New answers tagged

0

The first OTP definition in RFC 2289 based on S/Key had even this design requirement. It was not ment to implement two factor authentication but to merely protect the password or passphrase. It was simply used to avoid the password crossing the network - obviously it was assumed that the transmission could be evesdropped or unencrypted. So as already ...


3

Google Authenticator uses the Time-based One-time Password Algorithm ("TOTP"), which works by computing HMAC with a secret key over a timestamp. HMAC is a message authentication code ("MAC"). The standard security requirement for a MAC is that it be able to resist existential forgery (an attacker who doesn't know the key should not be able to forge any (...


4

No. Thats the whole point of TOTP/HOTP. That it should be infeasible, given any sequence of valid codes, to generate future codes or recreate the seed. The reason is that the TOTP/HOTP algoritm, use HMAC-SHA1 as hash, given the "challenge" (either current UNIX time or a counter of usages) and the secret "seed" as key. The resulting hash output is then ...


-1

As for the 2FA, I recommend using pam-radius, because you can then tie the process into your existing identity infrastructure and split authorization and authentication. For example, if you use AD, you can setup the MS radius plugin NPS and it will do authz in AD and if that passes authn to a 3rd party 2FA server. See all our pam-radius tutorials here: ...


1

What is the advantage of using jump servers for security reasons? Jump servers, or more accurately, bastion hosts, provide a segregation layer between the target network and the user. Consider a network with database servers, application servers, an HSM or NAE for PCI, and monitoring systems. Without a bastion host, this needs to be exposed for maintenance ...


0

What is the advantage of using jump servers for security reasons? My understanding of this is in general is that it allows you to minimize vulnerable and important attack surface and make an attack harder. This is because you can move towards white listing ips (you can white list the jump boxes). This would essential be like requiting authentication to have ...


0

Large websites deal with this by volume. They have such as large SMS packages, basically "unlimited SMS", so even a thousand of malicious SMS's won't "bite" on them. For smaller sites, it's usually better to have a request-response system instead. There's 2 things you can do: Either, you have a premium SMS number, and charge the equivalent fee that is cost ...


-2

Yes security is improved because there an additional HOTP "password". This would foil keylogger trojans which can grab normal passwords.


0

You can in fact combine ssh public key authentication with PAM authentication. The ssh daemon will do the public key authentication (with you ssh key, which is no certificate, just key pairs!) and the password authentication or OTP/GA authentication is managed via PAM. The trick is, to use this AuthenticationMethods publickey,password in your sshd_config....


0

See here. http://superuser.com/questions/607519/three-step-authentication The benefit of mfa is a password being guessed cannot get farther. You can use weaker passwords and reuse them and change them less often. You can avoid phishing scams more readily. Certs do not have that issue. You never transmit your private cert and can reuse it often. Also ...


1

Yes, this is two factor authentication, and it adds significant security. To me this seems like just another point of failure for a social engineer to take advantage of. This is not adding another weak point. It is adding another layer of protection. We have seen plenty of people who are willing to transfer accounts into their own names to ...


0

If verifying the phone number is through receiving a code by SMS, then "Yes", that is two factor authentication: Something you know: email and password Something you have: verified phone This is generally considered much more secure than either factor on its own. In fact the 2016 Verizon Data Breach Investigations Report mentions that “63 percent of ...


2

While many valid points are already discussed, no one yet came up with thoughts with regard to the Fifth Amendment (in US Law) and self-incrimination. There is similar law in other countries as well. The consensus is, that having a password will put you in advance against law enforcement, because is something that is protected by the amendment, where the ...


1

What's going on here is that your competitor is trying to use a poor man's substitute in place of a robust second-factor for authentication. For whatever business reasons they don't want to deal with putting in place the infrastructure on their end to implement a one-time code/OTP mechanism (the most common 2FA setup) to provide that robust second ...


1

You could implement your own layer of encryption in addition to the one that TLS provides. Since you say that "we can exchange some additional data in registration phase" I think the easiest solution would be to share a symmetric encryption key (e.g. AES) during registration and then encrypt all further communication with that. (The IV will prevent brute ...


1

an encryption patent is a contradiction in terms these days. nobody (in the large) is going to spend the effort to evaluate a patented method. at best, you would read the patent filing and determine that it's a cheesy version of something that exists and expose yourself to triple damages because you read a patent that should have been rejected based on an ...


0

The "part that you know" second factor could be which 3 of the 6 emailed characters to use (Mary uses 1st, 2nd, 5th, John: 1-2-6, Fred and Janet: 4-5-6)... not certain how you'd teach your folks which ones, but once taught that secret shouldn't have to be transmitted again. And then use tight lockdowns too. SMS is potentially vulnerable to stingray but take ...


17

A system which locks out an account, even temporarily, in response to invalid password attempts will make it very easy to conduct a denial-of-service attack against someone. Using a two-part authentication makes it possible to have very strict lockout policies on the second part while still remaining resistant to denial-of-service attacks. If someone found ...


29

I find it hard to see what security benefits this could provide. In multifactor authentication, the point is to use different factors — i.e., "something you know", "something you have", "something you are". Just repeating the same factor twice seems a bit pointless. But let me speculate some about what the purpose could be. 1. Stop keyloggers Only ...


7

The point of multi-factor authentication is to require information from multiple sources so that if a user is compromised in one way (say they write their password down somewhere and it's found), then there is still a layer of security preventing account access. Usually, the three types of authentication information are something you know - like a ...


15

If you want strong authentication without the cost of sending SMS you can use TOTP with the Google authenticator app. Indeed, the pin solution doesn't seem to add a lot of additional security. I also don't fully understand the mechanism. They enter 3 digits from a 6 digit pin. How did they obtain the 6 digit pin and how are the tree digits selected? Also 10^...



Top 50 recent answers are included