a multi factor authentication requires at least two sets of credentials. This is typically something you know (e. g. a password) and something you own (e. g. a token generator or mobile phone), but could also be something you are (a biometric).

learn more… | top users | synonyms (2)

2
votes
3answers
41 views

Is using the 2FA secret on the same machine as using the credentials, removing one factor of 2FA?

In other words: Is saving or using the two-factor authentication (2FA) secret on the same machine to generate one-time passwords (OTP), breaking the two-factor authentication (2FA) concept since it's ...
-3
votes
2answers
71 views

How is two step authentication done in Europe without SMS?

I've heard that SMS use in Europe isn't even close to how much it's used in the US. How do they do two step authentication when a user forgets their password? Is it as simple as just using a robocall ...
3
votes
3answers
90 views

What security does the new option for two factor authentication that Google offers enforce?

Google has announced a new option for two factor authentication - a popup message. How does this improve security?
13
votes
4answers
2k views

Which verification method should I choose: SMS or call?

I want to enable Two-Factor Authentication for my outlook account, but I'm not sure which method should I choose or in other words which method is more secure? Like I said there are two options: text ...
1
vote
2answers
68 views

Periodic password change needed when using 2-step verification?

I know that it's considered good online security hygiene to change one's login passwords every 6 months or so. Is that needed on sites with 2-step verification? Isn't the 2nd step what will keep my ...
33
votes
6answers
2k views

Why don't PGP and SSH keys see more widespread use as a second factor when authenticating?

One of the major up-and-coming MFA methods is U2F, which relies on an initial key exchange and challenge-response mechanism. It's a relatively new protocol, and is only starting to see more ...
-1
votes
5answers
162 views

Is it possible to bypass two step authentication process?

Is it possible for a hacker to bypass two step authentication process if the hacker has no physical access to my phone?
2
votes
2answers
81 views

For 2FA, is one method better (more secure) than another?

There are a variety of options available for 2FA - LastPass, for example, offers all of the following options: LastPass Authenticator Duo Security Authentication Google Authenticator Yubikey ...
7
votes
2answers
126 views

Why not make the second factor the only factor? [duplicate]

Most websites use a single-factor based authentication mechanism, the password. Some popular websites, however, also implement an (often optional) two-factor mechanism to log in; usually requiring the ...
3
votes
3answers
76 views

Additional confirmation for online bank payments

Nowadays, when someone is making an online payment, the associated bank often requires an authentication step. As far as I know, there are mainly two ways to do this: SMS Verification. The Bank ...
6
votes
4answers
103 views

How can I protect my credit card on sites where 2FA is not an option?

I'm using Visa Express, and sometimes when I'm shopping, the store doesn't support Verified by Visa - so that means that there is no 2FA option. Normally when there is that option, it will force me ...
0
votes
0answers
46 views

TOTP: Storing symmetrical secrets

I'm in the process of researching 2fa methods for a cloud connected physical access control system. There is very little margin for error in this space. Is it just me or does TOTP for two factor auth ...
62
votes
5answers
5k views

Do 2FA sites leak info by confirming a correct password guess?

Here's my relatively layman's view of the issue. Many websites tout multifactor authentication (MFA) as an enormous boost to the security of users' accounts, and it can be if implemented properly. ...
1
vote
1answer
69 views

Pro's and Con's of current 2-step-verification processes?

I am currently working on a project, and we are exploring different types of current industry MFA standards. The most known ones would most likely be HOTP & TOTP pins, which are used in the '...
0
votes
0answers
12 views

AWS - CloudFormation - Enable MFA

Is there a way of using cloud formation to enforce MFA on user accounts in AWS: I have the following cloud-formation code: { "AWSTemplateFormatVersion": "2010-09-09" "Description": "...
0
votes
0answers
18 views

Is “full loop” and “half loop” authentication the right word to describe this 2FA sequence?

