What 2nd factor accepted on a mobile app?

Question

To respect the 2FA philosophy, after a 1st factor of authentication (login/password), we need to request a 2nd factor of authentication.

But for a mobile app, I suppose we can't use SMS OTP, email OTP or TOTP (with another mobile app) because all of theses techniques could be accessed from the same mobile?

Thereby for a mobile app the only 2nd factor authorized are a separate device (eg: Yubikey, Nitrokey, etc)?

Is it enough if we request something we known (userID + hex PIN code) and something we have (this mobile device only)? There is a ECDSA private key installed on the device and the server can check it's the good mobile device with the signature.

Answer 1

It all depends on what threat you want to counter. Your proposed threat mitigation (requiring a separate device) is appropriate for the threat of someone gaining unauthorised access to the device. But it is over-provisioned for your stated threat of someone gaining unauthorised access to a user's account via the app.

In your stated threat scenario, the unauthorised actor installs the app and uses the victim's credentials to log in. This can be mitigated by using MFA processes on the authorised user's authorised device.

There are different ways to do this: sending OTP codes, a local TOTP generating app, or having a process to register and authorise the device.

Authorising the device is a "what you have" form of the MFA methodology.

There is just one thing you have to consider: the security of the processes around registering that device.

If an attacker has the credentials of the user, can they also register an unauthorised device? If so, then you need to consider this new threat scenario.

This is where having a completely separate authentication process to your own is very useful, like a TOTP app on the phone. In this way, the attacker needs the credentials to your service and the credentials to the TOTP service.