a multi factor authentication requires at least two sets of credentials. This is typically something you know (e. g. a password) and something you own (e. g. a token generator or mobile phone)

learn more… | top users | synonyms

-1
votes
1answer
200 views

Does PayPal support a backup code for two-factor auth? [closed]

Google and DropBox have backup codes in case you can't get access to one of the devices you have registered. Does PayPal have a backup code?
5
votes
1answer
277 views

How safe is “trust this computer” option for websites?

Many sites have a "trust this computer" option that allows one to bypass some security measures (ex.: with Google's 2-step authentication enabled, one does not need to enter the phone's code if the ...
4
votes
5answers
265 views

When should I issue more than one multi-factor device to a user? Is it OK to give several active tokens vs none at all?

Most of the conventional IT.Sec thinking I've seen says that a user can only have one multi factor authentication device. I'd like to challenge that defacto-thinking and ask if there is ever an ...
5
votes
1answer
219 views

How to solve race condition in 2-factor authentication solutions like RSA Security tokens or Google Authenticator?

One of the reasons we opt to use 2-factor authentication is to minimize the impact of keyloggers. The theory is that even if an attacker is able to observe the user type in the token numbers, they ...
4
votes
1answer
431 views

Can I re-use another vendor's dual factor token in my own system? (Avoid physical token bloat)

I read the open source multifactor authentication techniques called HOTP RFC 4226 and TOTP RFC 6238 and realized that a single random number is the basis for the token's cryptography... and that this ...
3
votes
2answers
151 views

Should the serial number of multi factor devices be removed?

I'm trying to understand the relationship between the serial number of a multi factor device and the cryptographic material behind it. I don't want to blindly assume that the serial number is just ...
2
votes
1answer
3k views

Is it secure to install RSA SecurID Software Tokens on the same computer that will be used to access the VPN?

My office switched from using the old hardware RSA SecurID key tokens to the RSA SecurID Software Tokens and most users have them installed on the same machines they use to access the VPN. I asked ...
1
vote
1answer
511 views

How does the YubiKey Validation Server work from an encryption perspective?

Many YubiKey servers rely on the free cloud hosted authentication that comes with the product, but I'm interested in keeping all cryptographic material in my control. For that reason I am looking at ...
17
votes
2answers
1k views

Which SSH security is stronger? 2 Factor or Public key

For SSH authentication, which is more secure? 2 Factor Authentication using a USB token/Google Authenticator(time based) OR Public/private key with password Or could they be both used at the same ...
4
votes
1answer
130 views

What physical, electronic, and software characteristics are important in a smart card?

I'm evaluating smart card readers to store a number of private keys, but don't know where to start. What criteria is important regarding smart cards and preventing the extraction or unauthorized used ...
14
votes
3answers
813 views

Do any DNS registrars support multi factor authentication?

I am looking for a DNS registrar that supports strong multi-factor authentication. Does any DNS registrar support multi-factor? Is this a legitimate need?
6
votes
5answers
616 views

Is behavioural analysis (e.g. keystroke dynamics) a reliable security mechanism for MFA?

The typical set of multi-factor categories is as follows: Something you know (e.g. a password) Something you have (e.g. a hardware token, or key file) Something you are (e.g. a fingerprint or retina ...
6
votes
2answers
745 views

Does having a passphrase and SSH key qualify as two factor authentication for PCI?

I am working on getting our company's servers PCI SAQ-C compliant (credit card data passes through our system but is not stored by our system). We have SSH access to administer the servers and all ...
2
votes
1answer
492 views

Is Dual Factor possible during boot with whole disk encryption on Mac FileVault 2

Mac FileVault 2 is the default disk encryption for newer Macs that occurs in the EFI pre-boot phase. The challenge here is that most smartcard drivers are loaded after the OS loads. Is anyone aware ...
4
votes
3answers
637 views

Two-Factor Authentication: When is it worth it?

I was reading this article, and it triggered the question: Why not use two factor authentication? In his case, it both possibilities were enabled anyway, so this looks to me like it's two attack ...
16
votes
3answers
11k views

How does HSBC's “Secure Key” actually work?

