a multi factor authentication requires at least two sets of credentials. This is typically something you know (e. g. a password) and something you own (e. g. a token generator or mobile phone)

learn more… | top users | synonyms

0
votes
1answer
46 views

How can LastPass enforce 2-factor authentication

I've recently started using LastPass and one of the things you can set as a policy for you password vault is Prevent offline access when using Google Authenticator. The local cache can be ...
2
votes
1answer
71 views

Do non-browser clients work around Gmail's 2-factor authentication?

If you use a client like mutt to access your mail, you probably know that it doesn't support 2-factor authentication. It still prompts only for a password - either your account password or, in the ...
0
votes
0answers
24 views

Generating backup codes for a 2FA implementation

I have implemented the login/verification aspect of a two factor auth system as per RFC 6238. It works fine with Google Authenticator, which is great. Now I am turning my attention to the backup ...
0
votes
1answer
25 views

How VIP card helps in verification? [duplicate]

How does the 6 digit randomly generated security code from (disconnected) Verisign Identity Protection card help in verification/validation of any user? Why one cannot enter any random 6 digit ...
3
votes
3answers
81 views

Is login limiting still needed if we employ multi-factor authentication?

The status quo is that most online websites limit login attempts per IP address, or even per account since some attackers possess huge amounts of IP addresses. OWASP declares: When multi-factor ...
2
votes
1answer
34 views

Does RADIUS allow for eventual, gradual adoption of 2 Factor auth in an AD Environment?

We have several applications that leverage AD SAML (via Ping Federate) LDAP authentication from 3rd party applications Windows workstation / Exchange auth (Kerberos) IIS and web components ...
1
vote
3answers
83 views

Multi-factor auth: implementing a “don't ask again for this computer” function

Many sites that support multi-factor authentication provide a "do not ask me again for this computer" option. I'm hoping to gain some insight into how this feature could best be implemented. My ...
0
votes
2answers
72 views

Creating port-specific SSH authentication for the same user

I have a Linux server running SSHD and would like to know if its possible to configure it, such that from within the LAN you only need a RSA key to authenticate (on port X), but from outside the LAN ...
1
vote
2answers
329 views

Could “receive SMS online” site be a scam?

There is a site that allows you to see all SMS received by a certain set of phone numbers (owned by the site). This seems to be meant for services that require two-factor authentication using SMS, ...
1
vote
3answers
58 views

Is it ok to use the same password for many services with two-factor authentication?

Let's say that I've a relatively strong password, but I don't want to use many different passwords for each different service, and let's say that those services provide two-factor authentication using ...
7
votes
3answers
357 views
+50

LastPass Grid Authentication vs Google Authenticator which one is more secure?

[Being a LastPass user] recently I moved to Google Authenticator instead of using Grid Authentication as a 2-factor security. For me, finding and filling letters from such a dense matrix is a rather ...
2
votes
2answers
87 views

Does Google 2-step verification protect user from session hijacking?

After signing in Google 2-Step verification scenario, user should enter verification code which sends to his mobile. Without it, he couldn't access to Gmail account. Consider an attacker does session ...
3
votes
6answers
221 views

Why not ask for a password and 2-factor token at the same time?

I have observed a number of web-based login forms that offer 2-factor authentication do token entry on a second form after validating your username and password. Is there a reason not to ask people ...
11
votes
2answers
1k views

Does having 2-factor authentication help with HeartBleed?

I was talking with a friend about HeartBleed, and he mentioned that he had 2-factor authentication enabled on all the sites that supported it, so even with his username and passwords, nobody would be ...
1
vote
0answers
32 views

Is there a TOTP variant that does not require the user to type in a code? [closed]

We're considering a 2 factor TOTP solution on a mobile phone. However, it would be much easier for the user to somehow send the OTP to the server by pushing a button, rather than manually typing in a ...
-1
votes
1answer
49 views

Is it applicable to use Google Authenticator against TEMPEST?

I would like to know about Multi-Factor Authentication is applicable for TEMPEST or not. Why I'm asking is I have suspicious matter every day also captured as log. My concern: It's possible to ...
0
votes
1answer
115 views

Using Gmail in China triggered lots of Two Factor SMS

A friend of mine lives in Hong Kong and she travelled to China over the weekend. Whilst there, she was able to use Gmail on her Android phone without logging in again, but she had to re-login on her ...
1
vote
2answers
1k views

How does Authy works?

