Choosing the Right Authenticator App

Yesterday, someone cloned my wife's Facebook profile. It got taken down quickly, but the incident prompted me to check my Facebook privacy and security settings. One of the changes I made was to set up two-factor authentication (2FA), using Google's Authenticator app.

I used that option because I've had it on my phone for a while and have it set up on my Google account. But is it the best choice?

Ed Bott, who knows far more about Windows and computer security than I ever will, has written an article for ZDNet on how to choose the best authenticator app. He discusses Google's and Microsoft's apps and a third-party app called Authy.

Adding multi-factor authentication (often called two-factor authentication, or 2FA) to high-value online accounts is probably the single most important security precaution you can take. It takes just a few minutes to set up, and the result is a layer of protection that will prevent intruders from intercepting your email, stealing funds from your bank account, or hijacking your social media.

In this post, I describe the most basic form of 2FA, which uses an authenticator app installed on a mobile phone to provide a secondary form of proof of identity when necessary. In that case, the two factors are the classic "something you know" (your sign-in credentials) and "something you have" (the mobile device that you've configured with a shared secret). The combination of those two factors sets the proof-of-identity bar high enough that your average thief won't be able to get over it.

If you haven't set up 2FA for at least your critical accounts like Microsoft, Google, and Facebook, this article offers good advice on why you should and how to do it.