New answers tagged

1

I think your friend has a phone hacked: a malware can stealthly receive and conceal 2-factor codes, then transmitting them to the attacker


-1

This makes no sense. There is an interesting basic difference between passwords and TOTP/HOTP. TOTP is a symmetric algorithm. The server and the client share the same information. They share the OTP secret key, the synchronized time and the last timecounter to avoid replay. In contrast the password authentication mechanism does not share information. The ...


3

The security lies in that you have a unique "access token" per client. So you can revoke and control as you will. Look at for example, Googles "App Passwords" which are the same thing. These tokens, of course make the 2FA no longer 2FA, but thats required for software and programs that do not support 2FA at all. The idea is that if a token becomes ...


0

First, remember that Authy allows you to use any TOTP token (like Google authenticator), but they also offer their own proprietary 2FA method. In Authy's method, the account provider must integrate Authy into their authentication mechanism, not just implement the TOTP standard. In this method, Authy issues the seeds, and this also allows them to support push ...


2

Google Authenticator worked for me - but it was a little bit tricky. Go to https://myaccount.google.com/security and start the process of enabling 2FA Google required me to enter my phone number - I could not find a way to enable Google Authentiactor without prior entry of a phone number. So do this and enable 2FA. Once 2FA is active, you can add a second ...


0

I would store them in an encrypted password vault (Somethg like Dashlane, Lastpass, or 1password.) in the notes section. It will be able to synchronized via mobile and encrypted also. Assuming you aren't using the same password as your master password you would be safe.


0

It's conceivable that there exists an mobile app that one could log into with name/pass and that app will take the name/pass plus some unique identifier from the device to generate a code which can be entered into a website for authentication. I think the OP wants to know why the generated code would be necessary if the attacker already has the name/pass. ...


3

2-factor authentication means to enter MOBILE app (using username and password) and then from that app you get codes to enter your account from a browser on a PC browser. No, no it doesn't. There are several kinds of 2FA. One is by getting a text message. You don't enter your site.com credentials on your phone to get a text message, you tell site.com ...


1

The major threat that mobile-based 2FA is designed to protect against is not a loss of your phone. It is against a network attack. It is very hard to imagine how an attacker at some random location on the planet can spoof your login to a website if you use mobile-based 2FA and they don't have your phone. They would need to physically get the phone. This is ...


7

2FA means to have to two factors for authentication, preferable one is a physical factor ("know" and "have"). The idea is that this way it is not enough to get the password due to hacking, data leakage, phishing etc but that the attacker must additionally have access to the physical device. There are lots of physical devices usable with 2FA like security ...


4

No. The attack-vector described in the article requires the PC to be compromised in some way and requires someone to intercept the radio-traffic sent from your PC. So first of all: unless your working on some really complex stuff that would be worth spying on it with great effort, you're pretty unlikely to be attacked this way anyways. 2FA via smartphone ...



Top 50 recent answers are included