a multi factor authentication requires at least two sets of credentials. This is typically something you know (e. g. a password) and something you own (e. g. a token generator or mobile phone)
14
votes
2answers
224 views
Mitigating the loss of a mobile phone used for second-factor login
Take the following scenario: John is using GMail for his primary email account and LastPass as his password management system. Both of these accounts are using the Google Authenticator mobile ...
4
votes
4answers
303 views
What are the ways to implement two factor authentication?
We have devices that can generate tokens. So we can use tokens with passwords to perform two factor authentication. There are many ways to implement such systems to enhance security. One of two I ...
5
votes
6answers
229 views
Is there multi-factor authentication for machines?
Most of what I have seen on mutiifactor authentication (eg wikipedia or here on se) seems human centric. Ie it is a human interacting with a machine and the factors are associated with authenticating ...
0
votes
0answers
64 views
Are there any SmartCards with NFC or Bluetooth technology? [closed]
I'm looking for a Smartcard that has integrated NFC communication, (or any other contact based transfer).
Does this technology exist, and must I rely on non-integrated solutions?
1
vote
1answer
88 views
What is more secure for voice and SMS OTP: A random number or generated similar to HOTP?
Many providers are creating OTP authentication for their sign in. However I noticed that all the voice and SMS OTPs I've come across are a series of 6 digits... similar to the HOTP RFC Standard ...
7
votes
2answers
235 views
What is the risk and mitigation of accidentally typing a YubiKey password in an open forum?
I have a YubiKey in my laptop (for testing) and accidentally broadcast my YubiKey password out to the Internet. Since this is only a test key, and has no access to anything of value, here are some ...
2
votes
2answers
74 views
Options for simple phone verification with pin delivery
My website needs to verify phone numbers in order to ensure that customers claiming a business actually work there. The service calls and gives the customer a pin which they put into the site. Many ...
7
votes
3answers
149 views
If multi factor authentication is enabled, how should that affect self-service password reset?
Given that security is only as secure as its weakest link, suppose I have website with additional authentication enabled in any of these ways: (example, multiple conditions may be required)
...
-1
votes
1answer
82 views
Does PayPal support a backup code for two-factor auth? [closed]
Google and DropBox have backup codes in case you can't get access to one of the devices you have registered. Does PayPal have a backup code?
3
votes
1answer
94 views
How safe is “trust this computer” option for websites?
Many sites have a "trust this computer" option that allows one to bypass some security measures (ex.: with Google's 2-step authentication enabled, one does not need to enter the phone's code if the ...
4
votes
5answers
145 views
When should I issue more than one multi-factor device to a user? Is it OK to give several active tokens vs none at all?
Most of the conventional IT.Sec thinking I've seen says that a user can only have one multi factor authentication device. I'd like to challenge that defacto-thinking and ask if there is ever an ...
4
votes
1answer
106 views
How to solve race condition in 2-factor authentication solutions like RSA Security tokens or Google Authenticator?
One of the reasons we opt to use 2-factor authentication is to minimize the impact of keyloggers. The theory is that even if an attacker is able to observe the user type in the token numbers, they ...
3
votes
1answer
156 views
Can I re-use another vendor's dual factor token in my own system? (Avoid physical token bloat)
I read the open source multifactor authentication techniques called HOTP RFC 4226 and TOTP RFC 6238 and realized that a single random number is the basis for the token's cryptography... and that this ...
3
votes
2answers
91 views
Should the serial number of multi factor devices be removed?
I'm trying to understand the relationship between the serial number of a multi factor device and the cryptographic material behind it.
I don't want to blindly assume that the serial number is just ...
1
vote
1answer
346 views
Is it secure to install RSA SecurID Software Tokens on the same computer that will be used to access the VPN?
My office switched from using the old hardware RSA SecurID key tokens to the RSA SecurID Software Tokens and most users have them installed on the same machines they use to access the VPN.
I asked ...
0
votes
1answer
153 views
How does the YubiKey Validation Server work from an encryption perspective?
Many YubiKey servers rely on the free cloud hosted authentication that comes with the product, but I'm interested in keeping all cryptographic material in my control. For that reason I am looking at ...
