set with the account it belongs to, and keep them with the business's important papers. Not in the email account they protect, and not on the phone that might be lost.

A second method helps too. Where a service allows a backup phone number or a second device, add one.

The staff member who will lose their phone

Somebody will. Phones are dropped in lakes, left in taxis, replaced when a contract renews, and wiped without a thought for what was on them.

An authenticator app usually lives only on the phone, so a lost phone takes the codes with it. Moving to a new phone is a deliberate job, done while the old one still works.

Plan for it before it happens. For email, an administrator can usually issue new backup codes or reset the second step for one person, which is a good reason to have more than one administrator.

For accounts with no administrator, such as a registrar account, the recovery codes are the plan. Without them, getting back in means the provider's identity checks, which can take days.

A worked example

A catering company with a dozen staff turned on two-step login for its G Suite email last autumn. The events manager also turned it on for the registrar account and for her own Facebook account.

In December, her phone was left behind at a wedding venue and never found. The authenticator app went with it.

Email took ten minutes, because the owner, as administrator, could generate backup codes for her account. The registrar took most of a week of identity checks, because nobody had printed its recovery codes.

The Facebook page was fine, because the owner was also an admin on it, with two-step login set up on her own phone.

The company now keeps printed recovery codes for every account in the office safe, gives each important account two people who can get in, and treats a new phone as a task with a checklist.

Shared logins make it harder

Two-step login assumes one person per account. Shared logins, such as one registrar account used by two people, fit it badly.

The better fix is separate logins wherever the service allows them: individual users in G Suite, page roles on Facebook, additional users at many registrars and hosts.

Where a shared login is unavoidable, the code can be set up on two phones at once, by scanning the same setup code with both while it is on screen. Record who holds the second.

Rolling it out

For a small business, the rollout is a morning, not a project.

Do the administrators first, then everybody else, sitting with each person while they set it up. Ten minutes in person saves a week of locked-out staff.

Then write a short page: which accounts have two-step login, who holds the second device or the recovery codes, and what to do when a phone is lost.

The counter-case

Not every account offers two-step login, and not every person has a smartphone.

A staff member without one can use text messages, or a key-ring security key on services that accept them. Text codes are weaker than an app, but much stronger than a password alone.

A sole proprietor has the opposite problem: nobody else to reset anything. For them, printed recovery codes matter more than the method chosen.

Whatever the shape of the business, turn it on for email this week, and work down the list from there.

Starting this week

1. Turn it on for business email.
2. Require it for every email user.
3. Use an authenticator app, not text messages.
4. Print the recovery codes for each account.
5. Store them with the business's important papers.
6. Add the registrar and hosting next.
7. Write down what happens when a phone is lost.

Step four is the one that decides how bad a lost phone gets. With the codes in a drawer, it is a ten-minute inconvenience; without them, it can mean days of proving who you are.

Why passwords alone stopped being enough is covered in a list of 773 million email addresses.

Frequently asked questions

West Coast Media Solutions Inc. provides web design, web development, hosting, digital marketing, and business consulting to organisations across Canada, drawing on more than twenty-five years in the field.