Tagged Questions

a multi factor authentication requires at least two sets of credentials. This is typically something you know (e. g. a password) and something you own (e. g. a token generator or mobile phone)

learn more… | top users | synonyms

0
votes
1answer
30 views

Are 2FA soft-tokens flawed if the user can log into the website from the same mobile device?

If I'm using something like Authy for soft tokens for my users, and they log into the web application on the mobile device itself, haven't they just lost the benefit of 2FA (ie loss of the mobile ...
19
votes
4answers
1k views

Why use a Smartcard for (Two Factor) Auth instead of another medium?

I recently installed Bitlocker on my Windows 8.1 machine, using only a password. I was thinking of getting something other than just a password for my storage drive, something physical, like a USB, SD ...
1
vote
1answer
52 views

Is selecting trusted computer in 2-step verification less secure?

In using 2-step verification, does selecting 'Trusted Computer' a less secure options? https://support.google.com/accounts/answer/2544838?hl=en If so, is it still a reasonably secure option?
1
vote
1answer
177 views

What are the differences between the U2F and UAF FIDO authentication standards?

Google recently announced support for Universal 2nd Factor (U2F) authentication in Chrome and started allowing that authentication mechanism to be used for 2-factor authentication across their various ...
0
votes
5answers
100 views

SSH server: What's more secure, pub key auth or Google Authenticator time-based auth?

I'm curious which would be more secure, pub key authentication or 2-factor auth via Google Authenticator. Apparently I can't use both. If I have pub key authentication, the Google Auth PAM module ...
21
votes
4answers
3k views

How secure are the FIDO U2F tokens

Google and Yubico just announced the availability of cryptographic security tokens following the FIDO U2F specification. Is this just another 2FA option, or is this significantly better than solutions ...
-1
votes
1answer
32 views

Can OTP 2FA be reversibly determined?

Please note: I'm not necessarily talking about what happens when one shoulder surfs someone inputting a OTP. I'm fairly confident that it's nearly impossible (or extremely impractical) to guess the ...
7
votes
0answers
167 views

Yubikeys & SSH - which option is best for lockdown?

My company has a few dozen servers hosted on a cloud provider. All but one (OpenVPN host) is closed to the internet. We're using OpenVPN AS which uses certs + Google Authenticator for login. We are ...
54
votes
6answers
6k views

Four-factor authentication

I'm sure you've all heard of two-factor/multi-factor authentication. Basically it comes down to these factors: Knowledge - something you know (e.g. password, PIN, pattern) Possession - something you ...
9
votes
4answers
241 views

What kind of factor is a physical signature?

I'm familiar with the basics of multi-factor authentication. Now I'm trying to understand how a physical signature, as written on, say, a check or a credit card receipt, would be classified: Is it ...
2
votes
2answers
100 views

Where can 2-factor fail in Google?

I was one of the people who thought that enabling 2-factor in Apple would have prevented the download of images from iCloud; it was recently pointed out to me that, in fact, I was gravely mistaken. ...
14
votes
6answers
1k views

Additional security benefits from Multi-Factor Authentication?

Does multi-factor authentication provide any additional security benefits on top of doing a better job at correctly identifying and authenticating users compared to single factor authentication? In ...
8
votes
5answers
417 views

Is a biometric eye scan more secure than a multi-factor authentication

I have come across the following question in a Security+ exam guide You are tasked with creating a high-security authentication system for physical access control to a military installation. Which ...
0
votes
2answers
75 views

Are there any flaws in my design for a paper-based OTP grid?

I'm trying to implement two-factor authentication on the cheap for a website of mine. My bank uses this sort of grid-based OTP system, so I wanted to emulate it in my application: Cards are ...
1
vote
1answer
159 views

How can LastPass enforce 2-factor authentication

I've recently started using LastPass and one of the things you can set as a policy for you password vault is Prevent offline access when using Google Authenticator. The local cache can be ...
3
votes
1answer
188 views

Do non-browser clients work around Gmail's 2-factor authentication?

