a multi factor authentication requires at least two sets of credentials. This is typically something you know (e. g. a password) and something you own (e. g. a token generator or mobile phone)

learn more… | top users | synonyms

1
vote
1answer
154 views

How secure is a password app that stores both the password and two factor secret in one place?

Take for example 1Password, that now can store your password and one time password secret in a single place (your 1Password vault). I know it isn't truly two-factor anymore, but how much better is it ...
2
votes
0answers
7 views

How secure is Certivox M-PIN?

CertiVox have designed a system with the aim of "getting rid of passwords". Essentially the system authenticates users with two factors of authentication: A 4 digit PIN and a token stored within the ...
2
votes
0answers
125 views

Remote Registry allows bypass of 2FA enforcement with 1FA

Some organizations will configure their Windows systems to require Smart Cards for all account logins, as part of a two-factor authentication implementation. However, this can easily be bypassed ...
1
vote
0answers
104 views

Soft tokens - multiple profiles on same smartphone

Some of our clients have started migrating to soft tokens instead of hardware ones for two-factor authentication to their network. We have apps like RSA SecurID and VIP Access on our smartphones. The ...
1
vote
0answers
80 views

Generating backup codes for a 2FA implementation

I have implemented the login/verification aspect of a two factor auth system as per RFC 6238. It works fine with Google Authenticator, which is great. Now I am turning my attention to the backup ...
0
votes
0answers
37 views

Additional security for services hosted on a 2FA or Multi-Factor Authenticated Network

I am aiming to lock down a web service that accesses other services and has a publicly facing UI. I have a hosted service on a network that requires 2-factor authentication to access. This service's ...
-2
votes
0answers
46 views

Google “App Passwords” - Do these circumvent 2FA?

I recently discovered Google's "App Password" feature: https://support.google.com/accounts/answer/185833?hl=en I generated a password there and used it in a Python script to authenticate with Google ...