a multi factor authentication requires at least two sets of credentials. This is typically something you know (e. g. a password) and something you own (e. g. a token generator or mobile phone)

learn more… | top users | synonyms (1)

2
votes
1answer
88 views

2FA: Difference between Storing Backup Codes & Secret Key

First of all, the secret key in discuss is the one when you cannot scan a QR code in a 2FA setup process, there is a code that you can manually entered into your TOTP-generating device/app. Some ...
1
vote
1answer
69 views

Doesn't this make 2FA irrelevant and possibly dangerous?

Article. One sentence summary: they use a smartphone as a listening device to compromise computer security. I know our bank doesn't allow us to take cell phones in at all, even if they're completely ...
29
votes
3answers
29k views

How does HSBC's “Secure Key” actually work?

My bank has recently sent me a Digipass/Secure Key, which looks like a tiny calculator. You press the green button to turn it on, type a PIN to unlock it, then press the green button again to generate ...
2
votes
2answers
56 views

What is the safer Google account recovery option?

I have a Google account with a strong password and 2-factor authentication set up, and I worry about what would happen if I lost my phone with the 2FA app. I want to set up a recovery option, and I ...
1
vote
2answers
99 views

Hacked, is my IOS systems safe?Werid things? [closed]

I hope this finds you well. I wanted to thank you in advance for your time and patience with me, and my questions. I was Hacked by friends of an X-boyfriend from HighSchool. He was a Foriegn ...
4
votes
2answers
78 views

Out of band verification using phone; a fallacy?

More and more websites nowadays require new users to verify their 'identity' by requesting the user prove that he/she has access to a device identified by a telephone number (typically a phone). The ...
0
votes
2answers
69 views

Malware able to “read” one's screen

I was searching online about multifactor authentication. One of the reasons that people recommend it is because they fear someone may use a keylogger to "steal" their password, so they use one more ...
7
votes
2answers
223 views

How to securely store and manage one-time backup codes for 2FA?

I am already using 31 services with 2nd factor authentication and the number is growing. In addition to having multiple authentication devices, I decided for or had to generate a separate set of ...
1
vote
1answer
22 views

How to reliably backup to cloud services without hampering security?

There is a huge number of articles advising to enable two-factor authentication on sensitive cloud services. I understand the benefits for my accounts' security, but doesn't it defeat the purpose of ...
5
votes
1answer
93 views

Can I use a satellite phone for 2 factor auth sms and such?

Would 2 factor authentication SMS messages or other kinds of internet security notifications work with satellite phones? E.g. companies like Google, Paypal, Facebook, banking institutions and others ...
2
votes
1answer
46 views

Accounts being accessed from X country

So recently I've been getting emails that X account has been accessed from Y country with an IP address that I obviously don't own. An example would be my Steam account which recently got accessed ...
1
vote
1answer
55 views

What are the privacy implications of using Yubico OTP with YubiCloud?

I am considering purchasing Yubikey devices (made by Yubico) to add two-factor authentication when my users ssh to our various servers. I figured I would configure the device to use Yubico OTP with ...
7
votes
3answers
135 views

Why do Google 2-factor authentication SMS codes never start with a 0? [closed]

When you use 2-step authentication to log to your Google Account, you can get an SMS on your mobile-phone with a G-123456 style code. I think that I never got a code with a leading zero. Is there a ...
4
votes
2answers
173 views

Authy: Does multi-device mode imply that all keys are stored on their servers?

My understanding is that if you use Authy, without backups/multi-device options, none of your account keys are stored on their servers. It all resides on your single device. Ie, even if Authy ...
3
votes
1answer
808 views

Is TextKey SMS 2 factor authentication secure against cell phone cloning?

I came across this website today that implements SMS based authentication that works "opposite" most SMS authentication methods. In typical SMS authentication, the provider sends you an access code ...
6
votes
1answer
310 views

How to solve race condition in 2-factor authentication solutions like RSA Security tokens or Google Authenticator?

