Mozilla announced the rollout of two-step verification (2SV) as an optional security feature for all Firefox user accounts. The engineers at Mozilla Foundation designed the feature without support for SMS-based codes. They likely did so for the same reasons as Twitter when it moved away from this form of verification in December 2017. Criminals previously found ways to steal users' SMS text messages, thereby enabling attackers to compromise 2SV-protected accounts. This vulnerability led Twitter to make a change in how it handles login verification. At the time of this writing, Mozilla's 2SV feature worked with the support of three authentication mobile apps: Google Authenticator, Duo Mobile and Authy 2-Factor Authentication. It's unknown whether Mozilla intends to add support for additional applications. Users who'd like to protect their Firefox accounts with two-step verification should download one of the supported authentication mobile apps from their smartphone's official app store. They should then click the menu button in Mozilla's Firefox browser, go to preferences and expand the Two-step authentication section. Alternatively, they can visit https://accounts.firefox.com/settings?showTwoStepAuthentication=true. When the Two-step authentication section appears, users will have the option of enabling the feature. Clicking the "Enable" button will subsequently display a QR code. Users must scan this code with their authentication mobile apps to add their Firefox accounts. With that process complete, they will need to obtain obtain a six-digit code from their app and use it to confirm setup. They should then save the 10 recovery codes provided by Firefox in a safe location in case they ever lose access to their authentication mobile app.
The setup process for 2SV on Firefox accounts. (Source: Bleeping Computer) Going forward, when users attempt to log in to their Firefox accounts, they'll need to generate a one-time passcode using their verified account on their authentication mobile app after entering in their username and password. This step can therefore help protect their accounts even if attackers gain access to their login credentials. Additional information on this feature and how to set it up can be found here.