My bank has recently sent me a Digipass/Secure Key, which looks like a tiny calculator. You press the green button to turn it on, type a PIN to unlock it, then press the green button again to generate ...
23
votes
11answers
2k views

Is it safe to use a weak password as long as I have two-factor authentication?

I'm careful to use strong passwords (according to How Big is Your Haystack, my passwords would take a massive cracking array 1.5 million centuries to crack), I don't reuse passwords across sites, and ...
7
votes
6answers
827 views

POP3/IMAP Stronger Authentication

We recently deployed a two-factor-authentication solution in order to strength logon to our web applications (one of them is web based mail, Microsoft outlook web access) Most of the users who have ...
4
votes
4answers
667 views

SMS Authentication: random OTP or a cryptographic one

I'm adding two-factor authentication using SMS to enhance an existing login process. Since I'm not working with physical tokens, I was wondering what is considered the safest: Sending random 8 ...
3
votes
3answers
204 views

Is multi-factor authentication supported by any current bios?

Is multi-factor authentication supported by any current bios'es? Update What I want to do is to make it impossible to go into the bios setup without both a password and another factor. It would ...
6
votes
2answers
2k views

How do I protect my Gmail account when accessing it via an Android smartphone?

I have a Gmail account that I also access via an Android smartphone. The mail account could be used to reset passwords for other online accounts, so I want to tighten up the security around this ...
10
votes
2answers
4k views

What is a Yubi key and how does it work?

How do Yubi keys work? Are there any alternatives?
4
votes
1answer
2k views

Which cross-platform password managers support encryption using a hardware token?

I am looking for a really secure password manager and I really like the fact that Password Safe supports encryption/decryption using a Yubikey programmed in challenge-response mode. Read more here: ...
7
votes
6answers
3k views

Is tokenless (specifically SMS) 2FA a security compromise over OTP tokens?

I've been looking into the various pros/cons of tokenless (particularly SMS based) and traditional token based two-factor authentication (think RSA SecurID). After doing some research, I think I have ...
6
votes
2answers
3k views

Full disk encryption and multi-factor authentication

All serious full disk encryption schemes I have looked into use a static password for authentication. For example, TrueCrypt supports two-factor authentication with keyfiles, but not for system ...
4
votes
5answers
735 views

Do any organizations use Smart Cards other than the military?

The military's Common Access Card (CAC) seems legit. Do other companies/organizations employ their use? If not, why? UPDATE What are the pros/cons of smart cards, compared to other methods?
5
votes
2answers
1k views

How does multi factor authentication modify the AD authentication process?

I'm trying to understand what would have to be updated to make Windows-based systems support multifactor authentication. Possible things that might have to be modified: Active Directory / Domain ...
1
vote
1answer
111 views

Should the email server/application be protected by 2 factor authentication? What applications should be protected?

When should email be protected by 2 factor authentication? Suppose a given company is in an industry where two factor authentication is offered to some or all of its clients. Does this mean that it ...
0
votes
1answer
290 views

What regulations *require* multi-factor authentication?

Just the straightforward question: What industries require multi-factor authentication? Please include the following information Country Industry Regulation name Additional information as you ...
2
votes
2answers
391 views

Restrict user login to a specific machine

How do you restrict user access to a corporate web site to a particular machine ? including the following conditions : Each user is meant to use his credentials ONLY from the assigned machine. The ...
2
votes
2answers
2k views

Synchronous and Asynchronous physical security tokens: which is stronger? pros/cons?

I'm thinking about the differences between physical authentication tokens such as RSA's synchronous physical tokens or asynchronous challenge/response, like Google's gmail direct-to-phone codes. At ...
4
votes
1answer
364 views

How many authentication factors are there?

The three classes that we all know and love: Something you know. Something you have. Something you are. I've also seen references to "somewhere you are". Is this really a fourth factor? How many ...
14
votes
6answers
6k views

How to implement multi factor authentication using a token generator?

