Decades into the campaign, the effort to wean users off simple password protection hasn’t gone very well. Fingerprints, iris scans, tokens… these methods have all been tried and met with only limited success. The security industry’s best chance yet? It’s a sort of half-measure that lets users keep their passwords but adds a second element (or “factor”) to logins.

However, data about the uptake of two-factor authentication (2FA) means this once-promising strategy also hasn’t succeeded. A combination of usability, fallibility and just-plain stubbornness has preserved the role of plain-old passwords at many places.

What’s so fallible about 2FA? It often relies on consumers’ smartphones. A bit like Social Security numbers in the U.S., it’s a role smartphones weren’t designed to play. So, many implementations haven’t proven to be robust.

Help might be on the way, however, as mobile carriers are working together on a solution. If they pull it off, perhaps two-factor might finally catch on with the masses — but that seems a distant possibility at the moment.

2FA or not 2FA?

Dismal data points for two-factor uptake are easy to find. The latest: 90 percent of Gmail users still haven’t turned it on, according to The Register, even though Google introduced two-factor tools seven years ago. Grzegorz Milka, a Google engineer, revealed this depressing reality at the Usenix conference in January 2018. When asked why Google didn’t require two-factor, Milka gave the answer almost all security professionals would.

“The answer is usability,” Milka told The Register. “It’s about how many people would we drive out if we force them to use additional security.”

Only 28 percent of people use 2FA anywhere, CyberScoop reported — and more than half of Americans don’t even recognize the term. That’s not much to show for a nearly 10-year campaign.

Why So Much Hate for 2FA?

At sites like Amazon, Facebook and Instagram, it’s really not that hard to turn on two-factor. Users can do it within a few clicks. The real reason for user indifference might not be usability so much as the irregularity. It seems each implementation of 2FA is slightly different.

One site requires users to enter an SMS text message that will be sent to their phone — woe to that user with a nearly dead cellphone battery. Another will ask for a token code generated by an authenticator app. Facebook generates its own token from within its app. Perhaps the state of affairs is not as bad as the 150 passwords that the average consumer must remember to navigate their digital lives, according to Dashlane, but the inconsistency itself can be maddening.

Is 2FA Really That Great?

Making matters worse, the most popular implementation — the something-you-know and something-you-have kind, which requires SMS text messages — isn’t all it’s cracked up to be. In fact, it’s been cracked, and it’s quite possible consumers have caught on.

Cybercriminals have used a variety of techniques to intercept authentication codes sent over mobile networks — rendering SMS nearly useless as a second factor. However, these attacks don’t seem to be in widespread use yet, so it can be said that two-factor SMS is still better a single password.

Yet, as with all such techniques, criminals will continue to share it and slowly make SMS only about as safe as the passwords themselves. Security professionals already concede this point. As The Verge reported, the National Institute of Standards and Technology withdrew its support for SMS-based 2FA in summer of 2016, citing interception and spoofing risks.

A Glimmer of Hope for 2FA

A consortium of mobile carriers led by AT&T, Sprint, T-Mobile and Verizon announced recently the creation of a “next-generation mobile authentication platform.” Calling themselves the Mobile Authentication Taskforce, the group promised in 2017 to be working hard on the spoofing and interception problem. In March 2018, the Mobile Authentication Taskforce revealed a few details about its plans in a statement.

“The [group] has been working with operators around the world to bring a consistent and interoperable, secure identity service and this task force will strengthen that effort by enabling a simple user experience quickly and conveniently in the US market,” said Alex Sinclair, chief technology officer at trade group GSMA.

The Mobile Authentication Taskforce also said in the statement that it had developed a technique that would utilize the “collective network intelligence” of the carriers. The strategy includes a “cryptographically verified phone number,” inspection of characteristics like phone number tenure, account type and IP address, as well as other advanced analytics that will be used to assess risk.

Further details are still elusive. However, the group promised it would begin testing soon, launch a website later this year and make the solution available by the end of the year. Meanwhile, the carriers’ chance to seize a privileged spot in the authentication game might already be slipping away. Token apps like Google’s Authenticator, which doesn’t require network access to generate a code, seem to bypass the carriers.

But IT professionals don’t need to wait around to see who wins that battle. Users can be forced to add another factor to their logins, of course, but perhaps there’s a better way. Some organizations lure users to turn on 2FA by giving them a discount when they do. And sometimes, an incentive is better than a threat.

“Attackers take advantage of security missteps and shortcuts to gain access to secure systems and sensitive files

More from Endpoint

Patch Tuesday -> Exploit Wednesday: Pwning Windows Ancillary Function Driver for WinSock (afd.sys) in 24 Hours

‘Patch Tuesday, Exploit Wednesday’ is an old hacker adage that refers to the weaponization of vulnerabilities the day after monthly security patches become publicly available. As security improves and exploit mitigations become more sophisticated, the amount of research and development required to craft a weaponized exploit has increased. This is especially relevant for memory corruption vulnerabilities.Figure 1 — Exploitation timelineHowever, with the addition of new features (and memory-unsafe C code) in the Windows 11 kernel, ripe new attack surfaces can…

When the Absence of Noise Becomes Signal: Defensive Considerations for Lazarus FudModule

In February 2023, X-Force posted a blog entitled “Direct Kernel Object Manipulation (DKOM) Attacks on ETW Providers” that details the capabilities of a sample attributed to the Lazarus group leveraged to impair visibility of the malware’s operations. This blog will not rehash analysis of the Lazarus malware sample or Event Tracing for Windows (ETW) as that has been previously covered in the X-Force blog post. This blog will focus on highlighting the opportunities for detection of the FudModule within the…

Cybersecurity in the Next-Generation Space Age, Pt. 3: Securing the New Space

View Part 1, Introduction to New Space, and Part 2, Cybersecurity Threats in New Space, in this series. As we see in the previous article of this series discussing the cybersecurity threats in the New Space, space technology is advancing at an unprecedented rate — with new technologies being launched into orbit at an increasingly rapid pace. The need to ensure the security and safety of these technologies has never been more pressing. So, let’s discover a range of measures…

Backdoor Deployment and Ransomware: Top Threats Identified in X-Force Threat Intelligence Index 2023

Deployment of backdoors was the number one action on objective taken by threat actors last year, according to the 2023 IBM Security X-Force Threat Intelligence Index — a comprehensive analysis of our research data collected throughout the year. Backdoor access is now among the hottest commodities on the dark web and can sell for thousands of dollars, compared to credit card data — which can go for as low as $10. On the dark web — a veritable eBay for…