PayTraq Blog

Multi-Factor or Two-Factor Authentication

Posted in PayTraq features, security

A new amazing feature has been added to PayTraq that is two-factor authentication, also known as multi-factor authentication or MFA.

Two-factor authentication is one of the best tools users have to protect their security. Two-factor authentication is identification of users based on two different types of authentication data requests.

How does it works? Instead of just your password standing between you and hackers, it also requires a second key before you can fully log in. In other words, the approach used in two-factor authentication is quite simple: to be granted access, you need to prove your identity by means of the combination of two different components. Even though two-factor authentication doesn’t provide 100% protection, it's still a reliable barrier preventing hackers from accessing your data, and in some sense mitigating the drawbacks of traditional password protection, especially when simple and short passwords are used that are easy to remember or guess.

To take advantage of our multi-factor authentication feature with PayTraq, you’re going to need an iPhone or any Android-compatible phone, and install an app for generating one-time temporary passcodes. Two-factor authentication isn't difficult to set up, but it's not particularly intuitive either. One of the easiest ways requires you to download a Google-made app – Google Authenticator, even though PayTraq isn’t a Google-made product.

Setting Up Multi-Factor Authentication With PayTraq

1) Take out your phone. In the iPhone or Android app store, search for and then download either an app called Google Authenticator (iPhone, Android) or one called Duo Mobile. On a Windows phone, look for Microsoft Authenticator.

These apps are made by Google and Duo, but your data will never actually touch a Google or Duo servers. These two authenticator apps are just implementations of a standard called the Time-based One-time Password Algorithm. This method hands a secret key to your phone, which your phone inputs into an algorithm. Your phone then solves the algorithm every 30 seconds, using the current time as one of the inputs. If you and the two-factor server both have the same secret key, and can show it’s roughly the same time, then you’re allowed to sign in.
Google Authenticator and Duo Mobile are just two different ways to run one of these algorithm solvers on your phone.

2) Go to your My PayTraq menu, choose My Profile page, then click "MFA". On this page, PayTraq tells you to show the authenticator app a QR code. This is how it communicates the secret key to your phone.

In Google Authenticator, you have to press a plus-sign button near the top of the screen to start a new log-in. After pressing it, tap the option to "scan barcode". Then show it the QR code on the screen.

Instead of scanning a QR code you can enter in authenticator app a secret configuration key from MFA page in PayTraq.

3) Your phone's authenticator app will now have an array of six numbers on the screen. Enter them in the box at the end of the MFA page, then click "Activate" button.

You can activate and deactivate multi-factor authentication at any time in your user profile's MFA page.