a multi factor authentication requires at least two sets of credentials. This is typically something you know (e. g. a password) and something you own (e. g. a token generator or mobile phone)

learn more… | top users | synonyms (1)

26
votes
4answers
3k views

How is “something you have” typically defined for “two-factor” authentication?

A wide range of products claim to offer "two-factor authentication" (c.v. Two-factor authentication - Wikipedia). Most are deployed as "something you have" to be used in addition to a normal password ...
79
votes
6answers
20k views

How secure are the FIDO U2F tokens

Google and Yubico just announced the availability of cryptographic security tokens following the FIDO U2F specification. Is this just another 2FA option, or is this significantly better than solutions ...
22
votes
13answers
4k views

Why do we even use passwords / passphrases next to biometrics?

In the last couple of days there were a lot of talking about passwords and passphrases, not only here, but on several blogs and forums I follow (especially after XKCD #936 saw the light of this ...
13
votes
9answers
847 views

Anybody have additional information on the EMC RSA SecurID compromise?

The Security Advisory Press Release here doesn't have much information, the email that alerted me to this didn't help much more, and unfortunately I heard about the two Thursday evening conference ...
26
votes
4answers
7k views

What is a YubiKey and how does it work?

How do YubiKeys work? Are there any alternatives?
4
votes
1answer
786 views

How many authentication factors are there?

The three classes that we all know and love: Something you know. Something you have. Something you are. I've also seen references to "somewhere you are". Is this really a fourth factor? How many ...
73
votes
2answers
12k views

How did someone log-in to my Gmail account from Kenya?

While on holiday in France in May I received an email from Google "New sign-in". Your Google Account was just used to sign in: Nairobi, Kenya. Tuesday, 26 May 2015 22:10 (East Africa Time). ...
11
votes
6answers
6k views

Is tokenless (specifically SMS) 2FA a security compromise over OTP tokens?

I've been looking into the various pros/cons of tokenless (particularly SMS based) and traditional token based two-factor authentication (think RSA SecurID). After doing some research, I think I have ...
4
votes
1answer
1k views

Blackberry + RIM Bluetooth-based Smart Card Reader

Has anyone used this Bluetooth based smartcard reader? (scroll to bottom) If so, what are your experiences with it? Can you tell me if it's possible to require only the presence of the card + card ...
6
votes
3answers
7k views

Does adding two-factor authentication by OTP really make KeePass more secure

KeePass is an application that keeps all your passwords for you in a database. It is primarily protected by a master password and/or keyfile. If the database is properly encrypted with that password ...
2
votes
3answers
290 views

Multi-factor auth: implementing a “don't ask again for this computer” function

Many sites that support multi-factor authentication provide a "do not ask me again for this computer" option. I'm hoping to gain some insight into how this feature could best be implemented. My ...
58
votes
6answers
8k views

Four-factor authentication

I'm sure you've all heard of two-factor/multi-factor authentication. Basically it comes down to these factors: Knowledge - something you know (e.g. password, PIN, pattern) Possession - something you ...
29
votes
3answers
29k views

How does HSBC's “Secure Key” actually work?

My bank has recently sent me a Digipass/Secure Key, which looks like a tiny calculator. You press the green button to turn it on, type a PIN to unlock it, then press the green button again to generate ...
19
votes
4answers
1k views

Biometric versus other Two Factor Authentication Mechanisms

Over the years biometrics is the go-to movie authentication mechanism, but in the real world I'm getting conflicting opinions about it. Everything I've learned shows that biometrics are flawed ...
15
votes
4answers
5k views

Three-Factor Authentication for Windows

This HowToGeek article... http://www.howtogeek.com/67556/how-to-unlock-your-pc-by-being-nearby-with-a-bluetooth-phone/ ...got me thinking. Is there any software (or combination of software) that ...
10
votes
3answers
861 views

If multi factor authentication is enabled, how should that affect self-service password reset?

Given that security is only as secure as its weakest link, suppose I have website with additional authentication enabled in any of these ways: (example, multiple conditions may be required) ...
4
votes
1answer
201 views

What physical, electronic, and software characteristics are important in a smart card?

I'm evaluating smart card readers to store a number of private keys, but don't know where to start. What criteria is important regarding smart cards and preventing the extraction or unauthorized used ...
16
votes
1answer
1k views

Do any DNS registrars support multi factor authentication?

I am looking for a DNS registrar that supports strong multi-factor authentication. Does any DNS registrar support multi-factor? Is this a legitimate need?
14
votes
5answers
1k views

Safe way to authenticate (multi-factor authentication?) while being monitored?

(I'm trying for a bit more precise answer, particularly with regard to multi-factor authentication, than I received for "Safe way to use a computer that has spyware/keylogger installed?" on SU.) ...
8
votes
1answer
703 views

How safe is “trust this computer” option for websites?