I'm looking for a term to describe this abstract thought about multifactor devices and how they are implemented. In the examples below, there are different levels of device authentication, but the ...
0
votes
0answers
27 views

From a credential flow perspective, whats the difference between FIDO UAF and FIDO 2.0 Web Services?

The FIDO Standard allows for devices and authentication schemes to be certified as UAF or U2F. This allows for flexible unified authentication, and optional second factor enrollment and registration. ...
0
votes
1answer
43 views

Protecting third-party credentials in a web database in light of weak passwords

I need to store third party credentials in a database for a web application. The third party supports OAUTH and I plan on getting a long-lived token to allow my app to access the third party, but I ...
1
vote
1answer
86 views

How is github 2FA personal access token more secure than passphrase?

I recently enabled 2-factor authentication (2FA) on my github account. Once you enable 2FA, you can no longer connect to the repo using your normal passphrase using command line tools. You have to ...
2
votes
1answer
60 views

Can I use Authenticator instead of phone number for Gmail 2FA? [closed]

I want to enable Two-Factor Authentication for my gmail accunt, but when setting this up it asks for my phone number. I don't have a phone (that I want to connect to Gmail), is there another way to ...
2
votes
4answers
267 views

What's the idea of two factor authentication? A hacker can use password with mobile

2-factor authentication means to enter MOBILE app (using username and password) and there you get code to enter your account from PC browser, right? But if hacker has my password, then he can enter ...
0
votes
1answer
81 views

Doesn't this make 2FA irrelevant and possibly dangerous?

Article. One sentence summary: they use a smartphone as a listening device to compromise computer security. I know our bank doesn't allow us to take cell phones in at all, even if they're completely ...
0
votes
0answers
20 views

Windows Server 2012 disable MFA for a single user?

I'm having issues with this for whatever reason. I created a new user and MFA is supposedly disabled but it doesn't seem to be true. Is there maybe something I've missed or is there an easier (more ...
2
votes
2answers
60 views

What is the safer Google account recovery option?

I have a Google account with a strong password and 2-factor authentication set up, and I worry about what would happen if I lost my phone with the 2FA app. I want to set up a recovery option, and I ...
1
vote
2answers
110 views

Hacked, is my IOS systems safe?Werid things? [closed]

I hope this finds you well. I wanted to thank you in advance for your time and patience with me, and my questions. I was Hacked by friends of an X-boyfriend from HighSchool. He was a Foriegn ...
4
votes
2answers
96 views

Out of band verification using phone; a fallacy?

More and more websites nowadays require new users to verify their 'identity' by requesting the user prove that he/she has access to a device identified by a telephone number (typically a phone). The ...
0
votes
2answers
71 views

Malware able to “read” one's screen

I was searching online about multifactor authentication. One of the reasons that people recommend it is because they fear someone may use a keylogger to "steal" their password, so they use one more ...
1
vote
1answer
24 views

How to reliably backup to cloud services without hampering security?

There is a huge number of articles advising to enable two-factor authentication on sensitive cloud services. I understand the benefits for my accounts' security, but doesn't it defeat the purpose of ...
2
votes
1answer
50 views

Accounts being accessed from X country

So recently I've been getting emails that X account has been accessed from Y country with an IP address that I obviously don't own. An example would be my Steam account which recently got accessed ...
3
votes
1answer
99 views

Relative merits of Yubico OTP vs. OATH-HOTP?

What are the pros and cons of using Yubico OTP vs. OATH-HOTP? They both seem very similar.
1
vote
1answer
94 views

What are the privacy implications of using Yubico OTP with YubiCloud?

I am considering purchasing Yubikey devices (made by Yubico) to add two-factor authentication when my users ssh to our various servers. I figured I would configure the device to use Yubico OTP with ...
7
votes
3answers
144 views

Why do Google 2-factor authentication SMS codes never start with a 0? [closed]

When you use 2-step authentication to log to your Google Account, you can get an SMS on your mobile-phone with a G-123456 style code. I think that I never got a code with a leading zero. Is there a ...
2
votes
2answers
76 views

Is email OTP improving the security for 2 phase authentication?

