[Huawei Developers] Mike-mei:
An account acts as an indispensable network access credential for everyone in this digital world. It is associated with a user's digital assets and privacy, and even affects the security of their physical assets.

How to ensure user account security has become a focal point that challenges developers, and that process is known as identity verification, which plays an important part in account security.

Account hacking happens all the time and often comes with bad consequences. A leaked bank account password can lead to significant economic losses. A hacker tends to clear all paid props of the account holder after they break into a game account. In social media, however, a prankster steals accounts to make offensive comments for fun, without specifically aiming to benefit financially.

Convenient sign-in methods have made signing into an app even easier, but this could also leave user accounts vulnerable to malicious people who cause harm or obtain illegal benefits. An essential cause of account hacking is that some authentication methods are overly simple.

In conventional account name plus password login scenarios, once the password is disclosed, the account can be signed in to by anyone. So, how can we cope with this problem?

The answer is two-factor authentication. This authentication method addresses the vulnerabilities during user identity verification and strengthens user account security.

What Is Two-Factor Authentication?

Two-factor authentication is a system that utilizes the time synchronization technology. It uses a one-time password generated based on time, event, and key to replace traditional static passwords.

More specifically, in addition to the combination of the account name and password, a layer of security authentication, that is, dynamic verification code, is added to verify user identity and ensure sign-in security. This authentication method is called two-step authentication or multi-factor authentication.

The verification code generated each time varies according to the variables used for each authentication. Because the verification code changes with each use and is unpredictable, it ensures sign-in security in the basic password authentication phase.

Two-factor authentication is applicable to a wide range of scenarios. Generally speaking, this authentication method can be adopted as long as a static password is available.

Nowadays, two-factor authentication has been used in multiple fields, including the U key for online banking and SMS verification code. Along with the finance field, the "account name+password+dynamic password" authentication mode has been utilized by websites and apps to cut security risks and protect users' digital assets and privacy in social networking, media, and more. Currently, the devices and technologies for two-factor authentication are mature. The two-factor authentication solution consists of three parts:

Authentication device (token), agent software, and management server.

The authentication agent software functions between terminal users and network resources to be protected. When a user wants to access a resource, the authentication agent software sends the request to the management server for authentication.

To ensure the operability of two-factor authentication, the management server that receives and verifies two-factor authentication requests must be highly reliable and secure, support multiple two-factor authentication devices, and can be easily integrated with enterprise IT infrastructure which includes front-end network devices and service systems and back-end account systems, such as Active Directory (AD) and Lightweight Directory Access Protocol (LDAP).

For independent developers and small and medium-sized enterprises, two-factor authentication is necessary for ensuring the security and reliability of their data assets. As multiple account systems with two-factor authentication services have been released on the market, you can simply integrate one to free up investment in the R&D of agent software and management servers.

The two-factor authentication function of HMS Core Account Kit has been tested by numerous developers and the market, and has shown remarkable reliability. Not only that, Account Kit informs risks in real time and complies with the General Data Protection Regulation (GDPR) to raise the level of account security. Try out the kit for even safer and more convenient identity verification!

Learn more about Account Kit:

>> Documentation: overview and development guides of HMS Core on HUAWEI Developers

>> Open source repositories: HMS repositories on GitHub and Gitee

>> Forum: HUAWEI Developer Forum