Evernote Turns On Three New Security Features, Including 2-Factor Authentication, After Major Breach In February
After Evernote, the personal note-taking app with 60 million+ users, got slammed with a security breach in February 2013, today the company is turning on three new features to give users better control over their accounts: two-step verification, access history and authorized applications listings. Two-step authentication will eventually get rolled out to all users, but a spokesperson tells TC that at first it will be only be rolled out to Premium (paying) users first, to make sure that the experience is right.
“Evernote Premium users are the most engaged so it made sense to start there,” she says. “With feedback from our Premium users, we’ll be best prepared to address questions and concerns as we continue the roll out to our larger user base.”
The move comes after a breach that was bad enough to forced Evernote to require password changes from its 50 million users (now numbering over 60 million), but not, according to CEO Phil Libin, serious enough that users’ data and payment details were accessed.
Evernote’s two-step verification — the most important of these three new services getting introduced today — had been in the works already, but plans to roll it out got accelerated after the February incident: today is the fruition of that attempt.
Like other two-step user authentication systems rolled out by Twitter just last week, Evernote’s service will be SMS-based, and it will be optional for all users. That is to say, if you are an Evernote user and don’t want to take the extra step to prove who you are every time you need to log in, you do not need to.
This is what the screen will look like in your settings to turn on the new features:
Once you have turned two-factor verification on, whenever you are signed out of your account or need to re-enter your password for other purposes, you will get a six-digit code sent to you by SMS — an example of how it looks on the iPhone is illustrated above. That code in turn is required in a new sign-in screen:
The need to re-enter a password shouldn’t come up regularly for users: it’s something that is typially required when you sign into Evernote on the desktop or install it on a new device. The code itself is generated by the Google Authenticator app, or users can get it by SMS, Evernote says in a blog post.
More to come.
