a multi factor authentication requires at least two sets of credentials. This is typically something you know (e. g. a password) and something you own (e. g. a token generator or mobile phone), but could also be something you are (a biometric).

learn more… | top users | synonyms (2)

-1
votes
3answers
95 views

Jump Servers for security

In my network, I have the clients directly connected to the server; but in the new PCI policies, they required to use jump servers. What is the advantage of using jump servers for security reasons? ...
0
votes
1answer
38 views

How To Stop A Mobile Verification Attack

I am thinking of using mobile phone number verification for the sign up step in my web application but how do I prevent a hacker or a malicious user from sending mobile verification requests to an ...
2
votes
2answers
94 views

HOTP/similar - how about standard backups of mobile devices?

I was considering adding HOTP as an option to my website (alongside things such as SMSed one time tokens which I already have). But I was considering one issue that HOTP inherently has: Things such ...
11
votes
4answers
7k views

Does adding two-factor authentication by OTP really make KeePass more secure

KeePass is an application that keeps all your passwords for you in a database. It is primarily protected by a master password and/or keyfile. If the database is properly encrypted with that password ...
0
votes
2answers
28 views

Use Public Key or Password and PAM verification code

So I've been reading more and more about how (relatively) easy it is to have your Ubuntu server compromised and suffice to say have become a tad paranoid by this fact. I've setup Multi Factor ...
0
votes
2answers
58 views

Is it less secure to require password and phone on sign in?

I'm concerned about the security of a system that requires its users to enter both their "email & password" and also their registered phone number which has to be verified upon each login. To me ...
19
votes
11answers
4k views

2 factor authentication - cost effective solution for a web startup [closed]

My local bank uses a 2 factor authentication where customers key in password AND a One Time PIN delivered via SMS to mobile phone OR from a security token device. I am doing a web startup in the ...
23
votes
14answers
4k views

Why do we even use passwords / passphrases next to biometrics?

In the last couple of days there were a lot of talking about passwords and passphrases, not only here, but on several blogs and forums I follow (especially after XKCD #936 saw the light of this world)....
0
votes
0answers
34 views

Regarding 2 factor authentication and adding new devices. Which one of these is safer?

Let's say I have a mobile device with google authenticator which uses TOTP, which I use everytime to log in into my personal accounts. If I want to add a second device. I would need to have access to ...
1
vote
0answers
27 views

What's the best way to implement phone-based 2FA

Some websites (for ex. Google) call you and you hear an recorded number, which you have to type in your computer. Some websites (for ex. Amazon) display a number on your computer which you have to ...
17
votes
6answers
3k views

What extra security does a 2-step website login process with a PIN provide?

I am currently working on a web application with a significant security risk attached to its function. We're using Microsoft Identity Framework to handle user logins, with the system forcing strong ...
-1
votes
1answer
58 views

Secure PIN verification if HTTPS is decryptable by third party

I'm developing a system where mobile applications communicate with server through HTTPS. The communication consists of two phases: at first, app "registers" at server: among other stuff, user chooses ...
3
votes
1answer
85 views

How safe is this “Multidimensional-Encryption method” (includes xAES, familiar from Unseen.is)?

I would like to ask about this encryption method that I found: USPTO patent and it is related to this question here: A service that claims beyond army level encryption Didn't see any updates on this ...
2
votes
3answers
63 views

Is using the 2FA secret on the same machine as using the credentials, removing one factor of 2FA?

In other words: Is saving or using the two-factor authentication (2FA) secret on the same machine to generate one-time passwords (OTP), breaking the two-factor authentication (2FA) concept since it's ...
2
votes
3answers
320 views

Multi-factor auth: implementing a “don't ask again for this computer” function

Many sites that support multi-factor authentication provide a "do not ask me again for this computer" option. I'm hoping to gain some insight into how this feature could best be implemented. My ...
-3
votes
2answers
78 views

How is two step authentication done in Europe without SMS?