One of the reasons we opt to use 2-factor authentication is to minimize the impact of keyloggers. The theory is that even if an attacker is able to observe the user type in the token numbers, they ...
3
votes
1answer
52 views

Relative merits of Yubico OTP vs. OATH-HOTP?

What are the pros and cons of using Yubico OTP vs. OATH-HOTP? They both seem very similar.
7
votes
1answer
2k views

How to fix a repeatedly hacked gmail account (where 2FA is enabled and passwords are changed)?

A friend of mine came to me for help with this issues. Her Gmail account has been hacked and keeps sending out spam emails to her contacts. This is happening to her on a monthly basis. Each time it ...
2
votes
4answers
125 views

Justifying strong 1st factor in the context of multi factor authentication — beyond passwords

I am wondering if you need strong 1st factor (for theoretical correctness, please note it is the knowledge factor -- not necessarily a password, but definitely also includes strong passwords)? What ...
5
votes
2answers
348 views

How secure is a password app that stores both the password and two factor secret in one place?

Take for example 1Password, that now can store your password and one time password secret in a single place (your 1Password vault). I know it isn't truly two-factor anymore, but how much better is it ...
6
votes
1answer
74 views

Are Push 2FA methods safe from Android and iOS Malware?

I am doing a survey on various 2FA solutions, and recently I came across “Push” 2FA (e.g Duo Security). In this solution, the site (e.g. a banking site) pushes a notification to the user’s mobile ...
8
votes
5answers
10k views

What are the ways to implement two factor authentication?

We have devices that can generate tokens. So we can use tokens with passwords to perform two factor authentication. There are many ways to implement such systems to enhance security. One of two I ...
0
votes
5answers
725 views

SSH server: What's more secure, pub key auth or Google Authenticator time-based auth?

I'm curious which would be more secure, pub key authentication or 2-factor auth via Google Authenticator. Apparently I can't use both. If I have pub key authentication, the Google Auth PAM module ...
2
votes
2answers
58 views

Is email OTP improving the security for 2 phase authentication?

There has been similar questions before where people say that using some other means (sms, hardware devices, etc.) is a more secure way to provide 2 factor authentication. Provided we don't have an ...
4
votes
6answers
316 views

When should I issue more than one multi-factor device to a user? Is it OK to give several active tokens vs none at all?

Most of the conventional IT.Sec thinking I've seen says that a user can only have one multi factor authentication device. I'd like to challenge that defacto-thinking and ask if there is ever an ...
6
votes
3answers
278 views

Is there any point in using two step authentication if you have strong passwords?

If you are in the habit of using strong passwords (randomly generated by password manager) is there any point in using two step authentication? Assuming that 99% of the time that when you enter a ...
1
vote
1answer
513 views

What regulations *require* multi-factor authentication?

What industries require multi-factor authentication? Please include the following information: Country Industry Regulation name Additional information as you see relevant. Some additional ...
1
vote
2answers
91 views

Does two factor authentication increase the attack surface?

Would adding two factor authentication to an application increase the attack surface of this application? I think it would, since by adding complexity the likelihood of a vulnerability in my ...
26
votes
4answers
7k views
0
votes
1answer
43 views

2 step authentication hybrid

I'm all forward on 2 step authentication. I understand how it is way more secure than a simple password. However I'm always afraid to start using it because I believe that in some cases I could be ...
1
vote
0answers
98 views

Steam two-factor authentication algorithm? [closed]

I'm all on-board that Value is recently pushing for two-factor authentication on Steam accounts. I'm not happy that they force you to use the Steam mobile app because both on iOS and Android, it's a ...
10
votes
3answers
830 views

Steam and two-factor authentication

The Steam platform is designed to encourage users to use two-factor authentication. One of the community tasks (achievement-like objectives) on Steam is "Use the Steam Mobile App for two-factor ...
2
votes
2answers
132 views

What are reasonable alternatives to “Trust this computer” prompts when signing in?

