A second lock on your apps

Cartoon

Evening. After what happened to Greg, Max talks his mom into turning on a "second lock" for her email and chat apps.

Max: Right now you have one lock: your password. The second lock is a confirmation on your phone. Without your phone, nobody can get in, even if they know the password.

Kate: Settings, then "Security", then "Sign-in confirmation". It’s on. That took a minute!

A month later, Kate’s password leaked along with a list of users stolen from some website. The crook types in her email address and password…

Kate: I’m not signing in anywhere! I’m tapping "It’s not me".

The crook has the password, but he can’t get in. The second lock stayed shut.

Max: Now change your password, since it leaked. And remember: if you’re asked to confirm a sign-in and you aren’t signing in, it’s always "It’s not me". And never read the confirmation code out to anyone.

The second lock takes a minute to turn on and protects you for years. Start with your email.

Exercise: what do you tap?

Six times Kate got a confirmation or a request. For each one, decide: is it dangerous or not?

• Email: «Someone is signing in to your email from a new device. Is this you? [It’s me] [It’s not me]» — Dangerous. Kate isn’t signing in, so a stranger is. Tap "It’s not me" and change your password.
• Email: «Sign-in from a new device. Is this you? [It’s me] [It’s not me]» — Safe. Kate is signing in herself, so it’s fine to confirm.
• Call: "email support": «We see a suspicious sign-in. Tell us the confirmation code, and we’ll block the intruder.» — Dangerous. That code is the second lock. Say it, and you open the door yourself.
• Bank app settings: «Turn on sign-in confirmation with your fingerprint or face?» — Safe. That’s exactly the second lock. Turn it on.
• Message: "security team": «Due to an update, turn off sign-in confirmation in your settings, or your email will be deleted.» — Dangerous. If someone asks you to remove the second lock, they want to get in. Don’t turn anything off.
• Email: «Is this you signing in? [It’s me] [It’s not me]» — Dangerous. The crook hopes you’ll get tired and tap "It’s me". Tap "It’s not me" and change your password.

What to remember

• The second lock is a sign-in confirmation on your phone. Without it, your password is useless to a crook.
• Turn it on for your email, your bank and your chat apps: "Settings" → "Security".
• If you aren’t signing in and you’re asked to confirm, tap "It’s not me".
• Never tell anyone the confirmation code, and never turn anything off because someone asked you to.

Questions

What is a "second lock" when signing in?

• A second password you have to remember
• A sign-in confirmation on your phone
• A lock on your front door

Even if a crook knows your password, he can’t get in without your phone.

You get "Is this you signing in?", but you didn’t do anything. What do you tap?

• "It’s me", so the notice goes away
• Don’t tap anything
• "It’s not me", and then change your password

Someone knows your password. Don’t let them in, and change the password.

You’re asked to turn off sign-in confirmation "due to an update". This is…

• An ordinary request
• A scam: they want to remove your second lock
• Something you must do, or everything gets deleted

Real services never ask you to remove your protection.

Where should you turn on the second lock first?

• Your email: through it, someone can reset all your other passwords
• A game on your phone
• Nowhere, it’s not needed

Your email is the master key. Then your bank and your chat apps.