Best Authenticator Apps for 2022
Passwords alone do not provide enough protection to secure your online bank account or social media accounts, as we’ve seen in recent leaks and attacks. Two-factor authentication (also known as multifactor authentication or 2FA) offers an extra layer of security, and Tyxod Blog authors routinely encourage our readers to adopt it. One of the more secure versions of 2FA is enabled via authenticator applications like Authy, Google Authenticator, or Microsoft Authenticator. Using one of these programmes can even protect you from sneaky threats such as stalkerware.
What Is Two-Factor Authentication?
As the name says, it’s just adding additional factors to your password to get access to your online account or app. Authentication elements are divided into three categories, according to experts: something you know (a password, for example), something you have (a physical object), and something you are (a fingerprint or other biometric trait). When you utilise one of the authenticator applications listed here, you use your token, smartphone, or wristwatch to supplement the password you already know.
What Type of Two-Factor Authentication Is Best?
Yes, you may use MFA by having your banking site give you a text message with a code that you then enter to obtain access to the site. However, it turns out that this isn’t the greatest method for implementing 2FA. A flaw in SMS communications was recently discovered, allowing criminals to redirect text messages. An authenticator app on your phone creates codes that never travel over your mobile network, avoiding the risk of exposure and compromise.
Authentication is set up under the two-factor or multifactor authentication area of a site’s security settings page—nearly every financial site has this option. Our piece, Two-Factor Authentication: Who Has It and How to Set It Up, explains which sites provide multifactor authentication solutions. There, you may learn how to set up two-factor authentication for a variety of businesses, from Amazon to Yahoo.
Most websites include a simple SMS code option but search for authenticator app support as well. Scanning a QR code on the site with your phone’s authenticator app is normally how 2FA is set up. If you desire a backup, you can scan the code to more than one phone. You should also remember the account recovery codes issued by the websites and keep them safe, such as in a password manager.
What Are Authenticator Apps and How Do They Work?
After that, every time you log into the site from an unfamiliar device, you’ll have to launch the Authenticator app, unlock it, and locate the site’s entry. The time-based, one-time passcodes (TOTP or OTP) generated by authenticator applications are six digits that change every 30 seconds. You type or paste this into the secure app or website, and you’re in. The time restriction ensures that even if a thief obtains your one-time passcode, it will no longer operate after 30 seconds.
Using a standard HMAC-Based One-Time Password (HOTP) technique sanctioned by the Internet Engineering Task Force, the codes are formed by doing some arithmetic on a lengthy code transmitted by that QR scan and the current time (IETF). These applications don’t have access to your accounts, and they don’t connect with the site beyond the first code transmission; they simply and ineptly produce the codes. They don’t even require phone service to function.
Because both companies’ protocols are normally built on the same standard, you might use Microsoft Authenticator to get into your Google Account or vice versa. Microsoft Authenticator, on the other hand, offers simple login choices for Microsoft services including Office, Outlook, and OneDrive.
What to Look for in a Mobile Authenticator
When picking one of these applications, make sure it backs up your account information (encrypted, of course) in case you lose the phone you used to set things up. This is available in Authy, Duo Mobile, LastPass Authenticator, and Microsoft Authenticator, but not in Google Authenticator.
Android blocks anybody from capturing screenshots while an authenticator app is active, although iOS allows it. This is a security triumph for Google’s mobile OS.
You could use a dedicated device like YubiKey to implement MFA for even more thorough security. These devices generate codes that can be transmitted via NFC, Bluetooth, or by directly plugging them into a USB port. These gadgets, unlike smartphones, offer the benefits of being single-purpose and security-hardened.
It’s possible that malware-infected software on your phone may intercept the authentication codes generated by the phone’s authenticator app, however, this is improbable. Security keys don’t require an internet connection and don’t require batteries or moving components, but they’re not as handy to use as your phone.
For even greater convenience, Authy and Microsoft Authenticator also have Apple Watch applications, whereas Google Authenticator and LastPass don’t. With around 36 million WatchOS devices expected to be sold in 2020 (14 million more than Apple Mac PCs), it’s a convenience that a lot of people will appreciate.
To summarise: (1) Multifactor authentication should be used for all of your online accounts. (2) Authenticator applications are more secure than SMS codes in terms of security. (3) Review our summary of the most popular authenticator applications and begin setting up your accounts with the one that appeals to you. Finally, let us know what you think about these applications and the security risks they raise in the comments section below.
Duo Mobile is aimed at business apps, especially now that it’s a Cisco product. In addition to the one-time passcodes stated above, the app has business capabilities such as multi-user deployment options and provisioning, as well as one-tap push authentication.
On Android, you can’t screenshot the Duo interface, which is a wonderful security feature (but you can on iOS). Duo Mobile may be backed up via Google Drive for Android and iCloud KeyChain for iPhone.
The authenticator app from the search engine giant is simple and lacks other features. Unlike Microsoft Authenticator, the Google Authenticator software does not provide any extra features for its own services, nor does it provide backup or password generation and administration.
Rather than utilising the Authenticator app, Google appears to be more interested in letting you set up two-factor authentication using built-in Android capabilities. It is more convenient to use an Android phone for 2FA with a Google account (rather than the Google Authenticator app) because it only requires tapping on the phone rather than typing a six-digit number.
Google Authenticator, unlike Authy, does not offer online backup for your account codes, but you may transfer them from an old phone to a new one if you have the former. The fact that Google Authenticator does not have an Apple Watch app is a small worry.
This is not the same as the LastPass password manager software, however, it does have some synergy with the password functionality of the more well-known tool.
LastPass Authenticator is simple to install, and if you already have a LastPass account with a multifactor authentication set, you may authorise LastPass simply by pressing a push message. It’s also simple to build a backup of your authenticator accounts in your LastPass vault once the app is linked to your LastPass account. This takes some of the stings off of switching phones.
Microsoft’s entry now features safe password creation as well as one-button access to Microsoft accounts. Schools and organisations that utilise the Authenticator app can now register users’ devices. If you use the app, account recovery is a crucial feature that you should enable. That way, when you obtain a new phone and install Microsoft Authenticator, you’ll be prompted to sign in to your Microsoft account and provide further verifications.
One difficulty here (and it’s an Apple lock-in issue) is that if you’ve backed up to iCloud, you won’t be able to move your stored 2FA accounts to an Android device, because the iPhone version requires iCloud. Microsoft Authenticator adds an extra layer of protection: To see the codes, you may need to unlock your phone using a PIN or biometric verification.
ALSO READ: Best electric toothbrush to buy in 2022
Password management is accessible through a separate tab at the bottom of the page. Simply sync with the Microsoft account you linked to the authenticator, and you’ll be able to view all of the logins you’ve stored and synchronised from the Edge browser. Additionally, you may utilise Authenticator on your phone as a password filler/saver.
When you initially set up Authy, unlike the other applications in our mini-roundup, it asks for your phone number. We don’t like this requirement since we’d want the app to treat our phones as anonymous bits of hardware rather than as a source of personally-identifying information.
Some have also claimed that this exposes the app to SIM-card switch fraud. The Authy Help Center has a fix for this, but we’d like it just to operate like the rest of the applications and didn’t require a phone number. Apple Watch owners will welcome the fact that there is an Authy app for their favourite timepiece.