I'd like to implement multi factor authentication on a few projects. Now the first factor would be username and password, for the second factor I would like to use a token generator. These tokens ...
3
votes
2answers
223 views

How to evaluate different solutions for security tokens?

According to my own experience, most companies selling security tokens for authentication like RSA, Verisign or Aladdin share little information about the internals of their products like algorithms ...
18
votes
12answers
2k views

Why do we even use passwords / passphrases next to biometrics?

In the last couple of days there were a lot of talking about passwords and passphrases, not only here, but on several blogs and forums I follow (especially after XKCD #936 saw the light of this ...
15
votes
5answers
797 views

Safe way to authenticate (multi-factor authentication?) while being monitored?

(I'm trying for a bit more precise answer, particularly with regard to multi-factor authentication, than I received for "Safe way to use a computer that has spyware/keylogger installed?" on SU.) ...
15
votes
5answers
829 views

Does two factor authentication prevent social engineering attacks

After reading this article from symantec I got to think how much all these social engineering techniques rely on the authentication system of users, a password. Considering three different additional ...
14
votes
4answers
3k views

Three-Factor Authentication for Windows

This HowToGeek article... http://www.howtogeek.com/67556/how-to-unlock-your-pc-by-being-nearby-with-a-bluetooth-phone/ ...got me thinking. Is there any software (or combination of software) that ...
25
votes
4answers
2k views

How is “something you have” typically defined for “two-factor” authentication?

A wide range of products claim to offer "two-factor authentication" (c.v. Two-factor authentication - Wikipedia). Most are deployed as "something you have" to be used in addition to a normal password ...
7
votes
3answers
1k views

How does LastPass' grid multi-factor authentication work behind the scenes?

I understand how to use the Grid multi-factor authentication as a user but how does it work technically? Specifically how can just a few letters from the grid be enough to decrypt any secret defined ...
4
votes
4answers
840 views

Are there consumer-grade VPN services that support two-factor authentication, like SecurID?

I'd like to increase my VPN security, and Google hasn't turned up anything with regard to VPN services and SecurId. Does anyone know of services like this?
13
votes
9answers
721 views

Anybody have additional information on the EMC RSA SecurID compromise?

The Security Advisory Press Release here doesn't have much information, the email that alerted me to this didn't help much more, and unfortunately I heard about the two Thursday evening conference ...
16
votes
11answers
2k views

2 factor authentication - cost effective solution for a web startup

My local bank uses a 2 factor authentication where customers key in password AND a One Time PIN delivered via SMS to mobile phone OR from a security token device. I am doing a web startup in the ...
4
votes
1answer
808 views

Blackberry + RIM Bluetooth-based Smart Card Reader

Has anyone used this Bluetooth based smartcard reader? (scroll to bottom) If so, what are your experiences with it? Can you tell me if it's possible to require only the presence of the card + card ...
17
votes
4answers
881 views

Biometric versus other Two Factor Authentication Mechanisms

Over the years biometrics is the go-to movie authentication mechanism, but in the real world I'm getting conflicting opinions about it. Everything I've learned shows that biometrics are flawed ...
0
votes
0answers
263 views

Is there software available for two-factor, biometric authentication to the OS?

Many fingerprint readers and other biometric authentication devices come with software for single-factor authentication to the OS. Is there any third-party software (F/OSS or otherwise) available for ...
11
votes
5answers
685 views

Non-OEM Biometric Software?

Most of us with fingerprint readers and such devices probably use the software provided by the vendor, to enable biometric OS login or single sign-on functionality. However, I've recently wondered if ...
7
votes
4answers
2k views

(SoHo) Multi-Factor Authentication for Remote Desktop Gateway

I am looking at implementing some sort of multi-factor authentication for a Remote Desktop Gateway at a small office (less than 20 users). Where would be a good place to start for a quality, ...
16
votes
3answers
1k views

Multi factor authentication on Ubuntu workstations, where to start?

Is it possible to have Ubuntu users log in with multi-factor authentication? I was thinking of a combination of pass(word|code) and smartcard (with screen locks when for example smart-card is removed) ...