Many sites have a "trust this computer" option that allows one to bypass some security measures (ex.: with Google's 2-step authentication enabled, one does not need to enter the phone's code if the ...
8
votes
3answers
270 views

What advantage does the Bloomberg authentication system have over traditional 2 factor?

Bloomberg clients have an interesting way to authenticate to the server. This seems involve some of the following: Logging into a secure website, that displays a flashing square Swiping your finger ...
7
votes
2answers
223 views

How to securely store and manage one-time backup codes for 2FA?

I am already using 31 services with 2nd factor authentication and the number is growing. In addition to having multiple authentication devices, I decided for or had to generate a separate set of ...
6
votes
3answers
277 views

Is there any point in using two step authentication if you have strong passwords?

If you are in the habit of using strong passwords (randomly generated by password manager) is there any point in using two step authentication? Assuming that 99% of the time that when you enter a ...
6
votes
6answers
1k views

Isn't it less secure to use something you are for authentication?

I have to think of this everyday when I close the doors of the shop I work in: A year ago we used to close the shop and arm the alarm using a key fob. This means the worst case scenario was that I ...
5
votes
3answers
911 views

Two-Factor Authentication: When is it worth it?

I was reading this article, and it triggered the question: Why not use two factor authentication? In his case, it both possibilities were enabled anyway, so this looks to me like it's two attack ...
0
votes
1answer
296 views

IP whitelisting as two factor authentication method for server access under PCI DSS

In the answer to my question: Two factor authentication for web application under PCI DSS gowenfawr stated: I have seen other methods used for 2FA than those you mention; IP whitelisting and ...
0
votes
2answers
748 views

Do Google 2 Factor Auth backup codes work for logging into Google or other sites?

I set up Google 2 Factor Auth to log into other sites. I see there are backup codes if you lose your device. Are these used only to log into Google, or can they be used to log into other sites?
11
votes
5answers
996 views

Non-OEM Biometric Software?

Most of us with fingerprint readers and such devices probably use the software provided by the vendor, to enable biometric OS login or single sign-on functionality. However, I've recently wondered if ...
10
votes
3answers
829 views

Steam and two-factor authentication

The Steam platform is designed to encourage users to use two-factor authentication. One of the community tasks (achievement-like objectives) on Steam is "Use the Steam Mobile App for two-factor ...
9
votes
2answers
2k views

How does Google detect new devices for two factor authentication

When you enable two step verification for google accounts, you get sent a code by SMS to enter in addition to your username and password the first time you log in with a new device. How do they ...
8
votes
2answers
2k views

Do keyfiles actually add any meaningful security in the presence of strong passwords?

In the context of protecting access to local encrypted files or devices against a determined (and competent) adversary, is there any reason to believe that the use of a key file actually presents a ...
3
votes
1answer
806 views

Is TextKey SMS 2 factor authentication secure against cell phone cloning?

I came across this website today that implements SMS based authentication that works "opposite" most SMS authentication methods. In typical SMS authentication, the provider sends you an access code ...
3
votes
1answer
975 views

Is Dual Factor possible during boot with whole disk encryption on Mac FileVault 2

Mac FileVault 2 is the default disk encryption for newer Macs that occurs in the EFI pre-boot phase. The challenge here is that most smartcard drivers are loaded after the OS loads. Is anyone aware ...
2
votes
2answers
374 views

Does Google 2-step verification protect user from session hijacking?

After signing in Google 2-Step verification scenario, user should enter verification code which sends to his mobile. Without it, he couldn't access to Gmail account. Consider an attacker does session ...
1
vote
1answer
128 views

How do banks determine when to ask for two factor authentication?

I was playing around with trying to figure out how my bank knows when to give me a two factor authentication prompt. I had originally thought it was based on my cookies and maybe my IP address. But ...
1
vote
1answer
83 views

Is selecting trusted computer in 2-step verification less secure?

In using 2-step verification, does selecting 'Trusted Computer' a less secure options? https://support.google.com/accounts/answer/2544838?hl=en If so, is it still a reasonably secure option?
1
vote
1answer
103 views

Securing data on a mobile device (even from the user/owner)?

I am writing an application to generate OTP codes for two factor authentication where I need to securely store data locally. This data must be secure from both the owner/user as well as intruders. I ...
0
votes
3answers
265 views

What is a good way to authenticate a user to websites and applications with a smart phone?

What would be a good way to authenticate a user to authenticate to websites and applications over a smart phone? By good, I mean that it is both secure, and user-friendly. Passwords don't seem to be ...
0
votes
1answer
466 views

Two factor authentication for web application under PCI DSS

PCI DSS 8.3 is stated as follows 8.3 Incorporate two-factor authentication for remote network access originating from outside the network by personnel (including users and administrators) and ...