11
votes
2answers
464 views
Which SSH security is stronger? 2 Factor or Public key
For SSH authentication, which is more secure?
2 Factor Authentication using a USB token/Google Authenticator(time based)
OR
Public/private key with password
Or could they be both used at the same ...
3
votes
1answer
70 views
What physical, electronic, and software characteristics are important in a smart card?
I'm evaluating smart card readers to store a number of private keys, but don't know where to start.
What criteria is important regarding smart cards and preventing the extraction or unauthorized used ...
8
votes
2answers
197 views
Do any DNS registrars support multi factor authentication?
I am looking for a DNS registrar that supports strong multi-factor authentication.
Does any DNS registrar support multi-factor?
Is this a legitimate need?
6
votes
5answers
232 views
Is behavioural analysis (e.g. keystroke dynamics) a reliable security mechanism for MFA?
The typical set of multi-factor categories is as follows:
Something you know (e.g. a password)
Something you have (e.g. a hardware token, or key file)
Something you are (e.g. a fingerprint or retina ...
4
votes
2answers
297 views
Does having a passphrase and SSH key qualify as two factor authentication for PCI?
I am working on getting our company's servers PCI SAQ-C compliant (credit card data passes through our system but is not stored by our system). We have SSH access to administer the servers and all ...
2
votes
1answer
169 views
Is Dual Factor possible during boot with whole disk encryption on Mac FileVault 2
Mac FileVault 2 is the default disk encryption for newer Macs that occurs in the EFI pre-boot phase. The challenge here is that most smartcard drivers are loaded after the OS loads.
Is anyone aware ...
1
vote
2answers
308 views
Two-Factor Authentication: When is it worth it?
I was reading this article, and it triggered the question: Why not use two factor authentication? In his case, it both possibilities were enabled anyway, so this looks to me like it's two attack ...
10
votes
3answers
918 views
How does HSBC's “Secure Key” actually work?
My bank has recently sent me a Digipass/Secure Key, which looks like a tiny calculator. You press the green button to turn it on, type a PIN to unlock it, then press the green button again to generate ...
19
votes
11answers
921 views
Is it safe to use a weak password as long as I have two-factor authentication?
I'm careful to use strong passwords (according to How Big is Your Haystack, my passwords would take a massive cracking array 1.5 million centuries to crack), I don't reuse passwords across sites, and ...
6
votes
5answers
255 views
POP3/IMAP Stronger Authentication
We recently deployed a two-factor-authentication solution in order to strength logon to our web applications (one of them is web based mail, Microsoft outlook web access)
Most of the users who have ...
3
votes
4answers
277 views
SMS Authentication: random OTP or a cryptographic one
I'm adding two-factor authentication using SMS to enhance an existing login process. Since I'm not working with physical tokens, I was wondering what is considered the safest:
Sending random 8 ...
2
votes
3answers
154 views
Is multi-factor authentication supported by any current bios?
Is multi-factor authentication supported by any current bios'es?
Update
What I want to do is to make it impossible to go into the bios setup without both a password and another factor.
It would ...
2
votes
2answers
662 views
How do I protect my Gmail account when accessing it via an Android smartphone?
I have a Gmail account that I also access via an Android smartphone. The mail account could be used to reset passwords for other online accounts, so I want to tighten up the security around this ...
8
votes
2answers
1k views
3
votes
1answer
1k views
Which cross-platform password managers support encryption using a hardware token?
I am looking for a really secure password manager and I really like the fact that Password Safe supports encryption/decryption using a Yubikey programmed in challenge-response mode.
Read more here:
...
5
votes
6answers
1k views
Is tokenless (specifically SMS) 2FA a security compromise over OTP tokens?
I've been looking into the various pros/cons of tokenless (particularly SMS based) and traditional token based two-factor authentication (think RSA SecurID). After doing some research, I think I have ...
4
votes
2answers
1k views
Full disk encryption and multi-factor authentication
All serious full disk encryption schemes I have looked into use a static password for authentication. For example, TrueCrypt supports two-factor authentication with keyfiles, but not for system ...
