Two-Factor Authentication (2FA)
Two-factor authentication (2FA) is a security mechanism that requires users to provide two separate forms of verification before accessing an account: something they know (password) and something they have (a code from an authenticator app or hardware key) or something they are (biometrics).
Understanding Two-Factor Authentication (2FA)
Passwords alone are increasingly insufficient for account security. Data breaches expose passwords, phishing attacks steal them, and credential stuffing attacks try stolen passwords across many services. Two-factor authentication adds a second layer that an attacker would need to compromise separately. Even if your password is stolen, an attacker cannot access your account without also having your second factor. Common second factors include TOTP authenticator apps, SMS codes, hardware security keys, and biometrics. Authenticator apps and hardware keys are significantly more secure than SMS codes, which are vulnerable to SIM-swapping attacks.
How GAIA Uses Two-Factor Authentication (2FA)
GAIA supports two-factor authentication for user accounts and encourages its use for all connected service accounts. When connecting sensitive tools like Gmail and Slack through OAuth, GAIA's integrations work correctly alongside 2FA-protected accounts without requiring 2FA to be disabled. Enabling 2FA on your connected accounts protects against unauthorized access to the data GAIA can access.
Related Concepts
Single Sign-On (SSO)
Single sign-on (SSO) is an authentication mechanism that allows users to log in once with a single set of credentials and gain access to multiple connected applications without re-authenticating for each one.
OAuth
OAuth (Open Authorization) is an open standard for delegated authorization that allows a third-party application to access a user's data in another service without requiring the user to share their password.
Password Manager
A password manager is an application that securely stores, generates, and autofills passwords and other credentials, enabling users to maintain unique, complex passwords for every account without memorizing them.
Phishing
Phishing is a cyber attack that uses deceptive emails, messages, or websites to trick recipients into revealing sensitive information such as passwords or financial data, or into taking harmful actions.
