Take the 2-minute tour ×
Information Security Stack Exchange is a question and answer site for Information security professionals. It's 100% free, no registration required.

We use Google Authenticator and SMS for two factor authentication. Should we allow the administrators of the site to turn off TFA for users?

Google Auth uses SMS as backup option but SMS does not have a backup and when the user cannot receive SMS for whatever reason he/she cannot login. I know we can backup SMS with voice calls but these situations might still arise.

share|improve this question
    
A lot of people use their mobile phone for 2FA. Most of those people also receive their email on that phone. This means that their email will be compromised as well. A cooldown time of about a week to a month seems necessary to me. –  user36088 Dec 20 '13 at 10:20

1 Answer 1

up vote 5 down vote accepted

Should we allow the administrators of the site to turn off TFA for users?

This is a very interesting question. I suspect the answer very much depends on the individual site's risk assessment. Let's look at some pros and cons of allowing the administrator to turn off 2FA for an individual user.

Pros

  • Convenient for the user if he loses access to his authentication token.

Cons

  • Subject to phishing attacks. An attacker could call/email the customer service representative and pretend to be the user asking them to turn off the 2FA. You might think your customer service representatives are smarter than that but you will be surprised. Mat Honan is living proof that this is a very real threat.

However, there might be a legitimate use case in which the user has lost access to his authentication token and needs it to be reset somehow. I would make the user go through the same process as he would need to when resetting his password. This could involve emailing him a link to trigger to process or something similar. The idea here is to make it as difficult for an attacker as possible to do this as he will need to compromise the user's email account as well.

share|improve this answer
    
We are operating a site where we collect some personal informaition that we can verify. I'll create a process that requires the personal details of the user to be verified before an admin can manually disable TFA. But now I'll have to make sure that the admin has actually verified the personal details before allowing her to do this. Which is a pain. –  AntonAnsgar Dec 20 '13 at 11:34
    
@AntonAnsgar That can be done automatically through something like email a link to the user. –  Terry Chia Dec 20 '13 at 11:42
    
That means all the attacker has to do is to take control of users email address right? Which kind of beats the purpose –  AntonAnsgar Dec 20 '13 at 12:33

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.