New Security Feature: 2 Factor Authentication

We recently added another layer of authentication that enables users to use time-based one-time password when authenticating/logging in. This password will be different every time you log in and would only be something that you and only you possess.

This added level of security is free for all users and available on all accounts now. What is 2 Factor Authentication? Here is what Wikipedia has to say:

“Time-based One-time Password Algorithm (TOTP) is an algorithm that computes a one-time password from a shared secret key and the current time. It has been adopted as Internet Engineering Task Force standard RFC 6238,[1] is the cornerstone of Initiative For Open Authentication (OATH) and is used in a number of two factor authentication systems.

TOTP is an example of a hash-based message authentication code (HMAC). It combines a secret key with the current timestamp using a cryptographic hash function to generate a one-time password. The timestamp typically increases in 30-second intervals, so passwords generated close together in time from the same secret key will be equal.

In a typical two-factor authentication application, user authentication proceeds as follows: a user will enter username and password into a website or other server, generate a one-time password for the server using TOTP running locally on a smartphone or other device, and type that password into the server as well. The server will then also run TOTP to verify the entered one-time password. For this to work, the clocks of the user’s device and the server need to be roughly synchronized (the server will typically accept one-time passwords generated from timestamps that differ by ±1 from the client’s timestamp). A single secret key, to be used for all subsequent authentication sessions, must have been shared between the server and the user’s device over a secure channel ahead of time. If some more steps are carried out, the user can also authenticate the server using TOTP.” *Wikipedia

Screen Shot 2014-09-09 at 8.10.31 PM

Screen Shot 2014-09-09 at 8.20.00 PM

More details here in our release notes and watch for the knowledge base article for a more detailed how to article.