Questions tagged [multi-factor]

a multi factor authentication requires at least two sets of credentials. This is typically something you know (e. g. a password) and something you own (e. g. a token generator or mobile phone), but could also be something you are (a biometric).

Filter by
Sorted by
Tagged with
137 votes
8 answers
70k views

How hard is it to intercept SMS (two-factor authentication)?

A lot of two-factor authentication mechanisms use SMS to deliver single-use passphrase to the user. So how secure is it? Is it hard to intercept the SMS message containing the passphrase? Do mobile ...
Paul Podlipensky's user avatar
133 votes
6 answers
48k views

How secure are the FIDO U2F tokens

Google and Yubico just announced the availability of cryptographic security tokens following the FIDO U2F specification. Is this just another 2FA option, or is this significantly better than solutions ...
tylerl's user avatar
  • 83.4k
32 votes
4 answers
5k views

How is "something you have" typically defined for "two-factor" authentication?

A wide range of products claim to offer "two-factor authentication" (c.v. Two-factor authentication - Wikipedia). Most are deployed as "something you have" to be used in addition to a normal password ...
nealmcb's user avatar
  • 20.8k
24 votes
4 answers
11k views

Is it secure to store a two factor authentication seed in a password manager?

I wonder whether it is really secure to store the Two Factor Authentication seed code (e.g. the secret key for TOTP) within a password manager together with the user and password for the service. If ...
Programie's user avatar
  • 341
40 votes
6 answers
15k views

Is it safe to store 2FA tokens together with passwords in 1password? [duplicate]

I'm using 1password and I've seen 1password allows you to store 2FA tokens in the same place where you store the password. I don't like the idea of having everything in the same place as if someone ...
Pau Chorro's user avatar
28 votes
14 answers
7k views

Why do we even use passwords / passphrases next to biometrics?

In the last couple of days there were a lot of talking about passwords and passphrases, not only here, but on several blogs and forums I follow (especially after XKCD #936 saw the light of this world)....
StupidOne's user avatar
  • 2,812
5 votes
1 answer
5k views

Maximum tries for 2FA code?

I am building a website and I am implementing two factor authentication (2FA). The second factor will be a random 6 digit code like those from Authy. This site will store very confidential information....
Eelke's user avatar
  • 516
39 votes
11 answers
11k views

Is it safe to use a weak password as long as I have two-factor authentication?

I'm careful to use strong passwords (according to How Big is Your Haystack, my passwords would take a massive cracking array 1.5 million centuries to crack), I don't reuse passwords across sites, and ...
Herb Caudill's user avatar
23 votes
6 answers
9k views

Is tokenless (specifically SMS) 2FA a security compromise over OTP tokens?

I've been looking into the various pros/cons of tokenless (particularly SMS based) and traditional token based two-factor authentication (think RSA SecurID). After doing some research, I think I have ...
dbr's user avatar
  • 435
19 votes
3 answers
3k views

2FA why not to ask the code before password

So in most websites on login page you have to input username and password for e.g. Facebook where you input username and password and then submit form. Other websites ask you each separately e.g. ...
vakus's user avatar
  • 3,853
60 votes
9 answers
61k views

Two-Step vs. Two-Factor Authentication - Is there a difference?

These days, there's pretty much three forms of authentication in general use on the web: Single-factor authentication, e.g.: PIN or password. Two-factor authentication, e.g.: Single-factor plus a ...
Iszi's user avatar
  • 27.1k
16 votes
3 answers
1k views

Should 2-factor authentication using SMS be deprecated?

Google, Facebook and most of the important websites (banks, payment sites, etc...) use SMS as the major method for 2FA or for controlling the account (password reset, etc..). However, GSM was proven ...
T.Todua's user avatar
  • 2,727
8 votes
2 answers
2k views

Is OATH TOTP and / or Google Authenticator vulnerable if an attacker has (N) previous codes?

I'm not much of a ipsec initiate, so this is a bit over my head ... but I'm always willing to learn more. Are there any known attacks against OATH TOTP (Google Authenticator's / Authy's algorithm) if ...
ELLIOTTCABLE's user avatar
5 votes
3 answers
2k views

Aren't endpoint devices inherently MFA?

I was recently asked if MFA was leveraged for authentication on endpoint devices. My gut reaction is that given MFA is something you have, know, are, and you need to have the laptop to log into it and ...
seePatCode's user avatar
25 votes
6 answers
7k views

Why do apps with phone verification send the user a message, rather than have the user send one to them?

