1

A lot of 2-factor authentication methods seem to rely on either a text message, email or a one-time password like Google's Authenticator as the second step in authentication.

It seems like these methods all rely on the security of a user's phone. For example if you stole someone's phone, you could go to their web browser, log on if you know the password or use their saved password, then perform the second step by opening their authentication app, email or text messages.

Is this not a big point of weakness in the whole system? Has this concern ever been expressed before and are there any alternatives that are more secure?

Improve this question
2
  • If it's PW+2FA vs PW alone, it's still worlds better. If your threat model is assuming the attacker knows the password and has access to the physical 2FA device, then yeah, you're right. That's a problem. But neither should that be surprising. :-| Feels like you're asking "Isn't using a key for your front door insecure? Because if a bad-guy has a copy of your key, he could just walk right in." I mean, you're not wrong, but what else would you recommend?
    – loneboat
    Commented Dec 12, 2017 at 14:40
  • Thats what I wanted to know, whether this concern has been expressed before, that we're now heavily reliant on our smart phones for security. If you steal someones unlocked phone you can access so much of someone's life. You can reset website passwords from the browser and email app pretty easily for example.
    – RicketyRick
    Commented Dec 13, 2017 at 12:40

4 Answers 4

Reset to default
4

It all depends on what you want to secure yourself from. Typically, 2FA is meant to protect you from remote threats. Ones that cannot get access to your phone (99% of the planet).

If your phone becomes a single point of failure, then you need to secure that point using all the recommended features, like strong passwords, remote wipe, and encrypting the device.

Improve this answer
0

It is not good protection against a very targeted attack, which can spend large amounts of time on you.

But that isn't the main threat today. The main threat is password leaks, password reuse, automated key loggers and weak passwords, used in automated attacks. Against this, even a weak 2FA works great - because the attacker isn't targeting anyone in particular, and spends the minimum resources on an account.

2FA a la google authenticator protects against password guessing, key loggers on a PC you use to access your account, shoulder surfing and other common threats. It's not a perfect solution. If you require better security, you have for instance Yubikey, which is essentially smart card technology.

Improve this answer
0

The Risk is subjective to the business area:

Independent apps and services

Independent apps and services like Google's Gmail gain a lot of mitigation through the use of these methods for Multi-Factor. The reason for this is that targeting this base is often remote, and not part of the a targeted plan. It's pointless to spend hours, weeks, and years to profile a single person and incur additional risk by attempting to steal a phone when there is already a lot of soft targets.

These method basically help protect you from people trying to steal your identity and do a pretty good job. Add Geo location tracking on your larger services and you have a pretty good security implementation for the general populace.

Large Corporations and IP

The Risk changes when you look at larger businesses internal structures and what they have that someone might want. You risk shifts from customers (who are too general to target) to employee's (vastly more narrow attack surface) who might provide what you want when accessing a system. We can narrow it down further by targeting employee's of interst such as executives and IT personnel. In these scenarios what attackers are after are a business assets, intellectual property, or access and it's far more worth their time to spend years on it.

Two factor is still important for the same reason that a general user should use them, but you also implement things such as certificate based authentication, phone sandboxing, and other network techniques. These are designed for a business to give confidence that an employee on the network is who they say they are.

Improve this answer
0

2FA does not just indicate only the use of a one-time key (as in the use of a Token like RSA) or an app (like Google Authenticator) or even a text or phone call with a one time key.

2FA can be a combination of any 2 of the following:

  • Something you have (Card, One Time Key, Token, Specific Cert or device) = Something you are (Fingerprint, Retina..)
  • Something thing you know (Password, key word..)
  • Somewhere you are (Global Location, i.g. Office, State, Country..)

With each of these you would calculate risk e.g. someone can acquires your device, guess you password, intercept text message or phone call..

Depending on what you are trying to secure and the risk, you would determine what combination of authentication to go with. You should weigh the ease of use for your users vs the security factor.

For instance, Something you are is more secure as it is harder to replicate (for the time being) but also the ease of use is slightly harder to implement especially for remote users.

There is even a such thing a 3FA or more.

As for 2FA keep in mind you are not always necessarily going to keep the bad guys out. You are just trying to make it that much harder so they need more sophistication to get in or move on to easier targets and not you.

2FA is only one step in helping secure your data. Monitor login attempts failures and successes, behavior monitoring and a whole lot more....

Improve this answer

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .