The Practical Guide To Mac Security: Part 4, Two-Factor Authentication — Transcript

Full transcript

1. 0:00Hi, this is Gary with MacMost.com. This is Part 4  of my course The Practical Guide to Mac Security.
2. 0:06This course is brought to you  thanks to my Patreon supporters.
3. 0:09To find out more about the Patreon  Campaign go to MacMost.com/Patreon.
4. 0:13There you can join us, get course  discounts, and exclusive content.
5. 0:23So while having strong passwords is a great way  to secure any account it's not the ultimate way.
6. 0:29A much better way is using  two-factor authentication.
7. 0:33So what is two-factor authentication?  Well, normally to get into an account
8. 0:38you've got your User ID and your Password.  Your User ID is usually an email address. Now
9. 0:44a User ID is pretty much public information. Other  people know your email address. It's not a secret.
10. 0:51So matching up an account with an email address  is no problem for somebody trying to get into
11. 0:58an account. However the Password represents  the barrier. It's hard to get your Password.
12. 1:04But it is possible. There are ways to get your  password. For instance you could be logging into
13. 1:09your account on a public computer on a public  network and the password could be intercepted.
14. 1:14Social engineering could be used  to con you out of your password.
15. 1:18Of course, you could have a weak password or  maybe weaker than you thought it was password
16. 1:23and it could be guessed and then there's access  to your account. So instead of just having that
17. 1:27one-factor of the password, the idea is to have  a second factor which is usually a one time code.
18. 1:34What happens here is you go to log into an account  with your ID and password and then you're asked
19. 1:39for a one time code. You have to enter that code  in. That code is sent to you sometimes on your
20. 1:45mobile phone, sometimes in an app, or in the case  of the Apple EcoSystem it's actually sent to you
21. 1:52by your other Apple devices. For instance  maybe you get it on your iPhone when you're
22. 1:55trying to login on your Mac. So in this case  you've got your email address is public,
23. 2:02your password is hard to get but possible and  this one time code is also very hard to get even
24. 2:09though it is technically possible especially using  social engineering trying to get that from you.
25. 2:13But combined the password and the one time code  are almost impossible to get. It creates quite a
26. 2:20barrier between somebody trying to get into  your account and them actually getting in.
27. 2:26So what is the Second Factor? This would be a  code sent to your phone, for instance. That's
28. 2:31the classic example although it is used less  and less now. So you get a text message with
29. 2:36that code. You try to login, your phone buzzes,  you look down and it says here's your code, and
30. 2:41you enter that into the app or computer screen,  or wherever you're at that's asking for the code.
31. 2:47Sometimes this is sent by email rather than by  a text message. Other times it is obtained by
32. 2:55an app. Like, for instance, if you're going to use  Goggle authenticator to log into a Goggle account,
33. 3:00like Gmail or YouTube or something, then instead  of actually having the code pushed to you you
34. 3:06would use the Goggle Authenticator app or another  app that works in that same system and you would
35. 3:11go and get that code itself. So you go into the  app and it shows that account and here's the
36. 3:16current code. These codes are always changing  so you can't just go one time to it and know
37. 3:23the code and memorize it. It's going to be  different thirty seconds or one minute later.
38. 3:27Also, it's important to note that there is a  usually a backup second factor. For instance
39. 3:32a backup code. If you create an account you can  create these backup codes and they are usually
40. 3:37very long codes that you wouldn't want to normally  type in. Maybe you would print them out on a piece
41. 3:42of paper and store them in a safe place. So  for some reason you loose access to your second
42. 3:46factor, like your second factor is a one time  code sent to your phone, and you change phones.
43. 3:52Like you loose your phone and get a new one and  it has a new phone number and now can no longer
44. 3:57have access to your second factor you can use the  backup codes one time to get into an account. So
45. 4:03you can reestablish things with that second  factor for a new phone number, for instance,
46. 4:09So what do I mean by a one-time code? Well,  one-time code it could be sent by either SMS
47. 4:15by text message or email or you obtain it in an  app. It's only valid for a short period of time.
