a multi factor authentication requires at least two sets of credentials. This is typically something you know (e. g. a password) and something you own (e. g. a token generator or mobile phone)
20
votes
4answers
1k views
How is “something you have” typically defined for “two-factor” authentication?
A wide range of products claim to offer "two-factor authentication" (c.v. Two-factor authentication - Wikipedia). Most are deployed as "something you have" to be used in addition to a normal password ...
19
votes
11answers
968 views
Is it safe to use a weak password as long as I have two-factor authentication?
I'm careful to use strong passwords (according to How Big is Your Haystack, my passwords would take a massive cracking array 1.5 million centuries to crack), I don't reuse passwords across sites, and ...
15
votes
12answers
2k views
Why do we even use passwords / passphrases next to biometrics?
In the last couple of days there were a lot of talking about passwords and passphrases, not only here, but on several blogs and forums I follow (especially after XKCD #936 saw the light of this ...
15
votes
5answers
531 views
Safe way to authenticate (multi-factor authentication?) while being monitored?
(I'm trying for a bit more precise answer, particularly with regard to multi-factor authentication, than I received for "Safe way to use a computer that has spyware/keylogger installed?" on SU.)
...
14
votes
2answers
252 views
Mitigating the loss of a mobile phone used for second-factor login
Take the following scenario: John is using GMail for his primary email account and LastPass as his password management system. Both of these accounts are using the Google Authenticator mobile ...
13
votes
9answers
667 views
Anybody have additional information on the EMC RSA SecurID compromise?
The Security Advisory Press Release here doesn't have much information, the email that alerted me to this didn't help much more, and unfortunately I heard about the two Thursday evening conference ...
12
votes
5answers
605 views
Does two factor authentication prevent social engineering attacks
After reading this article from symantec I got to think how much all these social engineering techniques rely on the authentication system of users, a password.
Considering three different additional ...
12
votes
2answers
524 views
Which SSH security is stronger? 2 Factor or Public key
For SSH authentication, which is more secure?
2 Factor Authentication using a USB token/Google Authenticator(time based)
OR
Public/private key with password
Or could they be both used at the same ...
12
votes
3answers
805 views
Multi factor authentication on Ubuntu workstations, where to start?
Is it possible to have Ubuntu users log in with multi-factor authentication? I was thinking of a combination of pass(word|code) and smartcard (with screen locks when for example smart-card is removed)
...
11
votes
9answers
1k views
2 factor authentication - cost effective solution for a web startup
My local bank uses a 2 factor authentication where customers key in password AND a One Time PIN delivered via SMS to mobile phone OR from a security token device.
I am doing a web startup in the ...
11
votes
3answers
2k views
Three-Factor Authentication for Windows
This HowToGeek article...
http://www.howtogeek.com/67556/how-to-unlock-your-pc-by-being-nearby-with-a-bluetooth-phone/
...got me thinking.
Is there any software (or combination of software) that ...
11
votes
2answers
617 views
Biometric versus other Two Factor Authentication Mechanisms
Over the years biometrics is the go-to movie authentication mechanism, but in the real world I'm getting conflicting opinions about it. Everything I've learned shows that biometrics are flawed ...
10
votes
3answers
1k views
How does HSBC's “Secure Key” actually work?
My bank has recently sent me a Digipass/Secure Key, which looks like a tiny calculator. You press the green button to turn it on, type a PIN to unlock it, then press the green button again to generate ...
10
votes
6answers
3k views
How to implement multi factor authentication using a token generator?
I'd like to implement multi factor authentication on a few projects.
Now the first factor would be username and password, for the second factor I would like to use a token generator.
These tokens ...
9
votes
2answers
226 views
Do any DNS registrars support multi factor authentication?
I am looking for a DNS registrar that supports strong multi-factor authentication.
Does any DNS registrar support multi-factor?
Is this a legitimate need?
9
votes
5answers
519 views
Non-OEM Biometric Software?
Most of us with fingerprint readers and such devices probably use the software provided by the vendor, to enable biometric OS login or single sign-on functionality. However, I've recently wondered if ...