If you use a client like mutt to access your mail, you probably know that it doesn't support 2-factor authentication. It still prompts only for a password - either your account password or, in the ...
0
votes
0answers
52 views

Generating backup codes for a 2FA implementation

I have implemented the login/verification aspect of a two factor auth system as per RFC 6238. It works fine with Google Authenticator, which is great. Now I am turning my attention to the backup ...
0
votes
1answer
28 views

How VIP card helps in verification? [duplicate]

How does the 6 digit randomly generated security code from (disconnected) Verisign Identity Protection card help in verification/validation of any user? Why one cannot enter any random 6 digit ...
3
votes
3answers
127 views

Is login limiting still needed if we employ multi-factor authentication?

The status quo is that most online websites limit login attempts per IP address, or even per account since some attackers possess huge amounts of IP addresses. OWASP declares: When multi-factor ...
2
votes
1answer
40 views

Does RADIUS allow for eventual, gradual adoption of 2 Factor auth in an AD Environment?

We have several applications that leverage AD SAML (via Ping Federate) LDAP authentication from 3rd party applications Windows workstation / Exchange auth (Kerberos) IIS and web components ...
2
votes
3answers
116 views

Multi-factor auth: implementing a “don't ask again for this computer” function

Many sites that support multi-factor authentication provide a "do not ask me again for this computer" option. I'm hoping to gain some insight into how this feature could best be implemented. My ...
0
votes
2answers
132 views

Creating port-specific SSH authentication for the same user

I have a Linux server running SSHD and would like to know if its possible to configure it, such that from within the LAN you only need a RSA key to authenticate (on port X), but from outside the LAN ...
1
vote
2answers
591 views

Could “receive SMS online” site be a scam?

There is a site that allows you to see all SMS received by a certain set of phone numbers (owned by the site). This seems to be meant for services that require two-factor authentication using SMS, ...
1
vote
3answers
70 views

Is it ok to use the same password for many services with two-factor authentication?

Let's say that I've a relatively strong password, but I don't want to use many different passwords for each different service, and let's say that those services provide two-factor authentication using ...
10
votes
2answers
860 views

LastPass Grid Authentication vs Google Authenticator which one is more secure?

[Being a LastPass user] recently I moved to Google Authenticator instead of using Grid Authentication as a 2-factor security. For me, finding and filling letters from such a dense matrix is a rather ...
2
votes
2answers
130 views

Does Google 2-step verification protect user from session hijacking?

After signing in Google 2-Step verification scenario, user should enter verification code which sends to his mobile. Without it, he couldn't access to Gmail account. Consider an attacker does session ...
3
votes
6answers
264 views

Why not ask for a password and 2-factor token at the same time?

I have observed a number of web-based login forms that offer 2-factor authentication do token entry on a second form after validating your username and password. Is there a reason not to ask people ...
11
votes
2answers
1k views

Does having 2-factor authentication help with HeartBleed?

I was talking with a friend about HeartBleed, and he mentioned that he had 2-factor authentication enabled on all the sites that supported it, so even with his username and passwords, nobody would be ...
1
vote
0answers
40 views

Is there a TOTP variant that does not require the user to type in a code? [closed]

We're considering a 2 factor TOTP solution on a mobile phone. However, it would be much easier for the user to somehow send the OTP to the server by pushing a button, rather than manually typing in a ...
-1
votes
1answer
56 views

Is it applicable to use Google Authenticator against TEMPEST?

I would like to know about Multi-Factor Authentication is applicable for TEMPEST or not. Why I'm asking is I have suspicious matter every day also captured as log. My concern: It's possible to ...
0
votes
1answer
122 views

Using Gmail in China triggered lots of Two Factor SMS

A friend of mine lives in Hong Kong and she travelled to China over the weekend. Whilst there, she was able to use Gmail on her Android phone without logging in again, but she had to re-login on her ...
3
votes
2answers
2k views

How does Authy's 2FA work, if it doesn't connect to the server?

I thought I knew how two-factor authentication works: I enter the password. Server generates a random number (token) and sends it to me via SMS. I enter this token. Server checks that the token I ...
2
votes
2answers
67 views

HOTP/similar - how about standard backups of mobile devices?

