Turn on two-factor authentication for your cloud account today

Your cloud storage account probably holds the most irreplaceable things you own in digital form: photos, scanned documents, years of work. The only thing between all of that and anyone on the internet is your password. If that sounds thin, it is.

Two-factor authentication, usually shortened to 2FA, adds a second check at sign-in. It takes a few minutes to set up and it defeats the most common way accounts are taken over. This article explains what it is, why it matters for storage in particular, and exactly how to turn it on and not lock yourself out.

How accounts actually get taken over

Attackers almost never guess passwords. They get them in bulk from other services that were breached, then try the same email and password combinations everywhere. If you have ever used the same password on two sites, and one of those sites was breached, your password is in a list somewhere being tried against every service that exists.

The second route is phishing: a convincing email leads to a convincing fake sign-in page, you type your password, and it is gone. This works on careful people. Everyone is tired sometimes.

In both cases the attacker ends up with your correct password. Two-factor authentication is built for exactly this situation. The password is correct, and it is still not enough.

What the second factor is

The first factor is something you know: the password. The second is something you have: usually your phone.

The most common form is an authenticator app. You install one on your phone, link it to your account once by scanning a code, and from then on it shows a six-digit number that changes every thirty seconds. When you sign in, you type your password and then the current number. An attacker with your password does not have your phone, so they cannot produce the number, and they are stopped.

Any standard authenticator app works. Several are free, and if you already use one for another service, the same app handles this account too.

Text-message codes are another form and are better than nothing, but they are weaker, because phone numbers can be hijacked. Use an app where the service offers one.

Why storage accounts especially

Some accounts, if compromised, cost you an hour of annoyance. A storage account is different in three ways.

Everything is in one place. An attacker in your email can read your messages. An attacker in your storage can download every document you have ever scanned, every photo, every client file, in one go.

Deletion is possible. Beyond reading, an attacker can delete. Trash gives you a window to restore, but only if you notice in time and only until it is emptied.

You share from it. Your account may have active share links and named shares to clients and colleagues. Someone in your account can see all of it, and can create new links to anything.

For a business account, or anyone storing other people’s information, the case is stronger still. If a client’s files leak because your password was reused from a breached forum, “I did not have 2FA on” is not an explanation you want to give.

Setting it up

The steps are much the same in any service. In Onlinedrive they go like this:

1. Install an authenticator app on your phone if you do not already have one.
2. Sign in to your account on a computer and open your account settings, then the security section.
3. Choose to enable two-factor authentication. A square code appears on screen.
4. In the authenticator app, add a new account and scan the code with the phone’s camera. The app starts showing six-digit numbers for your account.
5. Type the current number back into the settings page to confirm it is working.
6. The service shows you a set of recovery codes. Save these. The next section is about how.

From now on, signing in asks for your password and then a code from the app. Many services let you mark a trusted device so you are not asked for the code every single time on your own computer.

The whole thing takes about three minutes. The knowledge base has the exact steps with the current screens.

Recovery codes: the part people skip

Recovery codes are one-time codes that let you sign in if you lose access to your authenticator app. Phones get lost, broken, and replaced. Without recovery codes, a lost phone can mean a locked account, and proving you are you to support is slow at best.

Save them properly:

• Do put them in your password manager, if you use one.
• Do print them and keep the paper somewhere you keep other important documents.
• Do not store them only as a file inside the account they protect. If you are locked out, you cannot reach them.
• Do not screenshot them to your phone’s photos and leave it there. A lost phone takes the codes with it.

If you use a code, it is spent. When you have used a few, generate a new set.

Changing phones

The common way people lose 2FA access is upgrading their phone without thinking about it. Before you wipe or hand in the old phone:

• Check whether your authenticator app can transfer accounts to a new phone. Most can, either through a backup feature or an export.
• If not, sign in to each service, turn 2FA off, and turn it back on with the new phone.
• Keep the old phone until you have confirmed the new one produces working codes.

If you have already wiped the old phone, this is what the recovery codes are for.

Common objections

“It is a hassle every time I sign in.” On your own devices, it usually is not; you can trust the device and skip the code for a while. On a new device, it is six digits. Compare that with the hassle of losing the account.

“I have a strong password.” Good. A strong, unique password protects against guessing. It does not protect against phishing, and it does not help if the service you used it on is breached. 2FA covers the cases a strong password does not.

“I will lock myself out.” This is a real risk, and recovery codes are the answer. Save them before you do anything else.

“My account is not important enough.” Look at what is in it. If you would be upset to have it published or deleted, it is important enough.

Beyond 2FA

Two-factor authentication is the biggest single improvement, but a few things go with it:

• Use a unique password for the storage account, ideally generated by a password manager.
• Make sure the account’s email address is one you control and will keep, and that the email account itself has 2FA.
• Review your active share links occasionally and delete ones you no longer need. Password-protected and expiring links covers how to make new ones safer.
• For a team, require every member to enable 2FA, and check. A workspace is only as secure as its least careful member.

Next step

Open your account settings now, not later. Install an authenticator app if you need one, scan the code, confirm it works, and save the recovery codes somewhere outside the account. Three minutes, and the most likely way to lose everything in your drive is closed off. Then do the same for the email account attached to it.