I've heard that SMS use in Europe isn't even close to how much it's used in the US. How do they do two step authentication when a user forgets their password? Is it as simple as just using a robocall ...
3
votes
3answers
103 views

What security does the new option for two factor authentication that Google offers enforce?

Google has announced a new option for two factor authentication - a popup message. How does this improve security?
13
votes
4answers
2k views

Which verification method should I choose: SMS or call?

I want to enable Two-Factor Authentication for my outlook account, but I'm not sure which method should I choose or in other words which method is more secure? Like I said there are two options: text ...
2
votes
2answers
71 views

Periodic password change needed when using 2-step verification?

I know that it's considered good online security hygiene to change one's login passwords every 6 months or so. Is that needed on sites with 2-step verification? Isn't the 2nd step what will keep my ...
33
votes
6answers
2k views

Why don't PGP and SSH keys see more widespread use as a second factor when authenticating?

One of the major up-and-coming MFA methods is U2F, which relies on an initial key exchange and challenge-response mechanism. It's a relatively new protocol, and is only starting to see more ...
-1
votes
5answers
183 views

Is it possible to bypass two step authentication process?

Is it possible for a hacker to bypass two step authentication process if the hacker has no physical access to my phone?
2
votes
2answers
97 views

For 2FA, is one method better (more secure) than another?

There are a variety of options available for 2FA - LastPass, for example, offers all of the following options: LastPass Authenticator Duo Security Authentication Google Authenticator Yubikey ...
8
votes
3answers
325 views

How to securely store and manage one-time backup codes for 2FA?

I am already using 31 services with 2nd factor authentication and the number is growing. In addition to having multiple authentication devices, I decided for or had to generate a separate set of one-...
7
votes
2answers
138 views

Why not make the second factor the only factor? [duplicate]

Most websites use a single-factor based authentication mechanism, the password. Some popular websites, however, also implement an (often optional) two-factor mechanism to log in; usually requiring the ...
62
votes
5answers
5k views

Do 2FA sites leak info by confirming a correct password guess?

Here's my relatively layman's view of the issue. Many websites tout multifactor authentication (MFA) as an enormous boost to the security of users' accounts, and it can be if implemented properly. ...
3
votes
3answers
80 views

Additional confirmation for online bank payments

Nowadays, when someone is making an online payment, the associated bank often requires an authentication step. As far as I know, there are mainly two ways to do this: SMS Verification. The Bank ...
1
vote
1answer
84 views

Pro's and Con's of current 2-step-verification processes?

I am currently working on a project, and we are exploring different types of current industry MFA standards. The most known ones would most likely be HOTP & TOTP pins, which are used in the '...
6
votes
4answers
113 views

How can I protect my credit card on sites where 2FA is not an option?

I'm using Visa Express, and sometimes when I'm shopping, the store doesn't support Verified by Visa - so that means that there is no 2FA option. Normally when there is that option, it will force me ...
0
votes
0answers
69 views

TOTP: Storing symmetrical secrets

I'm in the process of researching 2fa methods for a cloud connected physical access control system. There is very little margin for error in this space. Is it just me or does TOTP for two factor auth ...
1
vote
1answer
181 views

How Google Authenticator in Android mobile identifies this is the right SSH server?

I am new to Google Authenticator mechanism. I have gone through the basics of mechanism but I couldn't understood the logic behind it to make a connection to the Linux machine. I have a Linux machine ...
0
votes
0answers
13 views

AWS - CloudFormation - Enable MFA

Is there a way of using cloud formation to enforce MFA on user accounts in AWS: I have the following cloud-formation code: { "AWSTemplateFormatVersion": "2010-09-09" "Description": "...
0
votes
0answers
21 views

Is “full loop” and “half loop” authentication the right word to describe this 2FA sequence?

I'm looking for a term to describe this abstract thought about multifactor devices and how they are implemented. In the examples below, there are different levels of device authentication, but the ...
0
votes
0answers
32 views

From a credential flow perspective, whats the difference between FIDO UAF and FIDO 2.0 Web Services?

