New answers tagged

0

an encryption patent is a contradiction in terms these days. nobody (in the large) is going to spend the effort to evaluate a patented method. at best, you would read the patent filing and determine that it's a cheesy version of something that exists and expose yourself to triple damages because you read a patent that should have been rejected based on an ...


-1

Just a note on sending 2-factor via sms: I have to turn this feature off when travelling internationally as I may not activate my mobile while in country 1, but then may purchase a sim card in country 2, (which provides a new mobile number). Country 3, who knows? Instead I use a "token" that generates a numeric code. Your mileage will differ ;)


0

The "part that you know" second factor could be which 3 of the 6 emailed characters to use (Mary uses 1st, 2nd, 5th, John: 1-2-6, Fred and Janet: 4-5-6)... not certain how you'd teach your folks which ones, but once taught that secret shouldn't have to be transmitted again. And then use tight lockdowns too. SMS is potentially vulnerable to stingray but take ...


5

A system which locks out an account, even temporarily, in response to invalid password attempts will make it very easy to conduct a denial-of-service attack against someone. Using a two-part authentication makes it possible to have very strict lockout policies on the second part while still remaining resistant to denial-of-service attacks. If someone found ...


14

I find it hard to see what security benefits this could provide. In multifactor authentication the point is to use different factors - i.e. "something you know", "something you have", "something you are". Just repeating the same factor twice seems a bit pointless. But let me speculate some about what the purpose could be. 1. Stop keyloggers Only dumb ...


6

The point of multi-factor authentication is to require information from multiple sources so that if a user is compromised in one way (say they write their password down somewhere and it's found), then there is still a layer of security preventing account access. Usually, the three types of authentication information are something you know - like a ...


8

If you want strong authentication without the cost of sending SMS you can use TOTP with the Google authenticator app. Indeed, the pin solution doesn't seem to add a lot of additional security. I also don't fully understand the mechanism. They enter 3 digits from a 6 digit pin. How did they obtain the 6 digit pin and how are the tree digits selected? Also 10^...


1

If it breaks 2FA authentication or not, depends on the implementation. Those implementations you specify do remove the "2factor" out of 2FA and reduce it to single factor (the seed then becomes like a second "password" to your account). Same applies to using a soft-token in a Android/iPhone unless the token specifically uses secure Android Keystore bound to ...


1

When you are using OTP based on HOTP or TOTP locally you need to store the seed somewhere. So you store the seed on this local machine. Now it depends on your threats. This may very well protect you against shoulder surfers or maybe keyloggers. But it will not protect you against local attacks. But the question is, if you do not have a bigger problem, if ...


3

Yes. Concept of two factors is to authenticate using any combination of the below methods Something you know (password) Something you have (OTP token with secret) Something you are - Fingerprint, retina , palm scan etc... If you hide both of them under third password (or even without password), you are weakening the whole concept. If the attacker can get ...


1

As @fishy says, Google's first goal is to increase adoption. Anecdotally, it seems like a majority of people do not require a second factor of authentication for any of their accounts. SMS-based tokens can sometimes introduce too much of a delay, lead to charges for incoming messages and hence is thought to reduce usability of the system. TOTP requires the ...


1

Like the previous two-factor auth scheme, this assumes that you are in possession of your cell phone. Unlike the previous scheme, it doesn't require you to enter any numbers (6 digit security key) into to login. (Keep in mind that since the system hasn't been completely rolled out yet, there could be lots of other information about the security of the ...


1

It is not you logging in on this phone, it is (presumably) you logging in on another device. You get prompted to authorize the login on the other device. That's why the prompt also mentions the device. So now you get a simple yes or no pop-up, rather than a confirmation email, text or setting up a separate security key. In itself it's not more secure, but ...


6

Neither. Both SMS and phone calls can be forwarded to a phone of an attacker's choice if that attacker can trick your mobile provider into believing he or she is you. Mobile account hijacking attacks like this aren't extremely common (yet), but they are definitely on the rise. The better option (as @Jedi briefly mentioned) is to use an authenticator app to ...


14

It really will depend on your threat model. SMS may be easier to sniff, or to be intercepted by an malicious app on your phone. So if you are worried about those kind of attack, it may be the better to use the call option. However, most phones will not require a device unlock to accept a call, so if you leave your phone unattended, ex on your desk, (or it ...


3

It depends on how often you need to authenticate and what your perceived threat model is. Whether the call is eavesdropped or the SMS is sniffed shouldn't really matter as long as you protect your password and keep a close eye on your account activity. Personally I find the SMS mechanism arrives faster and less intrusive (esp. in class or meetings). As @...


16

Call is safer, for reading your sms you only need a simple program whereas for monitoring your calls, you need an actual person, thereby increasing the effort needed by a lot. Reading sms is something you can do on as many phones as you want whereas listening to that many calls at the same time is impossible (unless you're the NSA I guess). Even if you ...


1

No. I would say, that the 2FA device in question, will protect your account more than the password. The idea behind the 2FA device, is to prevent someone remote to you, to access your account. Eg, hacking it from the other side of the globe. (NOTE: Does NOT apply to certain event based tokens with 6/8 digits - see later) However, changing password is a ...


3

Indeed, two factor authentication (2FA) will prevent anyone from accessing an account without having both authentication factors. That being said, the typical implementation of 2FA online is a password paired with a short code, either on a keyfob or sent via SMS. The standard RSA SecurID keyfobs that have been around for a couple decades now and Google's 2 ...


