Endpoint

11/7/2017
02:40 PM
Connect Directly
Twitter
LinkedIn
Google+
RSS
E-Mail
50%
50%

Less Than One-Third of People Use Two-Factor Authentication

The number of 2FA users is still lower than expected, but most adopters started voluntarily, researchers found.

The adoption rate for two-factor authentication (2FA) is even lower than expected: 28%. But on the bright side, those who use it report that they started 2FA voluntarily.

Researchers at Duo Labs hypothesized the majority of the US doesn't use 2FA. Their results were confirmed in a survey designed to measure both adoption of 2FA and users' perceptions of it. More than half of 443 participants had not heard of 2FA prior to taking the survey.

More than half (54%) of the 126 people who use 2FA were voluntary adopters, which took researchers by surprise. They had expected involuntary adopters would be this high, with the assumption that most people began using 2FA because their employers required it. However, results proved them wrong: only 20.8% of respondents learned about 2FA in the workplace.

"Initially, [20.8%] was surprising, but we realized that it seems reasonable," says Kyle Lady, senior R&D software engineer at Duo. "Consumer financial services have offered SMS-based authentication for many years, and services such as Gmail and Facebook occasionally prompt users to enable security features."

Less than half (45%) of people who employ 2FA use it across all the services that offer it. Those who only use 2FA for some apps and services explain their use with three popular answers: they are required to use 2FA, it's easier to enable 2FA on certain websites and apps, or certain websites and apps hold data they want to protect.

While it's easy to understand why people want to safeguard sensitive data, Duo data scientist Olabode Anise says the ease-of-use factor is critical.

"The finding that ease of setup was a major factor in 2FA use underscores the importance of making it as easy as possible for users to get into a desired state of security," he explains.

Most people (85.8%) prefer email or SMS for 2FA. This wasn't a surprise: many websites and applications offering 2FA have SMS as a default option. Researchers hope any future change points to a decline in SMS use, as it has become easier to social-engineer wireless carriers into forwarding text messages to another SIM card, or intercept messages via fake cell towers.

At 9% adoption, 2FA via security key was the least common method, which was understandable as security keys are the youngest 2FA technology. Adoption of authenticator apps increased as well, from 46% in 2010 to 52% in 2017. Hard tokens decreased from 38% to 19%.

Interestingly, 84% of people reported hard tokens were the most trustworthy form of 2FA. However, they did not agree hard tokens were more secure than a username and password.

"We view the distinction between trustworthy and secure as a focus on reliability," says Lady. "Users have great confidence that hard tokens will work, but they recognize that there are risks, such as losing them."

Email-based authentication is perceived as secure because it arrives in users' inboxes, but it's less trustworthy because emails commonly disappear or take a long time to arrive.

2FA via push notification ranked highest for user perception. Users reported it was the least frustrating and required the least concentration, plus instructions were not needed to use it.

Researchers also dug into where people most frequently use different methods of 2FA. Email/SMS is the most popular method in work environments at 29%, followed by authenticator apps (21%), and hard tokens (15%). More specifically, it's also the most common form of 2FA in the financial industry (45%) and in healthcare (31%).

Related Content:

Join Dark Reading LIVE for two days of practical cyber defense discussions. Learn from the industry’s most knowledgeable IT security experts. Check out the INsecurity agenda here.

Kelly Sheridan is the Staff Editor at Dark Reading, where she focuses on cybersecurity news and analysis. She is a business technology journalist who previously reported for InformationWeek, where she covered Microsoft, and Insurance & Technology, where she covered financial ... View Full Bio

Comment  | 
Print  | 
More Insights
Comments
Newest First  |  Oldest First  |  Threaded View
Higher Education: 15 Books to Help Cybersecurity Pros Be Better
Curtis Franklin Jr., Senior Editor at Dark Reading,  12/12/2018
Worst Password Blunders of 2018 Hit Organizations East and West
Curtis Franklin Jr., Senior Editor at Dark Reading,  12/12/2018
2019 Attacker Playbook
Ericka Chickowski, Contributing Writer, Dark Reading,  12/14/2018
Register for Dark Reading Newsletters
White Papers
Video
Cartoon Contest
Current Issue
10 Best Practices That Could Reshape Your IT Security Department
This Dark Reading Tech Digest, explores ten best practices that could reshape IT security departments.
Flash Poll
[Sponsored Content] The State of Encryption and How to Improve It
[Sponsored Content] The State of Encryption and How to Improve It
Encryption and access controls are considered to be the ultimate safeguards to ensure the security and confidentiality of data, which is why they're mandated in so many compliance and regulatory standards. While the cybersecurity market boasts a wide variety of encryption technologies, many data breaches reveal that sensitive and personal data has often been left unencrypted and, therefore, vulnerable.
Twitter Feed
Dark Reading - Bug Report
Bug Report
Enterprise Vulnerabilities
From DHS/US-CERT's National Vulnerability Database
CVE-2017-1265
PUBLISHED: 2018-12-17
IBM Security Guardium 10.0, 10.0.1, 10.1, 10.1.2, 10.1.3, 10.1.4, and 10.5 does not validate, or incorrectly validates, a certificate. This weakness might allow an attacker to spoof a trusted entity by using a man-in-the-middle (MITM) techniques. IBM X-Force ID: 124740.
CVE-2017-1272
PUBLISHED: 2018-12-17
IBM Security Guardium 10.0 and 10.5 stores sensitive information in URL parameters. This may lead to information disclosure if unauthorized parties have access to the URLs via server logs, referrer header or browser history. IBM X-Force ID: 124747. IBM X-Force ID: 124747.
CVE-2017-1597
PUBLISHED: 2018-12-17
IBM Security Guardium 10.0, 10.0.1, 10.1, 10.1.2, 10.1.3, 10.1.4, and 10.5 Database Activity Monitor does not require that users should have strong passwords by default, which makes it easier for attackers to compromise user accounts. IBM X-Force ID: 132610.
CVE-2018-1889
PUBLISHED: 2018-12-17
IBM Security Guardium 10.0 and 10.5 is vulnerable to cross-site scripting. This vulnerability allows users to embed arbitrary JavaScript code in the Web UI thus altering the intended functionality potentially leading to credentials disclosure within a trusted session. IBM X-Force ID: 152080.
CVE-2018-1891
PUBLISHED: 2018-12-17
IBM Security Guardium 10 and 10.5 is vulnerable to cross-site scripting. This vulnerability allows users to embed arbitrary JavaScript code in the Web UI thus altering the intended functionality potentially leading to credentials disclosure within a trusted session. IBM X-Force ID: 152082.