48. 4:21So there's no point memorizing it. You're going  to use it this one time to login. The next time
49. 4:25you go to login it's going to be a different code.  Even if you don't use it right there it's going to
50. 4:30expire maybe as soon as thirty seconds from that  point. Maybe it changes every minute so it could
51. 4:37expire seconds after you see it if you're at  the end of a minute. This is important because
52. 4:42somebody can't steal your one-time code. If they  steal your one-time code then you try to login,
53. 4:47even a couple of minutes later, it won't work. It  requires device access so, for instance, you know
54. 4:53if it's a SMS code that means that somebody needs  to not only have physical access to your phone but
55. 5:00be able to log into your phone. You know if you  have a passcode set on your phone. The same thing
56. 5:04if it's sent by email. They need to log into your  email account. So, even though it's kind of sent
57. 5:09to you and it looks like you get it without any  trouble somebody else trying to get it would mean
58. 5:13they need access to whatever you assume you had  access to like your phone or your email account.
59. 5:19Sometimes it can be a link especially if they're  sent in an email. Sometimes you get an email as
60. 5:22your second-factor and it says click this link  and basically all that's doing is entering the
61. 5:28code for you. So you really are getting a  second code there but you click it and it's
62. 5:32automatically confirming that you had access  to that second code because you clicked that
63. 5:37link in the email. You know sometimes today,  especially for lots of online accounts, the
64. 5:45password is actually not even used. So just the  second-factor. So you go to log into an account
65. 5:51and then is says look for an email or look  for a text message and click the link there.
66. 5:56It's basically not using a password at all. Only  using the second-factor. So it's relying on the
67. 6:02security of your email account or the security of  your phone for security to this account and not
68. 6:09throwing in a password as that first-factor. So  it's really one-factor but the one-factor is the
69. 6:15code rather than a password which is actually more  secure of the two since it changes all the time.
70. 6:22So if you don't already have two-factor  authentication setup for your iCloud
71. 6:26Account you can do that on your Mac by going into  System Preferences and then go to your Apple ID.
72. 6:34Then right here in Overview if you're not using  two-factor authentication you're going to get
73. 6:38an alert right here and the ability to turn  it on right here. But you could also do it
74. 6:43in Password & Security and then under Two-Factor  Authentication you could see you could turn it on.
75. 6:51So let's go to turn it on. The first thing  you're going to be asked is for a phone number.
76. 6:58It should be a trusted phone number. Your cell  phone's phone number. Your home phone number.
77. 7:03Something you think is going to be somewhat  permanent and this will kind of be the backup
78. 7:09because when you use Two-Factor Authentication  if for some reason you don't have access to a
79. 7:14second device, like for instance you're trying to  access your account on your iPhone while you're
80. 7:18out. All you have with you is your iPhone and  you don't have another Apple device with you
81. 7:24to get the second factor on, then one of  the things you can do is say, Okay you're
82. 7:29going to need to send me this using the text  message service of my mobile phone provider.
83. 7:34So you can provide a phone number here and you  could say I want a text message, if it's a regular
84. 7:40mobile phone. Or if for some reason your trusted  phone number is an old landline phone you'd rather
85. 7:45get a phone call, an automated message that  would read you with a computer voice the actual
86. 7:52number to enter in. So this is your backup. So I'm  going to enter in a phone number, then Continue,
87. 8:00and I'll get the verification code to sent to  that number. This is to confirm I entered the
88. 8:06phone number correctly. This is a one time  code. So for instance you can see this code.
89. 8:12It doesn't matter. After I use it here it's not  going to be something that can be used again.
90. 8:17So now it's confirmed that, okay there'a  a valid backup way to receive codes.
91. 8:23So then you continue through the prompts here  to finish setting up Two-Factor Authentication.
92. 8:28So you can see your trusted phone number is  1. I can Edit and I can change that phone
93. 8:32number. Remove it. Add a second trusted phone  number as well. So I could definitely update
94. 8:39this. It's not permanent. If I do get a new  cell phone number I can then update this.
