Why Your Business Email Needs 2FA
New forms of instant messenger apps might be snapping at email’s heels, but email is still most people’s primary online communication tool.
Think about how much sensitive information regularly passes through our inboxes. To fraudsters and cybercriminals, our email is a goldmine of contacts, facts, and figures.
Considering all the important information businesses of any size can send and store via email, securing these communications should be high on anyone’s list of priorities. Password-related cybercrime is on the rise, especially for those that don’t implement extra security.
Enabling two-factor authentication, a.k.a. 2FA, is near the top of the list security experts recommend to solopreneurs, micro-business operators, and Internet users.
With two-factor authentication (2FA), a separate one-time code is required to confirm one’s identity before logging in. It’s usually sent to you via SMS/text or separate email account, offering an additional and essential layer of security on top of your username and password.
Typically the 2FA code is a one-time short string of numbers but it can also include letters, and you simply enter this code in the fields provided before gaining access. When logging in to online accounts, 2FA can make most data thieves decide to skip out altogether on attacking you and head over to easier marks.
It’s why Namecheap now includes 2FA for free with all Private Email packages.
A (Very) Brief History of 2FA
There was a time when financial institutions were the only places that added this extra layer of security. But since the 2010s, online retailers, social media companies, and cloud storage providers have been under pressure to adopt two-step verification procedures because of the many times that username and password authentication proved insufficient.
Whether it was because people’s passwords were too easy to guess or because a breach on a company’s servers leaked their unencrypted credentials, time and again users saw their personal data accessed, stolen, and abused.
The single login with username and password had become inadequate to the task of protecting accounts. 2FA addresses these weaknesses in a much more elegant manner. It simply doesn’t matter if anyone else gets hold of (or guesses) your username and password. They still can’t get into your account or get at any sensitive information.
Changing Our Behavior
The pain for a bank and for its clients is obvious when their accounts get breached. Real, hard financial assets are on the line. The main reason for banks being around at all is to provide a safe place to keep our currency. So naturally, we agreed when they started putting measures in place to secure our holdings while continuing to make it possible for us to legitimately access them through convenient new technology.
But when it comes to our communications, our online storage, and our sharing sites, “set it and forget it” has become the ingrained practice. Providers had a strong incentive to make access to these vital services as frictionless as possible. Your devices remember your passwords for you and you enjoy convenient access ever after… until your password gets hacked.
Then personal details extracted from your communications may be leveraged by identity thieves, with costly reverberations for years to come. It’s all too easy to fool people when they think they’re simply replying to a friend or colleague.
Your hard-won online reputation may be also ruined by pranksters diverting or subverting your social-media presence. Or the hackers may hopscotch from one account to another, taking advantage of poorly designed account recovery mechanisms, leaving you locked out of services vital to your business. And all this is on top of any potential theft of sensitive information, such as bank and financial information.
What Types of 2FA Do We Provide?
Namecheap offers two leading options for securing Private Email accounts.
1. TOTP (Time based-One Time Password) – This is the most common method of 2FA. Verification usually happens based on something you ‘know’ and something you ‘own’. Meaning that you still enter your username and password (what you know) and then receive a one-time code to a device (the thing you own). As the name suggests, the codes are temporary and you only have a certain timeframe to enter the code.
2. U2F (Universal 2nd Factor) – Here you don’t need to type in codes on your device. This technology uses a small, specialized USB or NFC device like Yubikey that contains your encrypted information.
The same authentication app or U2F key will work with the many other services that now support these methods of 2FA. Once you’ve configured your device to work with Private Email, you will authenticate yourself with your username and password, and then prove you’re the legitimate owner of the account with a tap on the device.
Can I set 2FA up if I already have Private Email?
Setting up 2FA is a very easy process, and once you’ve got it in place, even easier to use. Take a look at our easy Knowledge Base guide: How to enable 2FA on Private Email. Simply follow the simple steps on how to get started with both TOTP and U2F.
The services that allow you to use 2FA are all around us both at home and at work. Consider setting up and implementing 2FA as part of your natural work-flow. Securing your personal and business messaging is a must in today’s online world.