Many apps allow the user to authenticate with their phone number, by having the user enter it, and then sending an SMS with a code to be entered into the app. Very few (if any that I can find still ...
George Green's user avatar
21 votes
4 answers
27k views

Does adding two-factor authentication by OTP really make KeePass more secure

KeePass is an application that keeps all your passwords for you in a database. It is primarily protected by a master password and/or keyfile. If the database is properly encrypted with that password ...
Jeff's user avatar
  • 3,609
20 votes
4 answers
4k views

Biometric versus other Two Factor Authentication Mechanisms

Over the years biometrics is the go-to movie authentication mechanism, but in the real world I'm getting conflicting opinions about it. Everything I've learned shows that biometrics are flawed ...
Steve's user avatar
  • 15.3k
15 votes
4 answers
15k views

Does IMAP/POP3/ASP undermine Two-Factor Auth?

When I log in to hotmail or Google or posteo I can only log in using the 2FA that I have set up. However, each provider seems to have an alternative for apps that do not auth via a web client. ...
CCXD's user avatar
  • 151
8 votes
3 answers
2k views

Two-Factor Authentication: When is it worth it?

I was reading this article, and it triggered the question: Why not use two factor authentication? In his case, it both possibilities were enabled anyway, so this looks to me like it's two attack ...
user857990's user avatar
8 votes
1 answer
3k views

Functional Google 2FA code (via SMS) received from a random (but in use) mobile phone number

tl;dr for those who are misunderstanding my post: imagine your friend who uses GMail suddenly tells you they have 2FA enabled, and logged in to their account, and that the 2FA code (SMS) they received ...
Dunois's user avatar
  • 181
86 votes
2 answers
20k views

How did someone log-in to my Gmail account from Kenya?

While on holiday in France in May I received an email from Google "New sign-in". Your Google Account was just used to sign in: Nairobi, Kenya. Tuesday, 26 May 2015 22:10 (East Africa Time). I ...
Colonel Panic's user avatar
68 votes
5 answers
44k views

What is a YubiKey and how does it work?

How do YubiKeys work? Are there any alternatives? Here is a picture of one:
Gabriel Fair's user avatar
  • 1,515
51 votes
5 answers
6k views

Should the average user with no special access rights be worried about SMS-based 2FA being theoretically interceptable?

Security experts are constantly discouraging users from using SMS-based 2FA systems, usually because of worries the auth code could be intercepted by an attacker, either through a SIM swap or a MitM ...
Nzall's user avatar
  • 7,433
27 votes
5 answers
2k views

Bank asked for a cross login?

I was creating a new bank account here in the US at HSBC's popular online bank... You know the step where you have to verify the account you're sending from, by receiving two small test payments? I ...
Fattie's user avatar
  • 273
14 votes
9 answers
1k views

Anybody have additional information on the EMC RSA SecurID compromise?

The Security Advisory Press Release here doesn't have much information, the email that alerted me to this didn't help much more, and unfortunately I heard about the two Thursday evening conference ...
Craig H's user avatar
  • 243
11 votes
3 answers
3k views

Why would password managers provide support for OTP codes? [duplicate]

Can anyone explain me what's this trend of providing passwords and OTP codes on the same service? What benefit or value are they trying to bring to the table? We, as security professionals, have been ...
user avatar
7 votes
1 answer
1k views

Is using desktop 2FA clients like Authy Desktop a good practice?

Basically 2FA relies on the idea that instead of just something you know, using a service also requires something you own. I am quite confident, especially when used on iOS (which has a better system ...
AsTeR's user avatar
  • 173
4 votes
1 answer
1k views

How many authentication factors are there?

The three classes that we all know and love: Something you know. Something you have. Something you are. I've also seen references to "somewhere you are". Is this really a fourth factor? How many ...
logicalscope's user avatar
  • 6,374
65 votes
5 answers
7k views

Do 2FA sites leak info by confirming a correct password guess?

Here's my relatively layman's view of the issue. Many websites tout multifactor authentication (MFA) as an enormous boost to the security of users' accounts, and it can be if implemented properly. ...
Ben Sandeen's user avatar
52 votes
10 answers
14k views

Is an SSH key with a passphrase a 2FA?

This is a really theoretical question, but if I use an SSH key with a passphrase to login on a server, could this be considered as a two-factor authentication (2FA)? Indeed, I need the SSH (private) ...
Antonin M.'s user avatar
27 votes
1 answer
17k views

What are the differences between the U2F and UAF FIDO authentication standards?

Google recently announced support for Universal 2nd Factor (U2F) authentication in Chrome and started allowing that authentication mechanism to be used for 2-factor authentication across their various ...
Ajedi32's user avatar
  • 4,753
25 votes
4 answers
7k views

What is the risk and mitigation of accidentally typing a YubiKey password in an open forum?

I have a YubiKey in my laptop (for testing) and accidentally broadcast my YubiKey password out to the Internet. Since this is only a test key, and has no access to anything of value, here are some ...
makerofthings7's user avatar
17 votes
4 answers
9k views

What is the use of the "secret" displayed when setting up 2 Factor Authentication?

What is the purpose of the "secret" that is displayed when you take the picture of the QR code to set up 2 Factor Authentication on a non-Google site? Why would you need it? If you save it, doesn't ...
B Seven's user avatar
  • 433
16 votes
2 answers
7k views

Is there a way to prevent hackers from using cookies to bypass two step verification?