3
votes
4answers
418 views
Do any organizations use Smart Cards other than the military?
The military's Common Access Card (CAC) seems legit. Do other companies/organizations employ their use? If not, why?
UPDATE
What are the pros/cons of smart cards, compared to other methods?
4
votes
2answers
301 views
How does multi factor authentication modify the AD authentication process?
I'm trying to understand what would have to be updated to make Windows-based systems support multifactor authentication.
Possible things that might have to be modified:
Active Directory / Domain ...
1
vote
1answer
92 views
Should the email server/application be protected by 2 factor authentication? What applications should be protected?
When should email be protected by 2 factor authentication?
Suppose a given company is in an industry where two factor authentication is offered to some or all of its clients. Does this mean that it ...
0
votes
1answer
150 views
What regulations *require* multi-factor authentication?
Just the straightforward question: What industries require multi-factor authentication?
Please include the following information
Country
Industry
Regulation name
Additional information as you ...
2
votes
2answers
235 views
Restrict user login to a specific machine
How do you restrict user access to a corporate web site to a particular machine ?
including the following conditions :
Each user is meant to use his credentials ONLY from the assigned machine.
The ...
2
votes
2answers
946 views
Synchronous and Asynchronous physical security tokens: which is stronger? pros/cons?
I'm thinking about the differences between physical authentication tokens such as RSA's synchronous physical tokens or asynchronous challenge/response, like Google's gmail direct-to-phone codes.
At ...
3
votes
1answer
214 views
How many authentication factors are there?
The three classes that we all know and love:
Something you know.
Something you have.
Something you are.
I've also seen references to "somewhere you are". Is this really a fourth factor? How many ...
9
votes
6answers
2k views
How to implement multi factor authentication using a token generator?
I'd like to implement multi factor authentication on a few projects.
Now the first factor would be username and password, for the second factor I would like to use a token generator.
These tokens ...
3
votes
2answers
162 views
How to evaluate different solutions for security tokens?
According to my own experience, most companies selling security tokens for authentication like RSA, Verisign or Aladdin share little information about the internals of their products like algorithms ...
15
votes
12answers
2k views
Why do we even use passwords / passphrases next to biometrics?
In the last couple of days there were a lot of talking about passwords and passphrases, not only here, but on several blogs and forums I follow (especially after XKCD #936 saw the light of this ...
15
votes
5answers
505 views
Safe way to authenticate (multi-factor authentication?) while being monitored?
(I'm trying for a bit more precise answer, particularly with regard to multi-factor authentication, than I received for "Safe way to use a computer that has spyware/keylogger installed?" on SU.)
...
11
votes
5answers
591 views
Does two factor authentication prevent social engineering attacks
After reading this article from symantec I got to think how much all these social engineering techniques rely on the authentication system of users, a password.
Considering three different additional ...
11
votes
3answers
2k views
Three-Factor Authentication for Windows
This HowToGeek article...
http://www.howtogeek.com/67556/how-to-unlock-your-pc-by-being-nearby-with-a-bluetooth-phone/
...got me thinking.
Is there any software (or combination of software) that ...
20
votes
4answers
1k views
How is “something you have” typically defined for “two-factor” authentication?
A wide range of products claim to offer "two-factor authentication" (c.v. Two-factor authentication - Wikipedia). Most are deployed as "something you have" to be used in addition to a normal password ...
5
votes
3answers
886 views
How does LastPass' grid multi-factor authentication work behind the scenes?
I understand how to use the Grid multi-factor authentication as a user but how does it work technically? Specifically how can just a few letters from the grid be enough to decrypt any secret defined ...
4
votes
4answers
591 views
Are there consumer-grade VPN services that support two-factor authentication, like SecurID?
I'd like to increase my VPN security, and Google hasn't turned up anything with regard to VPN services and SecurId.
Does anyone know of services like this?
12
votes
9answers
656 views
Anybody have additional information on the EMC RSA SecurID compromise?
The Security Advisory Press Release here doesn't have much information, the email that alerted me to this didn't help much more, and unfortunately I heard about the two Thursday evening conference ...