User feedback for a bank authentication website included this comment: It's annoying to get verification codes to my email or phone every time I log in to my Bank account from a new device ...
79
votes
6answers
21k views

How secure are the FIDO U2F tokens

Google and Yubico just announced the availability of cryptographic security tokens following the FIDO U2F specification. Is this just another 2FA option, or is this significantly better than solutions ...
6
votes
1answer
278 views

Using Two-Factor Authentication to Stop Pass-the-Hash

Am looking into mitigations to Pass+the-Hash and Pass-the-Ticket in Active Directory that also improve overall network security, too. Have sorting through some of the many two+factor authentication ...
3
votes
2answers
83 views

Multi-factor authentication - email link

I'm trying to understand possible issues with the approach of sending the MFA one-time-token to the user as a clickable link in the email. Instead of submitting the OTP on the web page, user will ...
4
votes
2answers
106 views

Can Simultaneous Logins Occur When Two Users Have Both Pieces Of Two-Factor Authentication Information?

In a hypothetical situation (say a screen capture program or rootkit, where, incidentally, a password change will not make any difference) where an attacker has both your password, and sees the ...
3
votes
1answer
48 views

Gmail twofactor auth on untrusted computer

Let's say I log in to gmail on untrusted computer using two factor auth in Google Chrome in incognito mode. Hypothetically some virus can read my email after this even without knowing password (.dll ...
1
vote
4answers
73 views

Someone tried to log into my mail - what do I do?

I have a 2-step verification system for both my gmail accounts. Today, I received a message with a code when I wasn't trying to log in. So someone has my password. What's my next step here? What ...
5
votes
3answers
167 views

Does a Smartphone contain all the essential properties of a Smartcard? If not, what is missing?

Can a smartphone, alone, be a valid substitute for a Smartcard? If not, what is missing technically speaking? Does the TPM chipset (which I assume is in the phone) provide enough security to "act ...
5
votes
3answers
278 views

How do Pentesters approach attacking 2FA (two factor authentication)?

I'm looking for practical ways to attack 2FA. What do you need to consider and how would you go about testing the effectiveness of 2FA? My only thoughts are that you would attack the implementation ...
16
votes
1answer
1k views

Do any DNS registrars support multi factor authentication?

I am looking for a DNS registrar that supports strong multi-factor authentication. Does any DNS registrar support multi-factor? Is this a legitimate need?
10
votes
5answers
437 views

Two passwords provide better security than two-factor authentication?

While evaluating 1Password's new Teams service, I noticed rather curious absence of support for multifactor authentication. When asked about the lack of MFA, they replied: We use an Account Key ...
1
vote
2answers
79 views

Importance of Lastpass User Vaults Statement and Two-Factor Authentication

The Lastpass breach statement reassures folks who had two-factor authentication enabled and recommends it for all users. I also note that they explain that there is no evidence that the encrypted user ...
3
votes
1answer
68 views

Can two TOTP clients register at the same time and generate the same tokens?

Note that I'm not talking about systems like Authy, where you can log in to your account on multiple devices and sync your tokens between them -- I'm referring to two completely separate devices that ...
22
votes
13answers
4k views

Why do we even use passwords / passphrases next to biometrics?

In the last couple of days there were a lot of talking about passwords and passphrases, not only here, but on several blogs and forums I follow (especially after XKCD #936 saw the light of this ...
73
votes
2answers
12k views

How did someone log-in to my Gmail account from Kenya?

While on holiday in France in May I received an email from Google "New sign-in". Your Google Account was just used to sign in: Nairobi, Kenya. Tuesday, 26 May 2015 22:10 (East Africa Time). ...
5
votes
1answer
277 views

YubiKey or Google authenticator?

I'm using lastpass and I would like to implement a 2FA in my account, but I don't know which one is the most secure, a software authenticator such as google authenticator or an USB device as Yubikey. ...
2
votes
1answer
102 views

OTP on the same device being used to login

I've seen mobile apps use two factor authentication by sending an SMS to the mobile phone. However, if I've stolen someone's phone, where is the security advantage? I can understand it if it's used in ...
2
votes
1answer
98 views

Why is the 2nd step in two-step authentication not a single click? [closed]

The case I'm using Google 2-Step Verification. The question Why does Google use a code as second step? Why not just an android app where you can click "It's me"?