8
votes
2answers
1k views
7
votes
3answers
166 views
If multi factor authentication is enabled, how should that affect self-service password reset?
Given that security is only as secure as its weakest link, suppose I have website with additional authentication enabled in any of these ways: (example, multiple conditions may be required)
...
7
votes
2answers
257 views
What is the risk and mitigation of accidentally typing a YubiKey password in an open forum?
I have a YubiKey in my laptop (for testing) and accidentally broadcast my YubiKey password out to the Internet. Since this is only a test key, and has no access to anything of value, here are some ...
6
votes
5answers
309 views
POP3/IMAP Stronger Authentication
We recently deployed a two-factor-authentication solution in order to strength logon to our web applications (one of them is web based mail, Microsoft outlook web access)
Most of the users who have ...
6
votes
5answers
248 views
Is behavioural analysis (e.g. keystroke dynamics) a reliable security mechanism for MFA?
The typical set of multi-factor categories is as follows:
Something you know (e.g. a password)
Something you have (e.g. a hardware token, or key file)
Something you are (e.g. a fingerprint or retina ...
6
votes
4answers
981 views
(SoHo) Multi-Factor Authentication for Remote Desktop Gateway
I am looking at implementing some sort of multi-factor authentication for a Remote Desktop Gateway at a small office (less than 20 users).
Where would be a good place to start for a quality, ...
5
votes
6answers
1k views
Is tokenless (specifically SMS) 2FA a security compromise over OTP tokens?
I've been looking into the various pros/cons of tokenless (particularly SMS based) and traditional token based two-factor authentication (think RSA SecurID). After doing some research, I think I have ...
5
votes
2answers
346 views
Does having a passphrase and SSH key qualify as two factor authentication for PCI?
I am working on getting our company's servers PCI SAQ-C compliant (credit card data passes through our system but is not stored by our system). We have SSH access to administer the servers and all ...
5
votes
6answers
236 views
Is there multi-factor authentication for machines?
Most of what I have seen on mutiifactor authentication (eg wikipedia or here on se) seems human centric. Ie it is a human interacting with a machine and the factors are associated with authenticating ...
5
votes
2answers
77 views
Do keyfiles actually add any meaningful security in the presence of strong passwords?
In the context of protecting access to local encrypted files or devices against a determined (and competent) adversary, is there any reason to believe that the use of a key file actually presents a ...
5
votes
2answers
779 views
How do I protect my Gmail account when accessing it via an Android smartphone?
I have a Gmail account that I also access via an Android smartphone. The mail account could be used to reset passwords for other online accounts, so I want to tighten up the security around this ...
5
votes
3answers
925 views
How does LastPass' grid multi-factor authentication work behind the scenes?
I understand how to use the Grid multi-factor authentication as a user but how does it work technically? Specifically how can just a few letters from the grid be enough to decrypt any secret defined ...
4
votes
5answers
149 views
When should I issue more than one multi-factor device to a user? Is it OK to give several active tokens vs none at all?
Most of the conventional IT.Sec thinking I've seen says that a user can only have one multi factor authentication device. I'd like to challenge that defacto-thinking and ask if there is ever an ...
4
votes
1answer
112 views
How to solve race condition in 2-factor authentication solutions like RSA Security tokens or Google Authenticator?
One of the reasons we opt to use 2-factor authentication is to minimize the impact of keyloggers. The theory is that even if an attacker is able to observe the user type in the token numbers, they ...
4
votes
2answers
2k views
Full disk encryption and multi-factor authentication
All serious full disk encryption schemes I have looked into use a static password for authentication. For example, TrueCrypt supports two-factor authentication with keyfiles, but not for system ...
4
votes
2answers
335 views
How does multi factor authentication modify the AD authentication process?
I'm trying to understand what would have to be updated to make Windows-based systems support multifactor authentication.
Possible things that might have to be modified:
Active Directory / Domain ...
4
votes
1answer
480 views
Blackberry + RIM Bluetooth-based Smart Card Reader
Has anyone used this Bluetooth based smartcard reader? (scroll to bottom) If so, what are your experiences with it?
Can you tell me if it's possible to require only the presence of the card + card ...