95. 8:44So as an example of using this  let's say you're at another person's
96. 8:48Mac or maybe a public computer and you want to  sign-on to your iCloud Account. So in this case
97. 8:53I'm not going to use the Apple ID that is setup  right here. I'm just going to say a different
98. 8:57ID so it's like I'm at somebody else's  computer. So I'm going to go and try to login
99. 9:07and then it's going to ask me for  the first factor. The password.
100. 9:14But now that's not enough. It needs two-factor. So  what's going to happen now is I will get a code,
101. 9:22either appearing automatically on my iPhone, so  if I have an iPhone registered to that Apple ID
102. 9:28automatically I would get a notification on  that phone and it would say, Do you want to
103. 9:33allow access to that computer, trying to  get into that account at this location.
104. 9:39I would say Yes and it would give me a  code. Then I would just type the code here.
105. 9:43This is a one time code so if you were to try  to use this code to get into that same account
106. 9:48it wouldn't work because it only works right  now at about 10:46 a.m. on this particular day.
107. 9:54I can say Trust or Don't Trust this router if I'm  on a public computer. I'll say Don't Trust. So
108. 9:59I will now be logged in but when I logout there  will be nothing left over for somebody else to try
109. 10:06to get in. So now I can access this account and,  you know, work with it here. The same thing would
110. 10:13happen in various other cases where you try to  get into your Apple ID or iCloud account. It could
111. 10:19even appear on other devices like an Apple TV if  you're trying to use that iCloud Account to access
112. 10:25content and on other types of devices as well.  Anything you're logging into your Apple ID with
113. 10:33you will have to enter in that second-factor.  But once you do then you should be logged in
114. 10:39depending upon whether you say Trust This Computer  or not. You should be logged in and not have
115. 10:44to enter it again for some period of time. So  it's not something where you constantly have to
116. 10:49enter it in. You should be just as often  as you have to enter in your Password.
117. 10:53So by using Two-Factor Authentication to get  into your Apple ID and iCloud Account makes
118. 10:58sense for all Mac users, you also want to use it  on all third party services. So let me show you
119. 11:05some examples of how to use it on third party  services. Everyone is going to be a little bit
120. 11:10different but let's look at doing it with a Goggle  Account and also doing it with an Amazon account.
121. 11:18First let's start by setting up a gmail  account. Now a gmail account is really just
122. 11:24a Goggle Account. So I'm going to sign-in here  to my Goggle Account using the ID and Password
123. 11:30that I already have setup. Next I'm going to  click on my User icon here at the top right
124. 11:37and then go Manage My Account and go to the  Security settings. If I look down the list
125. 11:44I'll find Two-Factor Authentication, although  they call it Two-Step Verification right here.
126. 11:51So I'll go and set this up and it's going to ask  me to sign-in again to make sure it really is me.
127. 11:58I'm going to start here by adding my mobile phone  number. So this is one way I can get that second
128. 12:03factor as a text message sent to me. Note that  I can also select a phone call which means that
129. 12:10I'll get an automated phone call and the number  would be read out to me by a computer generated
130. 12:16voice. So use this if you have a landline and no  mobile phone. Now to verify I entered my number
131. 12:23correctly it's going to immediately send me a text  message with a number. Now at this point what is
132. 12:28going to happen is a handy feature on macOS  will kick in to make things a lot easier for
133. 12:34me. The message will come into my phone and since  I get my messages on my phone and also on my Mac
134. 12:41then that text message is going to be recognized  by the system as one of these Two-Factor codes.
135. 12:47Then instead of having to go to the Messages  App, look at that number, return to this webpage
136. 12:53and type it in, it automatically allows me to  fill it in here. So you see this little prompt
137. 12:59and it saves me the time of having to look at  that number, memorize it for just a few seconds,
138. 13:03so I can type it in again. Now I can turn on  two-step verification and I've got that setup.
139. 13:10But there's a lot more that I can do. So if I  scroll down I can see that one of the things I
140. 13:15can get are backup codes. So what happens if I  loose access to my mobile phone number. Maybe I
141. 13:20change it because of a problem and they forget  that I need it to be able to get these codes.