I think I knew how does two-factor authentication works. I enter the password. Server generate random number and send me it me by sms. I enter this number. Server check number I entered with ...
1
vote
2answers
61 views

HOTP/similar - how about standard backups of mobile devices?

I was considering adding HOTP as an option to my website (alongside things such as SMSed one time tokens which I already have). But I was considering one issue that HOTP inherently has: Things such ...
-6
votes
1answer
160 views

How can I succesfully pentest site with two factor authentication? [closed]

I want to use a commercial, automated tool but it cannot login successfully because the website requires a two factor authentication process using SMS. For testing, the SMS message is sent to another ...
4
votes
3answers
309 views

Does Google/Dropbox/Github Two-Step Verification count as Two-Factor?

This considers the route where somebody does not use the SMS option, but rather using TOTP, and the site offers a generated seed to input. Two factors questionably at use: password: something KNOWN ...
0
votes
3answers
128 views

Isn't it less secure to use something you are for authentication?

I have to think of this everyday when I close the doors of the shop I work in, a year ago we used to close the shop and arm the alarm using a key fob this means the worst case scenario was that I get ...
0
votes
1answer
120 views

Two-factor port-knocking via SMS (TXT)

It seems to me that a useful alternative or supplement to traditional port-knocking, fwknop, etc, for a system requiring only occasional access, would be to: Set up a one-time pad of keys, and a ...
32
votes
2answers
1k views

Why does Google cripple the 2FA Google Authenticator PAM module?

If you enable 2FA for Google Apps the shared secret is 160 bits. The google_authenticator PAM module on the other hand seems to use 80 bits for the shared secret. According to RFC 4226: R6 - The ...
0
votes
1answer
45 views

Securing data on a mobile device (even from the user/owner)?

I am writing an application to generate OTP codes for two factor authentication where I need to securely store data locally. This data must be secure from both the owner/user as well as intruders. I ...
1
vote
2answers
156 views

Does this show the need for a two-factor authentication?

I need some help for my understanding while reading through this authentication scheme in WEP. In a WEP authentication scheme, the station first sends a request for authentication. However, this ...
4
votes
2answers
460 views

Is OATH TOTP and / or Google Authenticator vulnerable if an attacker has (N) previous codes?

I'm not much of a ipsec initiate, so this is a bit over my head ... but I'm always willing to learn more. Are there any known attacks against OATH TOTP (Google Authenticator's / Authy's algorithm) if ...
4
votes
2answers
2k views

Does adding two-factor authentication by OTP really make KeePass more secure

KeePass is an application that keeps all your passwords for you in a database. It is primarily protected by a master password and/or keyfile. If the database is properly encrypted with that password ...
0
votes
1answer
143 views

What are techniques for end users to select keys on a smartcard?

When multiple keys exist on a given smartcard, how can a user choose between them for a given identifier ... ideally without a loss of privacy? For example suppose I have a government issued ID that ...
10
votes
4answers
635 views

What is the use of the “secret” displayed when setting up 2 Factor Authentication?

What is the purpose of the "secret" that is displayed when you take the picture of the QR code to set up 2 Factor Authentication on a non-Google site? Why would you need it? If you save it, doesn't ...
0
votes
2answers
329 views

Do Google 2 Factor Auth backup codes work for logging into Google or other sites?

I set up Google 2 Factor Auth to log into other sites. I see there are backup codes if you lose your device. Are these used only to log into Google, or can they be used to log into other sites?
-2
votes
2answers
315 views

Why doesn't Google 2 Factor Auth ask for a code? [closed]

I set up Google 2 Factor auth to use 2 Factor Auth with certain sites. But reading over the help suggests that Google 2 Factor Auth is only used to log into Google services like Gmail. But when I log ...
5
votes
4answers
526 views

One time password over SMS - exposing the Authentication Server to the internet

Consider a Internet Based Website which does authentication. The Web Application can do the authentication by calling an Authentication Server which is not connected to the internet. The ...
9
votes
2answers
382 views

NFC used in place of contact based smart card two-factor authentication

My organization is trying to move away from contact based smartcards (because our hardware vendor is no longer integrating them into their current systems) to some other form of two-factor ...
2
votes
2answers
494 views

How does Google detect new devices for two factor authentication

When you enable two step verification for google accounts, you get sent a code by SMS to enter in addition to your username and password the first time you log in with a new device. How do they ...
6
votes
2answers
290 views

Do keyfiles actually add any meaningful security in the presence of strong passwords?