Let's take Steam/Google/FB/Microsoft/Twitter logins as examples. All of them offer two step verification through SMS message. Let's say the hacker does not have access to my phone. But he has access ...
Steve's user avatar
  • 353
14 votes
1 answer
2k views

Could the Stack Overflow Dance Dance Authentication April Fool's joke actually work in a real environment?

Today, Stack Overflow released their April Fool's joke (a day early, but hey) involving Dance Dance Authentication. Essentially, it's logging you in by dancing in front of your PC, and it can ...
Nzall's user avatar
  • 7,433
10 votes
2 answers
881 views

Is there any point in using two step authentication if you have strong passwords?

If you are in the habit of using strong passwords (randomly generated by password manager) is there any point in using two step authentication? Assuming that 99% of the time that when you enter a ...
Dave's user avatar
  • 203
10 votes
2 answers
6k views

Authy - is my backup secured by only my password or 2FA s well

I've read around the Authy site and done a few Google searches, but it is not clear to me whether an attacker that compromised my Authy account backup password could access my keys without any ...
Steve Campbell's user avatar
7 votes
2 answers
299 views

Why not make the second factor the only factor? [duplicate]

Most websites use a single-factor based authentication mechanism, the password. Some popular websites, however, also implement an (often optional) two-factor mechanism to log in; usually requiring the ...
user avatar
7 votes
4 answers
7k views

Best practices for usefully storing two factor authentication backup codes?

For a lot of web services offering two factor authentication, after setting up the system, you are given a short list of backup codes (one-time pads) that are around 7-10 characters long. These are ...
0d0h0m0s's user avatar
5 votes
1 answer
474 views

Why is email 2FA not common?

SMS is a quite common, albeit insecure, 2FA method. Why is email not more common? If someone is using a computer, they almost certainly have an email address, while it is less certain that they have a ...
Someone's user avatar
  • 169
5 votes
3 answers
1k views

Multi-factor auth: implementing a "don't ask again for this computer" function

Many sites that support multi-factor authentication provide a "do not ask me again for this computer" option. I'm hoping to gain some insight into how this feature could best be implemented. My ...
GBC's user avatar
  • 716
4 votes
1 answer
1k views

Blackberry + RIM Bluetooth-based Smart Card Reader

Has anyone used this Bluetooth based smartcard reader? (scroll to bottom) If so, what are your experiences with it? Can you tell me if it's possible to require only the presence of the card + card ...
makerofthings7's user avatar
4 votes
4 answers
1k views

Is 2FA a false sense of extra security on a mobile phone?

I understand that 2FA increases security if you are using two different devices, for instance a computer and a mobile phone. I fail to understand how these security measurements help if you are doing ...
servi Servaas's user avatar
3 votes
2 answers
2k views

Is TextKey SMS 2 factor authentication secure against cell phone cloning?

I came across this website today that implements SMS based authentication that works "opposite" most SMS authentication methods. In typical SMS authentication, the provider sends you an access code ...
Johnny's user avatar
  • 1,438
2 votes
1 answer
432 views

Two factor authentication: Why ask for password first? [duplicate]

Every website that I came across that uses two-factor authentication asks the user for their password first. Then, after a correct password was entered, an SMS or an e-mail is sent that contains ...
Kijewski's user avatar
  • 149
1 vote
2 answers
618 views

Two factor authentication turned on for my Google account (Phone) - but still hacked

I just got a message today that someone changed my password on my Google account. The email seems legit, and Google confirmed there was a login from Ukraine two weeks ago in recent activity. The ...
Dirk Boer's user avatar
  • 117
99 votes
7 answers
17k views

Attacker circumventing 2FA. How to defend?

Detailed in the latest NSA dump is a method allegedly used by Russian intelligence to circumvent 2FA. (In this instance Google 2FA with the second factor being a code.) It’s a fairly obvious scheme ...
TheJulyPlot's user avatar
  • 7,829
88 votes
7 answers
22k views

Why is SMS used as a way of verifying a user's mobile, when it is not even encrypted in transit?

I did some research about how secure and private SMS messages are. Providers and governments can see these SMS messages in plaintext, but what is weird is that these messages are not encrypted in ...
Mohammed Rady's user avatar
67 votes
6 answers
15k views

Four-factor authentication

I'm sure you've all heard of two-factor/multi-factor authentication. Basically it comes down to these factors: Knowledge - something you know (e.g. password, PIN, pattern) Possession - something you ...
rink.attendant.6's user avatar
65 votes
6 answers
11k views

Is 2FA via mobile phone still a good idea when phones are the most exposed device?

Everyone knows that two factors are better than one. My problem is that often the only second factor allowed is text messages sent to your mobile phone. This creates two concerns: I travel frequently ...
functionalparanoia's user avatar