The FIDO Standard allows for devices and authentication schemes to be certified as UAF or U2F. This allows for flexible unified authentication, and optional second factor enrollment and registration. ...
15
votes
6answers
10k views

How to implement multi factor authentication using a token generator?

I'd like to implement multi factor authentication on a few projects. Now the first factor would be username and password, for the second factor I would like to use a token generator. These tokens ...
9
votes
2answers
3k views

How to fix a repeatedly hacked gmail account (where 2FA is enabled and passwords are changed)?

A friend of mine came to me for help with this issues. Her Gmail account has been hacked and keeps sending out spam emails to her contacts. This is happening to her on a monthly basis. Each time it ...
75
votes
2answers
12k views

How did someone log-in to my Gmail account from Kenya?

While on holiday in France in May I received an email from Google "New sign-in". Your Google Account was just used to sign in: Nairobi, Kenya. Tuesday, 26 May 2015 22:10 (East Africa Time). ...
0
votes
1answer
44 views

Protecting third-party credentials in a web database in light of weak passwords

I need to store third party credentials in a database for a web application. The third party supports OAUTH and I plan on getting a long-lived token to allow my app to access the third party, but I ...
1
vote
1answer
96 views

How is github 2FA personal access token more secure than passphrase?

I recently enabled 2-factor authentication (2FA) on my github account. Once you enable 2FA, you can no longer connect to the repo using your normal passphrase using command line tools. You have to ...
2
votes
4answers
269 views

What's the idea of two factor authentication? A hacker can use password with mobile

2-factor authentication means to enter MOBILE app (using username and password) and there you get code to enter your account from PC browser, right? But if hacker has my password, then he can enter ...
5
votes
3answers
236 views

Authy: Does multi-device mode imply that all keys are stored on their servers?

My understanding is that if you use Authy, without backups/multi-device options, none of your account keys are stored on their servers. It all resides on your single device. Ie, even if Authy ...
2
votes
1answer
61 views

Can I use Authenticator instead of phone number for Gmail 2FA? [closed]

I want to enable Two-Factor Authentication for my gmail accunt, but when setting this up it asks for my phone number. I don't have a phone (that I want to connect to Gmail), is there another way to ...
3
votes
1answer
147 views

2FA: Difference between Storing Backup Codes & Secret Key

First of all, the secret key in discuss is the one when you cannot scan a QR code in a 2FA setup process, there is a code that you can manually entered into your TOTP-generating device/app. Some ...
0
votes
1answer
81 views

Doesn't this make 2FA irrelevant and possibly dangerous?

Article. One sentence summary: they use a smartphone as a listening device to compromise computer security. I know our bank doesn't allow us to take cell phones in at all, even if they're completely ...
0
votes
0answers
27 views

Windows Server 2012 disable MFA for a single user?

I'm having issues with this for whatever reason. I created a new user and MFA is supposedly disabled but it doesn't seem to be true. Is there maybe something I've missed or is there an easier (more ...
31
votes
3answers
31k views

How does HSBC's “Secure Key” actually work?

My bank has recently sent me a Digipass/Secure Key, which looks like a tiny calculator. You press the green button to turn it on, type a PIN to unlock it, then press the green button again to generate ...
2
votes
2answers
62 views

What is the safer Google account recovery option?

I have a Google account with a strong password and 2-factor authentication set up, and I worry about what would happen if I lost my phone with the 2FA app. I want to set up a recovery option, and I ...
1
vote
2answers
112 views

Hacked, is my IOS systems safe?Werid things? [closed]

I hope this finds you well. I wanted to thank you in advance for your time and patience with me, and my questions. I was Hacked by friends of an X-boyfriend from HighSchool. He was a Foriegn ...
4
votes
2answers
97 views

Out of band verification using phone; a fallacy?

More and more websites nowadays require new users to verify their 'identity' by requesting the user prove that he/she has access to a device identified by a telephone number (typically a phone). The ...
0
votes
2answers
73 views

Malware able to “read” one's screen

I was searching online about multifactor authentication. One of the reasons that people recommend it is because they fear someone may use a keylogger to "steal" their password, so they use one more ...