New answers tagged

0

The "part that you know" second factor could be which 3 of the 6 emailed characters to use (Mary uses 1st, 2nd, 5th, John: 1-2-6, Fred and Janet: 4-5-6)... not certain how you'd teach your folks which ones, but once taught that secret shouldn't have to be transmitted again. And then use tight lockdowns too. SMS is potentially vulnerable to stingray but take ...


2

A system which locks out an account, even temporarily, in response to invalid password attempts will make it very easy to conduct a denial-of-service attack against someone. Using a two-part authentication makes it possible to have very strict lockout policies on the second part while still remaining resistant to denial-of-service attacks. If someone found ...


10

I find it hard to see what security benefits this could provide. In multifactor authentication the point is to use different factors - i.e. "something you know", "something you have", "something you are". Just repeating the same factor twice seems a bit pointless. But let me speculate some about what the purpose could be. 1. Stop keyloggers Only dumb ...


4

The point of multi-factor authentication is to require information from multiple sources so that if a user is compromised in one way (say they write their password down somewhere and it's found), then there is still a layer of security preventing account access. Usually, the three types of authentication information are something you know - like a ...


6

If you want strong authentication without the cost of sending SMS you can use TOTP with the Google authenticator app. Indeed, the pin solution doesn't seem to add a lot of additional security. I also don't fully understand the mechanism. They enter 3 digits from a 6 digit pin. How did they obtain the 6 digit pin and how are the tree digits selected? Also 10^...



Top 50 recent answers are included