The Honan Hack Is The Alamo For Two-Factor Authentication

Writers digital life wipe is bringing two factor authentication to the forefront

By now I hope you have read about the devastating hack of Wired writer Mat Honan. It serves as a chilling example of how much of our lives are entrenched in the digital sphere today and what can happen if the keys to that sphere fall into the wrong hands. Reading Honan's story, I was of course empathizing with him because of my own nightmare with passwords being hacked. In fact, I just wrote yesterday about my Twitter account being hacked, but so far that seems to be an isolated minor irritant.

RELATED: My Twitter Account Was Hacked! It Can Happen To You Too

Retelling a Password Nightmare in the Wake of the LinkedIn Password Leak

The thing about Mat's story, though, is that his passwords weren't hacked here. They were allowed to be changed because of some social engineering by the hackers convincing Apple, Amazon and Google to allow them to change the passwords for Honan's accounts there. It is amazing that what Amazon makes available (the last 4 digits of a person's credit card) is exactly the same information that Apple required to allow someone change their iCloud accounts. Of course, Apple says they are changing this now, but that doesn't do Mat much good.

Again, read Mat's story and realize how easy this can happen to you. They didn't go after Mat because of who he is, they just liked his Twitter name and wanted to get control of it. It can happen to any of us. Matt's only fault seems to be that he used the same name for all of his accounts. Probably most of us do too. But what else can we do?

That is the real lesson of the Mat Honan story. For far too long the security industry has said we need more than passwords. Using passwords and asking the same security questions (mother's maiden name, first pet, favorite movie - if you're a guy, is it the Godfather?) is just not a great way of protecting what has become a vital and irreplaceable part of our lives and fortunes. Two-factor authentication has been around a while now. While it is not perfect (see: last year's RSA hack of their token technology), it represents a quantum leap over single-factor authentication. Using SMS messages to your phone may be the best of these. We all have cellphones that are around us just about constantly. The only thing I can see messing this up is if somehow you lost your phone too.

Mat himself says that this whole ordeal could have been possibly avoided if he would have turned on two-factor authentication on his Google Gmail account. It is an easy thing to do. I did it myself this morning. Go to this Gawker article and follow the links to enable Gmail and Google account two-factor authentication. While you are at it, go through all of the devices and apps that you have authorized to use your Google account settings. Just as with the Twitter experience I went through the other day, I was amazed how linked in (no pun intended) my Google account was to many of the other services I use.  

After setting up two-factor authentication in Google, next go to Facebook and do the same thing. The Gawker article has the link for that as well. Once you do, again take the time to see what devices and location have logged in to your Facebook account. Once again, I was blow away. Even scarier, I saw two or three log ins to Facebook from places and devices I did not recognize. That was scary. I went in and changed my Facebook password for good measure as well.

Finally, another lesson from Mat's misadventure is that backing up your data only to the cloud is only as good as the security of your cloud identity. If they can break into the service, they can wipe out your data. So maybe keeping an old-fashioned on-premises backup of both your company and personal account is still a wise move.

I was really sorry to see what happened to Mat here. Reading about the reasons one of the hackers who did this to him had for doing it made it seem like a senseless crime to me. I empathized with Mat after what happened to me. At the end of the day, if enough people adopt two-factor authentication and it finally reaches a critical mass as the normal way to secure your accounts, the good news is that Mat's hacking did not happen in vain.

Remember Honan's hack and install two factor authentication now!

• Security

• Identity Management

• Unified Communications

• Cloud Computing

• Alan Shimel

• Amazon

• Apple

• authentication

• Gmail

• honan

• passwords

• wired