Tag Info

New answers tagged

7

I disagree with Mark. A main goal of SSL/TLS is the protection of the long term key (i.e. the private certificate). If an attacker can obtain the key, the implementation must be considered broken. It does not matter if you use two-factor authentication or not. If I know the server's secret key, I can decrypt your traffic either directly (without PFS) or via ...


0

I do not see any security issue in asking for the password and a second factor (token/biometric) at the same time. In fact this increases the security of the system, but it might affect the usability (user experience) of the system. How is that? Let us say that the system take the two-authentication factors (password and OTP) at the same point and test ...


0

"A login form could detect a username that has 2-factor authentication enabled" - How? In order to do this, the page would either need to send another request to the server, including the user name (which seems to be what you're trying to avoid), or the page would have to include a list of all the usernames with 2-factor authentication enabled in the body ...


4

Proper two-factor authentication (authentication with both a password and a single-use token sent via an external channel) provides protection against the Heartbleed attack. An attacker can get both the password and the token, but with a proper implementation, the token is worthless for actually attempting a login of their own: it's single-use, and it ...


1

There could be a number of non-technical reasons, possibly a driver would be performance because it reduces load to some processing on the backend that doesn't need to get called. Another possibility may be to make it harder to setup a phishing website. You now need to program multiple pages. Also, if you only show OTP when there is a successful ...


-1

For internet banking 2FA, this is the reason I could think of why they make a 2nd form. They want to reduce the load on the database and processing for performance issue. For internet banking our 2nd factor is normally a generated key with some devices and the key is normally changed every minute / X minute. Imagine on the server they need to re-generate ...



Top 50 recent answers are included