4
votes
4answers
471 views
What are the ways to implement two factor authentication?
We have devices that can generate tokens. So we can use tokens with passwords to perform two factor authentication. There are many ways to implement such systems to enhance security. One of two I ...
4
votes
4answers
602 views
Are there consumer-grade VPN services that support two-factor authentication, like SecurID?
I'd like to increase my VPN security, and Google hasn't turned up anything with regard to VPN services and SecurId.
Does anyone know of services like this?
4
votes
1answer
46 views
NFC used in place of contact based smart card two-factor authentication
My organization is trying to move away from contact based smartcards (because our hardware vendor is no longer integrating them into their current systems) to some other form of two-factor ...
3
votes
4answers
435 views
Do any organizations use Smart Cards other than the military?
The military's Common Access Card (CAC) seems legit. Do other companies/organizations employ their use? If not, why?
UPDATE
What are the pros/cons of smart cards, compared to other methods?
3
votes
2answers
91 views
Should the serial number of multi factor devices be removed?
I'm trying to understand the relationship between the serial number of a multi factor device and the cryptographic material behind it.
I don't want to blindly assume that the serial number is just ...
3
votes
1answer
71 views
What physical, electronic, and software characteristics are important in a smart card?
I'm evaluating smart card readers to store a number of private keys, but don't know where to start.
What criteria is important regarding smart cards and preventing the extraction or unauthorized used ...
3
votes
2answers
166 views
How to evaluate different solutions for security tokens?
According to my own experience, most companies selling security tokens for authentication like RSA, Verisign or Aladdin share little information about the internals of their products like algorithms ...
3
votes
4answers
290 views
SMS Authentication: random OTP or a cryptographic one
I'm adding two-factor authentication using SMS to enhance an existing login process. Since I'm not working with physical tokens, I was wondering what is considered the safest:
Sending random 8 ...
3
votes
1answer
101 views
How safe is “trust this computer” option for websites?
Many sites have a "trust this computer" option that allows one to bypass some security measures (ex.: with Google's 2-step authentication enabled, one does not need to enter the phone's code if the ...
3
votes
1answer
184 views
Can I re-use another vendor's dual factor token in my own system? (Avoid physical token bloat)
I read the open source multifactor authentication techniques called HOTP RFC 4226 and TOTP RFC 6238 and realized that a single random number is the basis for the token's cryptography... and that this ...
3
votes
1answer
218 views
How many authentication factors are there?
The three classes that we all know and love:
Something you know.
Something you have.
Something you are.
I've also seen references to "somewhere you are". Is this really a fourth factor? How many ...
3
votes
2answers
364 views
How do I block LinkedIn from extracting data from Microsoft Exchange Server?
LinkedIn now offers the ability to take a real user and password from the end user and connect to Exchange Server for the purpose of importing contacts into their system. (To do this yourself, click ...
3
votes
1answer
1k views
Which cross-platform password managers support encryption using a hardware token?
I am looking for a really secure password manager and I really like the fact that Password Safe supports encryption/decryption using a Yubikey programmed in challenge-response mode.
Read more here:
...
2
votes
2answers
330 views
Two-Factor Authentication: When is it worth it?
I was reading this article, and it triggered the question: Why not use two factor authentication? In his case, it both possibilities were enabled anyway, so this looks to me like it's two attack ...
2
votes
2answers
248 views
Restrict user login to a specific machine
How do you restrict user access to a corporate web site to a particular machine ?
including the following conditions :
Each user is meant to use his credentials ONLY from the assigned machine.
The ...
2
votes
1answer
193 views
Is Dual Factor possible during boot with whole disk encryption on Mac FileVault 2
Mac FileVault 2 is the default disk encryption for newer Macs that occurs in the EFI pre-boot phase. The challenge here is that most smartcard drivers are loaded after the OS loads.
Is anyone aware ...
2
votes
2answers
1k views
Synchronous and Asynchronous physical security tokens: which is stronger? pros/cons?
I'm thinking about the differences between physical authentication tokens such as RSA's synchronous physical tokens or asynchronous challenge/response, like Google's gmail direct-to-phone codes.
At ...
