Two-factor authentication: why Twitter and Google need to educate users

Most social media users across the globe are not aware of two-factor authentication or how it operates, a survey reveals

Google and Twitter have increased their security, but the measures they have put in place are only going to work if their users understand them fully. Photograph: Bethany Clarke/Getty Images

Recent events can validate that online security breaches of social media accounts are becoming more frequent and extreme. In an effort to combat security threats, many internet companies such as Facebook, Google, LinkedIn and Twitter have upped the priority level to integrate a method of security to protect their users.

Of the solutions available, many are turning to SMS-based mobile authentication to augment their existing systems. An obvious choice, SMS-based two-factor authentication (2FA) is so appealing because of its user friendly nature, economic cost structure and security effectiveness.

However, despite acknowledged security concerns over social media, high levels of account hacking and theft of personal data, the general public are slow to accept the move to SMS-based 2FA. As a method to substantiate our own understandings, we at Tyntec conducted a survey along with YouGov that focused specifically on consumers and their perceptions regarding security measures for their social and online accounts.

The overlying theme of this survey: most social media users across the globe are simply not aware of two-factor authentication or how it operates. In many cases, it may have been positioned as a helpful tool to keep track of lost usernames or passwords, or presented under an alternate guise than what it was truly intended for.

This point is well made in answer to the question: "Do you know what 2-factor authentication or 2-step authentication is?" 77% of respondents in the UK said that they do not understand the term. The replies were remarkably consistent in other parts of the world too – 79% in Russia, 78% in Brazil and 72% in the US.

Although Google and Twitter have increased their security levels, the measures they have put in place are only going to work if their users understand what the process involves and why their mobile phone number is being requested.

If you dig deep into Twitter's FAQ webpage you will eventually findinformation on login verification but the content is well-hidden and probably not something your average social media user would think to research. More needs to be done by these social media networks and internet companies to start educating the likes of Joe Blogs on what 2FA is all about and how a simple SMS can provide an additional layer of protection to their accounts.

SMS-based mobile authentication involves a user sharing their mobile number with an trusted internet company so that when they login they are sent a text message with a one-time password (OTP), which they must utilise to complete the login attempt successfully. However, the issue we have here is that multiple generations of mobile phone users have grown up being suspicious of having to share their private contact details. They are wary that if they reveal their telephone number then they might be subjected to cold-calling, spam text messages or be used for marketing or other non-security related purposes. To many people, a mobile number is considered to be a "personal identifier" which contains or acts an entry point to highly sensitive information.

To quantify this, YouGov's survey revealed that only 12% of UK and 11% of US respondents are willing to share their mobile number with online application providers to add an additional security feature on their individual social media accounts. Specifically in the UK, 16% of men and only 8% of women would share their mobile number willingly.

The consumers have spoken and clearly indicate that for a security method such as SMS-based mobile authentication to take hold, internet companies need to retool their messaging to their end-users on how easy it can be to increase security on their social accounts.

Along with that comes the caveat that they must hold themselves accountable for only using mobile numbers to authenticate identity and nothing else. The loyalty of the customer is already demonstrated in their willingness to use products and apps developed by internet companies. So the onus is now on these companies to educate their customers about their loyalty to them in terms of information protection and security.

It's fair to say that 2FA does not have to be just SMS-based, there are other methods. However, the creation and deployment of specialist smart card readers or even paper code lists are a significant investment, which is why more and more companies are looking to SMS-based mobile authentication as the preferred solution.

Twitter, Google and others have deployed SMS-based mobile authentication as a free tool for consumers, presumably because of its easy-to-integrate potential, but also as a means to balance the cost against the reputational and economic damage that can be caused by security breaches.