1. Security Problems Are Getting Worse
As the internet permeates every layer of life, we depend more and more on various online IDs. These IDs make up our digital selves and are extremely important account assets.
On the other hand, account information leaks and security incidents happen from time to time: CSDN, 12306, Huazhu Hotels, Facebook, Twitter, Uber… the list goes on. What is even more frightening is that these are only the disclosed, publicly reported account information leaks. Beneath the surface of the iceberg, there may be far more information leaks.
The domestic internet today seems to care more about sharing information than about isolating it from one another. This has fueled the continued prosperity of the big data industry.
Ignoring personal privacy is not a healthy way for the internet to develop. System security and information security deserve adequate attention. After all the chaos and wild growth, a period of rule-making is bound to follow, and the security field has a great deal of room to grow in the future.
2. Password Basics
- The password is long enough, usually more than 8 characters
- The password is complex enough, containing upper and lower case letters, digits, and special characters
- Use a different password for each website
- Change passwords regularly
3. Password Management Platforms
Passwords are too complex and too numerous to remember, which creates a need for users to manage their account passwords.
Password management platforms, through automatic cloud synchronization, let users remember just one master password and then enjoy auto-fill, secure notes, and password sharing with friends anytime and anywhere, with no limit on the number of devices. Common platforms include 1Password and Lastpass, both of which offer extremely powerful plugins that support Windows, OS X, IOS, Android, and other platforms.
Using these password management platforms, users can set sufficiently complex account passwords without needing to memorize them, balancing both security and convenience.
But can the information in a password management platform itself be leaked? Lastpass was in fact once hacked. In reality, using a password management platform means concentrating all the leak risk into that platform. Once the platform’s security can no longer be guaranteed, users will face enormous losses.
4. The Principles and Methods of Account Verification
Account verification is, in effect, about proving that what is yours is indeed yours. Common approaches include:
- Private information
A piece of information that others do not know. For example, a password, an image, a file, a URL, recent purchases, or a home address can all serve as a verification medium.
- Something you carry
A physical entity that only you can have. For example, a USB key (U-shield), an electronic security card, an IC card, a phone, or an ID card. Compared with private information, the security of a carried item is much higher, essentially guaranteeing uniqueness.
- Biometric traits
A fragment of biometric information that only you possess. For example, fingerprints, the iris, or DNA.
Account verification is essentially just comparing whether two pieces of information match, but it needs to balance two cores: convenience and security. A convenient verification method requires being easy to remember, easy to carry, always available, and replaceable if lost. A secure verification method requires more complex and longer verification information.
5. What Is Two-Factor Authentication
Two-factor authentication, abbreviated 2FA, adds another layer of security protection on top of ordinary verification.
After enabling two-factor authentication, logging into an account requires an additional, dynamically generated random string.
Today, more and more websites support two-factor authentication, and there are more and more ways to display the verification code. SMS, email, software tokens, and so on are all very common channels.
Currently, the more mainstream two-factor authentication strategy is the one-time password based on a timestamp algorithm, Time-based One-time Password, abbreviated TOTP. Common two-factor authentication apps such as Google Authenticator and Authy use the TOTP algorithm.
The basic principle of the TOTP algorithm is: the server side generates a key and then sends it to the phone side. The phone side uses the key and the timestamp to generate a hash value. Within a period of time, the hash values generated by the phone side and the server side using the same key are identical. The hash value is calculated by the formula:
| |
- unixtime(now), the current Unix timestamp
- unixtime(T0)), the agreed starting time, which defaults to 0
- TS, the length of the validity period
