Setting Up Two-Factor Authentication — Ask Leo! Live

Turning on multi-factor or two-factor authentication, multi-factor authentication, it goes by it goes by both terms two-factor and multi-factor. The bottom line is that you have multiple forms of proof that you are who you say you are, that are required when you log in. So normally when we think of just logging in with a username and password, that’s really only one factor. It is something you know; it’s you you know, your you know your username, and you know your password.

Two-factor authentication adds basically something you have. So what that usually boils down to is some kind of proof that you are in possession of something physical, physical. And I’ll show you some of the examples that are associated with that. Something you have, like I said something physical, that also tends to spill over into something you have access to, such as an alternate email address or another kind of account. And then we say multi-factor because in fact that can still be extended.

There’s a third level that often gets added in even more highly secure scenarios. And that’s something you are which typically boils down to biometrics. Now, biometrics can be used as its, you know, by itself as a second factor. But when we start looking at multi-factor authentication, you can actually have all three things required something you know, a password, something you have, which we will prove, and then something you are which would be something that would, you know, be a fingerprint or a retinal scan or face ID or something like that. When you go to something like outlook.com, and you click on your, your icon, your your usually it’s an avatar, it’s, it can be the first letters of your, of your email address.

It can be an image that you uploaded, I uploaded an image here that says AskLeo! – click on that, click on My Account. And now you can see we’re at the same place we were on this tab, so we’ll make that one go away. My Account is where this kind of information is kept. And the place we want to go down to here is Protect Your Account because that’s what two-factor authentication is all about. It does request you to enter a password again; you’re about to make security settings to your account. And it’s important that only you be able to do so. So even though we’re already logged in, it’s going to ask you to confirm your password yet again. In this case, you can see that LastPass, which I have enabled on this machine, has already entered it in for me so all I really need to do is click Sign In.

There’s a variety of things that you can do on the security page. I’m going to focus specifically on more security options. If I set up two-step verification, it will now walk me through the process of setting it up for the first time. I’m going to set up using a different authenticator app. Here you can see now that there is a QR code being displayed. That is the QR code that will associate my account with a specific, with a specific identification app; it’s going to be impossible for me to really show it to you. The phone is actually turned into a very strange little camera with an area that you are supposed to target the QR code. And a QR code was scanned. And now the app is showing me a number that would be my identification number. Verify that the pairing was successful by entering a code below; the code that’s it’s asking for is the code that is currently being shown on my phone, which in the time since I started talking, and just now has changed.

So the whole theory behind security codes and apps, and let me bring this full screen again, so it’s a little bit easier to see. The whole idea here is that this number that’s being displayed by the security app on my phone will be different every 30 seconds. And it is impossible for you or I or pretty much anybody to guess or predict what the next number in the sequence is.

In fact, we are unable to guess any of the future numbers associated with this with this app, this pairing, the only places that know what the next number is or what the number is, is the app on my specific phone and the service into which I’m logging in. So what that means is that my ability to provide the correct number, when asked proves that I am in possession of my phone; it proves that I have my second factor. So we have now turned on two-factor authentication for this account.

And the next time I log in, or anytime I log in on a device that I haven’t logged into before, it will ask me, show me, or tell me the current code on your authenticator device to prove that you are in possession of the device. That will be required in addition to the password. The, the reason I point out that it only will ask for that second factor on devices on which you haven’t previously logged in, is a lot of people are worried, “Do I have to do this every time I log in?” And the answer is no, of course not. You, when you log in, you have the option of saying “remember this machine”.

And depending on the service you’re using, you can say just remember this machine or some will say remember this machine for 30 days. But for that period of time on that specific machine, often that specific browser on that specific machine, you will not have to prove your identity beyond knowing your user account name and password. The reason that is so still incredibly secure, is that the folks that are trying to hack into your account don’t have access to your machine; they do not have a machine on which they have successfully logged into your into your account. They may, at worst have your account name and password.

But with two-factor authentication turned on the first time they try to log in from any machine, it will require them to enter in the second factor, which they don’t have. That’s why two-factor authentication is so incredibly powerful. Now, you can of course set up an additional identity verification app, you can do run through this process again, if you like. So if you want it to have both Google Authenticator, and Authy, and the Microsoft tool that I’m running, all connected and connected separately, so they’re not all sharing the same authentication codes, you can do that. That’s not the approach that I take as I was mentioning, I use Authy so when I do go through this process of scanning a QR code, everything gets remembered automatically across the devices on which I have Authy installed.

What I want you to do that immediately after having set something like that up is scroll down here in the Microsoft account settings to replace or set up a recovery code. In my case, I needed to log in again. In your case, you may not, you’ll probably need to log in again, if you haven’t done it for a little while. The idea here, as I was saying is that the recovery code is something you can print or copy, paste and save somewhere secure. If you ever lose your phone, as I was leading up to if I ever lose my phone, right now, this is the only place I have a second factor. If I lose this phone, I cannot log into my account, perhaps.

But if there are run the risk of not being able to log into my account the recovery code is your safety net. It is something that you save securely for any emergency such as having lost your second factor. When you try to log in, and it asks for your second factor, you will be either giving this recovery code in its place, or you will have an option to say I don’t have my second factor, it will ask you for your recovery code. Microsoft, as you can tell, this looks like looks a lot like a product key.

And I’m sure it uses the same encryption mechanism. It is not a product key. It’s just their standard way of displaying what is essentially a very long, complex password that they set and save for you that you get to use exactly once in an emergency. They strongly recommend that you don’t store your recovery code on a device naked. That statement by itself is true. You should not store the recovery code on a device. I do but as I said, I encrypt it first, I save it somewhere that is secure. So that it’s not something that somebody can just stumble on.

But this is how you would regain access to your account, should you not be able to use your second factor now, very often. So let’s go ahead and we’ll go ahead and save that. Let’s assume that I saved it somewhere safe. Setting up a security key;  a security key is one of these. This is a yubikey. There are several made by different manufacturers and it can be the second factor associated with your account. It acts in various ways depending on the application asking for you to prove that it exists.

The short version is that when the app asks you for a second factor It will ask specifically for any security key that you’ve configured. I’m going to go ahead and step ahead here so that you can see what it’s asking you to do. There are two different kinds USB, actually, this one does both, but it’s obviously USB. It’s something that you stick into a USB port. When you associate it, what happens is, you press on the button that is here in the middle of the key, and it actually enters some information into your computer. I believe there’s a private (Click on the term for full definition.)