142. 13:25Well, you can go and printout backup codes. There  are just ten codes that you can use one time each.
143. 13:32You can print them out or write them  down and put them somewhere safe.
144. 13:35In case of an emergency they can be  used instead of your two factor code.
145. 13:39So make sure you always do this when  a site offers it so that you have that
146. 13:44backup in case you loose access to whatever  device is giving you your two factor codes.
147. 13:51Another thing you can do is you can setup  your phone to tab an app on it to get these
148. 13:57codes without using text messaging at all.  So in the case of Goggle you can get an
149. 14:02app called Goggle Authenticator. So you can  go through the steps here and it gives you
150. 14:06this QR code. Then you want to go on your iPhone  to the App Store, look for Goggle Authenticator,
151. 14:13and get that app. Use the Plus button there and  then you can point your camera at that QR code on
152. 14:21your Mac screen and it automatically adds this to  a list there. Anytime you want you can now go to
153. 14:27this App and get the current code. It will change  every thirty seconds or a minute depending upon
154. 14:33the service and it's more secure because you're  not using a third party like a mobile phone
155. 14:39company to get your codes. You're just getting  it directly into this app and, of course, only
156. 14:45you would have access to this app because it's  on your phone which is locked with your passcode.
157. 14:50Here's another example of setting up Two-Factor on  an account. In this case it's an Amazon account.
158. 14:55So I'm already logged into an Amazon account here.  I go to Manage My Account and I look for Security.
159. 15:03Under that I'll find a Two-Step Verification
160. 15:09and it's actually going to perform a type  of two-factor authentication right here by
161. 15:12sending an email to my email account  associated with this Amazon account.
162. 15:17Then I have to click on a link in that email and  it takes me to this page where I could approve the
163. 15:23changes that are about to be made. So now to  setup Two-Factor Authentication and just like
164. 15:30with Goggle I'm going to provide my phone number  here and it's going to be able to send me a text
165. 15:35message. As soon as I do that it's going to send  a test text message. A lot of these services,
166. 15:41of course, want to send a test out to make sure  you answer the number right before it locks the
167. 15:45account down. With two-factor maybe you used the  wrong number. So I could see that I'm able to get
168. 15:53from the Messages App the number. It doesn't  appear right away but as soon as I start typing
169. 15:59you could see it picks it out and I don't have  to type the remainder of the number there. So it
170. 16:03makes it pretty easy to do. So here's what  it looks like to sign-in to Amazon now. Go
171. 16:08to Sign-In. Select my ID, my password. Those are  all saved to my Password Manager. Then I need the
172. 16:14two-factor code which is sent to Messages. I can  add that in there or manually type it if I want.
173. 16:21So you've seen some similarities and differences  between how Goggle and Amazon do this.
174. 16:26All other services are going to be kind of the  same. There's going to be some things that look
175. 16:30familiar and some things that are specific to that  service. So what you generally want to do is look
176. 16:36for your account settings, look for an area that's  dealing with Security or your Password. Then look
177. 16:43for something called Two-Factor Authentication,  Two-Step Verification, or something similar to
178. 16:48that. Then read carefully what's there. Some  sites will let you use your mobile phone number
179. 16:56to confirm with two-factor. Others may let you  use an email address to do it and they'll send
180. 17:01you an email message. Others will allow you to  use Apps like we saw the Goggle Authenticator app.
181. 17:08As a matter of fact many will allow you to use  that very same Goggle Authenticator App to do it.
182. 17:14Some services want you to use their own  mobile app. For instance, you can use an
183. 17:20app like the Facebook App to get codes  for logging onto Facebook on your Mac.
184. 17:26But you can also use other methods as well.  Many have backup codes that you can get and save
185. 17:32or print out as well. So make sure you look  for that. After you do it a few times with
186. 17:38a few different services you begin to  understand what to look for and how to
187. 17:43quickly enable Two-Factor Authentication so  it's in all of your most important accounts.