In the context of protecting access to local encrypted files or devices against a determined (and competent) adversary, is there any reason to believe that the use of a key file actually presents a ...
6
votes
2answers
1k views

How do I block LinkedIn from extracting data from Microsoft Exchange Server?

LinkedIn now offers the ability to take a real user and password from the end user and connect to Exchange Server for the purpose of importing contacts into their system. (To do this yourself, click ...
2
votes
1answer
382 views

Is TextKey SMS 2 factor authentication secure against cell phone cloning?

I came across this website today that implements SMS based authentication that works "opposite" most SMS authentication methods. In typical SMS authentication, the provider sends you an access code ...
16
votes
2answers
411 views

Mitigating the loss of a mobile phone used for second-factor login

Take the following scenario: John is using GMail for his primary email account and LastPass as his password management system. Both of these accounts are using the Google Authenticator mobile ...
8
votes
5answers
3k views

What are the ways to implement two factor authentication?

We have devices that can generate tokens. So we can use tokens with passwords to perform two factor authentication. There are many ways to implement such systems to enhance security. One of two I ...
8
votes
6answers
601 views

Is there multi-factor authentication for machines?

Most of what I have seen on mutiifactor authentication (eg wikipedia or here on se) seems human centric. Ie it is a human interacting with a machine and the factors are associated with authenticating ...
1
vote
1answer
310 views

What is more secure for voice and SMS OTP: A random number or generated similar to HOTP?

Many providers are creating OTP authentication for their sign in. However I noticed that all the voice and SMS OTPs I've come across are a series of 6 digits... similar to the HOTP RFC Standard ...
10
votes
3answers
918 views

What is the risk and mitigation of accidentally typing a YubiKey password in an open forum?

I have a YubiKey in my laptop (for testing) and accidentally broadcast my YubiKey password out to the Internet. Since this is only a test key, and has no access to anything of value, here are some ...
4
votes
2answers
132 views

Options for simple phone verification with pin delivery

My website needs to verify phone numbers in order to ensure that customers claiming a business actually work there. The service calls and gives the customer a pin which they put into the site. Many ...
10
votes
3answers
304 views

If multi factor authentication is enabled, how should that affect self-service password reset?

Given that security is only as secure as its weakest link, suppose I have website with additional authentication enabled in any of these ways: (example, multiple conditions may be required) ...
-1
votes
1answer
182 views

Does PayPal support a backup code for two-factor auth? [closed]

Google and DropBox have backup codes in case you can't get access to one of the devices you have registered. Does PayPal have a backup code?
4
votes
1answer
245 views

How safe is “trust this computer” option for websites?

Many sites have a "trust this computer" option that allows one to bypass some security measures (ex.: with Google's 2-step authentication enabled, one does not need to enter the phone's code if the ...
4
votes
5answers
261 views

When should I issue more than one multi-factor device to a user? Is it OK to give several active tokens vs none at all?

Most of the conventional IT.Sec thinking I've seen says that a user can only have one multi factor authentication device. I'd like to challenge that defacto-thinking and ask if there is ever an ...
5
votes
1answer
202 views

How to solve race condition in 2-factor authentication solutions like RSA Security tokens or Google Authenticator?

One of the reasons we opt to use 2-factor authentication is to minimize the impact of keyloggers. The theory is that even if an attacker is able to observe the user type in the token numbers, they ...
4
votes
1answer
373 views

Can I re-use another vendor's dual factor token in my own system? (Avoid physical token bloat)

I read the open source multifactor authentication techniques called HOTP RFC 4226 and TOTP RFC 6238 and realized that a single random number is the basis for the token's cryptography... and that this ...