New answers tagged

2

Well, it is two-factor, so it does add some security. It's not great two factor, for a couple of reasons. The user is very likely to read email on the same machine they log onto your service with, but that's also a problem with SMS a lot of the time. And of course email is a very insecure channel. But on the whole it will usually be better than nothing, ...


5

This is essentially the scheme that Steam uses if you log in from an "unknown" device. It increases the security slightly, as an attacker would need to compromise both the username/password combination for the application, and the email account of the user. This effectively makes non-targeted attacks worthless. This could be argued as a bad thing - if the ...


0

At least in the latest versions of Authy's Android application authenticator tokens, such as your Gmail TOTP, are sent to api.authy.com only after being encrypted using an AES key derived from your backup password and a randomly generated salt using PBKDF2. According to this source information sent from the API to your mobile phone has the following format: ...


0

I think it should be possible for each user to get multiple keys, if your key gets lost or stolen (or in case of the tokens that have their own battery, if the battery dies) you should always have a backup token, so you can get in (and disable the other token for example) that's also the reason Google, Github and Dropbox allow Multiple U2F devices.


5

I'll be writing from the assumption that 2FA is used with two separate devices. A single device with 2FA doesn't make any sense to me considering the risks associated with malware. Is it possible to trick 2FA? Now, wouldn’t a malware residing on the user’s phone simply be able to generate the “Yes” tap? Yes, this is possible. Pretty much nothing ...


-3

If you are doing your homework by the book in all aspects (using password manager, strong passwords, secure database backup, Windows security, Anti-virus, Secure Internet Behavior, learning, learning, etc) then a 2nd factor only means HEADACHE! It adds little more security and add a lot more attention/care/work. It is a trap! It is targeted for careless ...


0

To directly answer the question; it depends on the implementation and/or use-case. It's not as simple as "more functionality equals greater risk". 2-Factor authentication only ensures that there are at least two channels used as intended and thereby prove that the authentication claim is more than likely correct. This defeats most of attacks made possible ...


1

Two factor authentication is a great way to help prevent unauthorized access especially if you use a product that's already been in development and had time to mature. Should you choose to roll your own 2-factor from scratch you expose yourself to many risks thus widening you attack surface. When looking for a provider I would look at something like RSA's ...



Top 50 recent answers are included