2-Factor Authentication (2FA) is a key security feature for online accounts that has been largely neglected due to the difficulty and tedious nature of its operation. 2FA refers to the two factors required to authenticate with an online service. One factor is typically something a user knows, such as a login and password. A second factor is something a user has, such as a mobile device with an app such as Google Authenticator or Authy. This second factor prevents unauthorized access to an account by an attacker that has the correct username and password, but does not have the user’s device.
We’ve accomplished this simplicity by basically merging the functionality of Google Authenticator into Airbitz. Upon enabling 2FA, the Airbitz app will share a random token with the Airbitz servers. Instead of copy and pasting a 6 digit PIN every time you want to login, Airbitz will simply generate a one time use password from the shared token, and send it with each server interaction. This effectively ties your account to your current device.
Should the user lose their device, they can still attempt a login using another device and request a 2FA reset. The reset will require 7 days, during which, a notification will be sent to the device of the user to prevent a fraudulent reset. This leaves one question, why aren’t you using two factor authentication for all of your online services?
Here’s a video that shows our 2FA in action.