I was considering adding HOTP as an option to my website (alongside things such as SMSed one time tokens which I already have). But I was considering one issue that HOTP inherently has: Things such ...
-6
votes
1answer
231 views

How can I succesfully pentest site with two factor authentication? [closed]

I want to use a commercial, automated tool but it cannot login successfully because the website requires a two factor authentication process using SMS. For testing, the SMS message is sent to another ...
4
votes
3answers
393 views

Does Google/Dropbox/Github Two-Step Verification count as Two-Factor?

This considers the route where somebody does not use the SMS option, but rather using TOTP, and the site offers a generated seed to input. Two factors questionably at use: password: something KNOWN ...
0
votes
4answers
200 views

Isn't it less secure to use something you are for authentication?

I have to think of this everyday when I close the doors of the shop I work in: A year ago we used to close the shop and arm the alarm using a key fob. This means the worst case scenario was that I ...
0
votes
1answer
138 views

Two-factor port-knocking via SMS (TXT)

It seems to me that a useful alternative or supplement to traditional port-knocking, fwknop, etc, for a system requiring only occasional access, would be to: Set up a one-time pad of keys, and a ...
32
votes
2answers
2k views

Why does Google cripple the 2FA Google Authenticator PAM module?

If you enable 2FA for Google Apps the shared secret is 160 bits. The google_authenticator PAM module on the other hand seems to use 80 bits for the shared secret. According to RFC 4226: R6 - The ...
0
votes
1answer
51 views

Securing data on a mobile device (even from the user/owner)?

I am writing an application to generate OTP codes for two factor authentication where I need to securely store data locally. This data must be secure from both the owner/user as well as intruders. I ...
1
vote
2answers
183 views

Does this show the need for a two-factor authentication?

I need some help for my understanding while reading through this authentication scheme in WEP. In a WEP authentication scheme, the station first sends a request for authentication. However, this ...
4
votes
2answers
562 views

Is OATH TOTP and / or Google Authenticator vulnerable if an attacker has (N) previous codes?

I'm not much of a ipsec initiate, so this is a bit over my head ... but I'm always willing to learn more. Are there any known attacks against OATH TOTP (Google Authenticator's / Authy's algorithm) if ...
5
votes
2answers
3k views

Does adding two-factor authentication by OTP really make KeePass more secure

KeePass is an application that keeps all your passwords for you in a database. It is primarily protected by a master password and/or keyfile. If the database is properly encrypted with that password ...
0
votes
1answer
174 views

What are techniques for end users to select keys on a smartcard?

When multiple keys exist on a given smartcard, how can a user choose between them for a given identifier ... ideally without a loss of privacy? For example suppose I have a government issued ID that ...
10
votes
4answers
688 views

What is the use of the “secret” displayed when setting up 2 Factor Authentication?

What is the purpose of the "secret" that is displayed when you take the picture of the QR code to set up 2 Factor Authentication on a non-Google site? Why would you need it? If you save it, doesn't ...
0
votes
2answers
380 views

Do Google 2 Factor Auth backup codes work for logging into Google or other sites?

I set up Google 2 Factor Auth to log into other sites. I see there are backup codes if you lose your device. Are these used only to log into Google, or can they be used to log into other sites?
-2
votes
2answers
395 views

Why doesn't Google 2 Factor Auth ask for a code? [closed]

I set up Google 2 Factor auth to use 2 Factor Auth with certain sites. But reading over the help suggests that Google 2 Factor Auth is only used to log into Google services like Gmail. But when I log ...
5
votes
4answers
572 views

One time password over SMS - exposing the Authentication Server to the internet

Consider a Internet Based Website which does authentication. The Web Application can do the authentication by calling an Authentication Server which is not connected to the internet. The ...
9
votes
2answers
488 views

NFC used in place of contact based smart card two-factor authentication

My organization is trying to move away from contact based smartcards (because our hardware vendor is no longer integrating them into their current systems) to some other form of two-factor ...
2
votes
2answers
645 views

How does Google detect new devices for two factor authentication

When you enable two step verification for google accounts, you get sent a code by SMS to enter in addition to your username and password the first time you log in with a new device. How do they ...
6
votes
2answers
354 views

Do keyfiles actually add any meaningful security in the presence of strong passwords?

In the context of protecting access to local encrypted files or devices against a determined (and competent) adversary, is there any reason to believe that the use of a key file actually presents a ...