0

Yes. I speak from experience. Our company account has been hacked while we had 2FA in place. Service provider: Amazon AWS The technique: social engineering. The hacker convinced the AWS servicedesk to disable 2FA. The other answers here all talk about hacking your phone, or the website. This "hack" is another route and very effective. If the hacker ...


0

In case of codes sent with SMS or email, in addition to an already mentioned maliciuos app being planted on a device: recently a social engineering hack has been revealed where an attacker sends a message convincing the victim to forward (or input on attacker site) the legitimate authentication message (login attempt from the attacker) that will follow you ...


0

The short answer is yes. They could install malware onto your phone, add an SMS redirect, hack a phone service, or just hack the target site.


2

The difficulty of bypassing 2FA depends on the mechanism used for the second factor, but with SMS codes it's definitely possible and has been done before. In an actual incident recently, hackers were able to trick Verizon employees into redirecting the texts to a different phone by simply impersonating the subscriber.


1

When thinking of two factor authentication or multi factor authentication you have to take a look at the 2nd factor - in case of possession. The possession factor needs to be unique You need to realize, when it was stolen / compromized You need to be able to revoke this and reenroll it. (bad for biometrics) Authentication devices You can differentiate ...


4

You don't say what kind of 2FA process you are using and which kind of phone you have. But if the hacker manages to install a privileged application to your phone he might be able to capture 2FA tokens send with SMS or extracts the secrets from some OTP apps you use. And installing an app to your phone without having physical access might be easier than you ...


2

Generally speaking, all of these security products are solid enough for casual end-users. When it comes to end-users, most of the vulnerabilities come from the way the person uses it, not from weakness in the method itself. For example, do you leave your RSA SecureID card where your kids have easy access to it? If you use a code generating app, then does ...


0

Two factor authentication, is usually based on something you know (a password) and something you have (e.g. RSA token, email account, phone). If you are the only person that knows your "something you know" then this should be perfectly fine. However brute forcing, rainbow tables, social engineering attacks are all designed to get around that. The security ...


2

I think there are two independent questions here that you need to distangle. Question #1: Should I use just one factor or should I use two? This is the question that you adress in your title - "Why not make the second factor the only factor?". Two factor will be safer than one, but it comes with a usability and an implementation cost. If it is worth the ...


2

I've been doing professional pentesting for quite a while covering many of the banks having a permit here in Switzerland. Traditionally they were using username/password only. Then they switched to TAN (transaction authentication number) handed out on paper. I just know 2 remaining banks in Switzerland which are still doing this. There are two reasons: (1) ...


1

Most banks would ideally to use multiple stages of authentication. These are classified as: Something you know (password) Something you have (card / token / phone) Something you are (biometric) By asking for a DoB, your bank is restricting itself to only one source. Considering that once a password is known it is hard to assume that the attacker cannot ...


4

I've never heard of just using the date of birth for authentication. It's a bad idea as a date of birth is non-revocable. Meaning if it is "compromised" you can't change it. If it is the only means of authentication for consulting account or transactions it's a REALLY BAD IDEA. But that brings me to my second point. It is, in general, not considered your ...


2

For systems where 2FA/MFA is "optional" such as Gmail or Outlook.com, the service has to balance the hassle factor of using the 2-factor method and the security it brings to their site. In a perfect world, users would have unique, complex passwords for every site, and always use 2FA when available, but in the real world, you're right - users will have the ...


1

Some card issuers let you create a virtual credit card. You can setup a virtual card, configure appropriate limits, then use it on an insecure site with much less risk than using your main card. A low-tech alternative is to get a pre-paid credit card and use that whenever you're concerned.


0

You can buy at sites that are PCI DSS complaint. The Payment Card Industry Data Security Standard (PCI DSS) is a proprietary information security standard and the merchants who comply with it are more secure monitored and surveyed by a qualified security assessor . You will be able to identify these merchants by the PCI Turquoise logo in white letters at ...


3

Instead of seeing this from the point of view of the card, look at this from the point of view of your account's money (that after all it's what matters, right?). So, how can you protect your money in such sites? Simple solution: using a virtual credit card. Most banks offer these kind of cards that you should always have with no funds. Then when you are ...


8

There's nothing you can do. Because if it's actually you using the web site, then fraud is obviously not an issue. The 2FA only helps if someone else is using a web site pretending to be you, and so nothing that you do on web sites will make any difference. You can't stop a fraudster who has got hold of your card details from using them on a web site that ...


5

In theory, yes, this is a possibility (provided the site implementing 2FA doesn't have any rate limiting or fraud detection of any kind, as pointed out by the other answers). In practice, there's the usability factor to think about, too. Imagine you built a login form that prompts a user for 2FA on every login attempt, only telling the user the attempt was ...


9

So now the cracker may have access to all the user's accounts across the web, many of which probably don't have MFA implemented, leaving the user completely vulnerable to attacks. An attacker isn't going to try guessing a password on Google that they aren't also going to try for the bank or facebook or the like. Just because it's now been given away ...


116

If I'm understanding your question properly, the attack you are proposing is to brute-force passwords against a server like this, then once it shows you the MFA screen, go try that password on other websites that this user has accounts on. This is a great question! Good find! But you seem to be overlooking two points: This is no weaker than not having MFA,...


11

I think this is a non-issue. Multi-factor authentication isn't about preventing someone to guess your password, but to prevent anyone to sign in on your accounts.


2

So one thing you're getting confused about is that you're combining to different security theaters. Let's instead look purely at the web, and then purely at the phone. The Web Theater With the web you're subject to people randomly trying to hack your account. This is protected by a password(something you know) and a username(something you have). In this ...



Top 50 recent answers are included