Timeline for Is an SSH key with a passphrase a 2FA?
Current License: CC BY-SA 4.0
15 events
| when toggle format | what | by | license | comment | |
|---|---|---|---|---|---|
| Oct 31, 2019 at 15:04 | comment | added | user163495 | @MatijaNalis Two passwords would be 2FA in theory, but given that they would likely be stored in the same way (e.g. the same keepass database), it is also very likely that they would be compromised at the same time (thus rending the benefit of 2FA moot). But for instance a password and a one-time key sent via e-Mail would be a viable approach. | |
| Oct 31, 2019 at 14:59 | comment | added | Matija Nalis | @MechMK1 And if server asks for two passwords (like common "password" and "security question" mechanisms in use today), and you keep password written down on paper, and remember your security question, is that a 2-factor authentication then? The server asks for and gets two separate inputs. But two separate inputs does not imply two factor IMO. Nor do different channels means different factor - for example, if the server required that you send one password via web form, and another via email, it would not count as two-factor (even if it might improve security somewhat) | |
| Oct 31, 2019 at 14:41 | comment | added | user163495 | @MatijaNalis No, because the server does not care how you store your password. The server sees one factor: the password. | |
| Oct 31, 2019 at 14:39 | comment | added | Matija Nalis | @MechMK1 feel free to replace that with half a password (or a few letters) remembered, and rest of password written down on paper. Is that 2-factor authentication then? | |
| Oct 31, 2019 at 12:44 | comment | added | user163495 | @MatijaNalis No, because a usernames or e-mail addresses are not confidential information. Therefore they are not factors to consider when authenticating. | |
| Oct 31, 2019 at 3:50 | comment | added | Ayush Ambastha | @ConorMancone I think you're right. I missed out on that. Thanks for pointing it out! | |
| Oct 30, 2019 at 23:32 | comment | added | Matija Nalis |
@ConorMancone following that to conclusion, one could also argue that in classical username/password authentication only (usually known as single factor auth) your username is "something you know" and the password you have written down on paper (as it is too bothersome to remember) is "something you have", so it is actually two factor authentication. I'd argue instead that if you can use simple cp(1) to make exact duplicate of some authentication factor, then it is "something you know", not "something you have".
|
|
| Oct 30, 2019 at 14:33 | comment | added | user163495 | @PeterCordes I edited the answer to clarify it more. It was a good point to raise, though | |
| Oct 30, 2019 at 14:32 | comment | added | Peter Cordes | @MechMK1: Your phrasing didn't put it as succinctly or even as clearly (at least for me), unfortunately. That's probably why commenters on your answer (especially @R.) felt the need to rephrase and highlight key points in other words. | |
| Oct 30, 2019 at 14:23 | comment | added | user163495 | @PeterCordes That is actually exactly the content of my answer. | |
| Oct 30, 2019 at 13:29 | comment | added | Peter Cordes | @Ghedipunk: Can you post that as an answer? That's the key piece of reasoning that justifies my intuitive sense that it's not 2FA. I was having a hard time formulating it (server doesn't independently check both things) until reading your comment. | |
| Oct 29, 2019 at 20:07 | comment | added | Ghedipunk | That is, the passphrase protects the private key, not the authentication. I can decrypt the private key whenever I choose, and the service I'm authenticating with would be none the wiser. | |
| Oct 29, 2019 at 20:00 | comment | added | Ghedipunk | I agree with Conor: The SSH key is something you have. It's only because the passphrase is tied directly to that SSH key that I would argue that they're not separate factors. If the passphrase and key were unrelated, then they would be separate factors. | |
| Oct 29, 2019 at 19:55 | comment | added | Conor Mancone | Unless you're memorized your SSH Key (which seems very unlikely), you could argue that the key is "something you have", and the password is "something you know". As a result, why doesn't it count as 2FA given your outline? | |
| Oct 29, 2019 at 19:46 | history | answered | Ayush Ambastha | CC BY-SA 4.0 |