There has been similar questions before where people say that using some other means (sms, hardware devices, etc.) is a more secure way to provide 2 factor authentication. Provided we don't have an ...
6
votes
1answer
82 views

Are Push 2FA methods safe from Android and iOS Malware?

I am doing a survey on various 2FA solutions, and recently I came across “Push” 2FA (e.g Duo Security). In this solution, the site (e.g. a banking site) pushes a notification to the user’s mobile ...
5
votes
1answer
94 views

Can I use a satellite phone for 2 factor auth sms and such?

Would 2 factor authentication SMS messages or other kinds of internet security notifications work with satellite phones? E.g. companies like Google, Paypal, Facebook, banking institutions and others ...
1
vote
2answers
98 views

Does two factor authentication increase the attack surface?

Would adding two factor authentication to an application increase the attack surface of this application? I think it would, since by adding complexity the likelihood of a vulnerability in my ...
0
votes
1answer
44 views

2 step authentication hybrid

I'm all forward on 2 step authentication. I understand how it is way more secure than a simple password. However I'm always afraid to start using it because I believe that in some cases I could be "...
0
votes
1answer
56 views

Why does LastPass give me one password without needing my MFA key?

I open my browser and navigate to a login page. When I click the LastPass asterisk in the input field, I'm prompted to log in. I enter my password, and another tab pops open asking me for my MFA key (...
1
vote
0answers
117 views

Steam two-factor authentication algorithm? [closed]

I'm all on-board that Value is recently pushing for two-factor authentication on Steam accounts. I'm not happy that they force you to use the Steam mobile app because both on iOS and Android, it's a ...
11
votes
3answers
848 views

Steam and two-factor authentication

The Steam platform is designed to encourage users to use two-factor authentication. One of the community tasks (achievement-like objectives) on Steam is "Use the Steam Mobile App for two-factor ...
3
votes
1answer
126 views

2FA: Difference between Storing Backup Codes & Secret Key

First of all, the secret key in discuss is the one when you cannot scan a QR code in a 2FA setup process, there is a code that you can manually entered into your TOTP-generating device/app. Some ...
3
votes
2answers
131 views

Multi-factor authentication - email link

I'm trying to understand possible issues with the approach of sending the MFA one-time-token to the user as a clickable link in the email. Instead of submitting the OTP on the web page, user will ...
4
votes
2answers
107 views

Can Simultaneous Logins Occur When Two Users Have Both Pieces Of Two-Factor Authentication Information?

In a hypothetical situation (say a screen capture program or rootkit, where, incidentally, a password change will not make any difference) where an attacker has both your password, and sees the two-...
2
votes
1answer
39 views

MFA token for authentication to a call center

I work for an AWS managed service provider, and we are brainstorming the best way to authenticate someone who calls for support over the phone. Yes, we could use a verbal password, but this can be ...
3
votes
1answer
50 views

Gmail twofactor auth on untrusted computer

Let's say I log in to gmail on untrusted computer using two factor auth in Google Chrome in incognito mode. Hypothetically some virus can read my email after this even without knowing password (.dll ...
6
votes
1answer
330 views

Using Two-Factor Authentication to Stop Pass-the-Hash

Am looking into mitigations to Pass+the-Hash and Pass-the-Ticket in Active Directory that also improve overall network security, too. Have sorting through some of the many two+factor authentication ...
2
votes
1answer
140 views

What are reasonable alternatives to “Trust this computer” prompts when signing in?

User feedback for a bank authentication website included this comment: It's annoying to get verification codes to my email or phone every time I log in to my Bank account from a new device ......
1
vote
4answers
75 views

Someone tried to log into my mail - what do I do?

I have a 2-step verification system for both my gmail accounts. Today, I received a message with a code when I wasn't trying to log in. So someone has my password. What's my next step here? What ...