What is 2FA?
Two-factor authentication (also known as 2FA) is a security measure that requires users to submit a form of verification in addition to their traditional username and password. This method of authentication provides a second layer of user account security. 2FA is often presented as a code that is given to users who then confirm the code they’re given with the code the website is expecting. These codes are usually temporary and only good for single use, meaning a new code is required every time a user attempts to access their account. The most common methods of 2FA are email, SMS, and through a mobile authenticator app. Dropil recommends using Google Authenticator to secure your account. Email: Email authentication is a very common method used to secure user accounts. It is convenient and can come in the form of a specific code or a link that users can click to confirm. This method does not require a specialized app or mobile phone. There are some drawbacks to this method, as email accounts can be insecure. If a user’s email account is compromised, their 2FA code will be known, and their other accounts will be insecure.
SMS: SMS (also known as text message authentication) is a form of 2FA where a code is sent from a website to a cell phone and then entered into a website. This method of 2FA is not recommended for a number of reasons. Text messages are vulnerable to attacks such as text message interception or SIM swap attacks. In these instances, text messages can be rerouted away from a user’s phone and to an attacker’s.
Mobile authentication apps: Mobile phone applications such as Google Authenticator are the most highly recommended form of 2FA and considered to be the most secure. With this type of authentication, bad actors would need access to a user’s mobile phone in order to verify their 2FA code. These codes reset every 30 seconds and can only be viewed from within the app one device. This type of authentication comes with a secret seed phrase which users need to write down should their phone break or need to be restored. Without this seed phrase, users will be unable to restore their 2FA settings.
Why is 2FA important?
2FA is an important aspect of user security that safeguards accounts more than a traditional username and password combination alone. An account with 2FA enabled would be inaccessible without the confirmation code even if the username and password were entered correctly. There are numerous ways that simple usernames or passwords could be compromised especially for users with the same credentials on multiple websites, but with a secondary form of verification that is constantly changing and different across every website, you can secure your accounts from these compromises.
What types of 2FA does Dropil offer?
Dropil currently offers both email and authenticator 2FA. Users have the choice to require 2FA on login, Dex cancellation, and when changes are made to Dex settings. For security purposes, 2FA is required for withdrawals to be processed and cannot be disabled. These options can be set up under user account settings in the Dropil portal.
Things you need to enable 2FA
A mobile phone with a Google Authenticator app or Authy (recommended). Your phone does not need to be connected to the internet to generate a code each time. Alternatively, you can enable 2FA authentication through email. You will receive your authentication code via email each time. However, this method is considered less than ideal since if your email is compromised so will your email 2FA code.
How to enable 2FA on Dropil
- Within your account settings, there is a “2FA” section.
- You will need to select your preferred method of 2FA and input your password.
- We are going to enable Google/ Authy 2FA and use the Google Authenticator application
- On the Google/ Authy 2FA set up screen you will need to save your 16 digit authentication key. If for any reason you need 2FA removed from your account Support will request the secret key.
DISCLAIMER: By checking the above checkbox, you agree that you have written down your 16-digit key and put it in a safe place. If your device is lost, stolen, or broken, you will need this key to get back into your account! If the key is lost, your account will be lost permanently. This key is displayed only once.
- Click the checkbox confirming you have saved the secret code
- Scan the QR code with your Google authenticator/ Authy app.
- The app will store the account and provide you with a six-digit code that will need to be entered into the text box.
- Click “Activate Two Factor Authentication”
- Now you will select the options you would like to require 2FA, Dropil recommends you enable all four options.
Require on login
Require on Dex cancellation
Require on Dex settings updates
Require on withdrawals ** REQUIRED
Congrats, you have now Set up Google 2FA on your Dropil account.