Is the following considered 2FA?

Question

• user have a verified email in system A
• user have a verified phone number system A
• user's authentication method in system A is out of scope in this question, but it is password based
• security measures of system A is out of scope in this question
• given system B, which trusts in system A. (system A and B belongs to the same entity, evaluating this "trust" its risks, etc. is out of scope in this question)

Authentication steps, in question

• user authenticates itself in system A
• using system A, user initiates he wants to use system B.
• an email sent to the user's registered email, with a time limited and encoded link to system B's url. System B is a publicly accessible web application.
• user navigates to the link.
• system B checks the encoded link and validates it
• in case of successful link validation, system B asks for the user its phone number showing only the last two digits
• in case of the user enters the right phone number (which matches its registered phone number in system A) system B sends a one time SMS code to the user's registered phone.
• in case of user enters the right code, system B accepts the user as authenticated.

Is this considered 2FA?

Answer 1

If both these conditions are true:

1. Access to System B can be requested only from an authenticated session in System A where the user authenticates using a password.

2. After System B receives the login request from the user through System A, it (System B) authenticates the user again using an OTP (one-time-password/SMS).

Then, it qualifies as 2FA for System B because the user cannot login into System B without these two factors:

• The password to log into System A (1st factor - something the user knows)

• The phone/SIM card (2nd factor - something the user has) to which System B sends the OTP.

Note: It will stop being 2FA, if the user can reset the password to System A using the phone number/SIM card to which System B sends the OTP because it means the user can ultimately gain access to System B using only his phone/SIM card.

Answer 2

It depends on how strict your definition of “2FA” is and whether system B actually enforces password authentication via system A.

The idea of course is that the user authenticates with both the password and the SMS token. However, an SMS token doesn't necessarily count as a separate factor besides the password. The SMS is sent to a particular phone number, and this phone number is tied to a SIM card (something you have). But in practice, there's only a loose association between the token and the SIM card. Attackers can (and do) capture SMS messages, e.g., by impersonating a cell site with an IMSI catcher. So the token might as well be regarded as something you know – like the password. In this case, there are no two different factors, so no real 2FA.

You also don't describe how system B ensures that the user has indeed authenticated within system A before. You talk vaguely about an “encoded link” which transfers the user from system A to system B, but you don't mention any concrete security measures like a signature, a message authentication code or a shared secret which would allow system B to verify the user's authentication status within system A. If there's any shortcut which enables the user to get away with just the SMS token, this isn't 2FA.