Would adding two factor authentication to an application increase the attack surface of this application?

I think it would, since by adding complexity the likelihood of a vulnerability in my application is increased and so it opens another path for the attacker to exploit the system.

Would this be right?

  • yes, this is correct - more functions = more possibility for vulnerabilities
    – schroeder
    Jan 17 '16 at 19:52
  • 1
    You have to ask yourself, though, is the increased attack surface worth it? Does the new function mitigate other risks? Known, tested, and mature new functions can be low-risk in comparison to the problem they are fixing.
    – schroeder
    Jan 17 '16 at 19:54

To directly answer the question; it depends on the implementation and/or use-case.

It's not as simple as "more functionality equals greater risk". 2-Factor authentication only ensures that there are at least two channels used as intended and thereby prove that the authentication claim is more than likely correct.

This defeats most of attacks made possible by eavesdropping on a transmission between parties. Assuming the implementation is secure, 2FA tremendously increases security (and to some extent authorization). However, assuming things is always a bad idea, especially in the case of information security.

  • But, the OP is asking about the security of the application, not the user's account.
    – schroeder
    Jan 17 '16 at 23:13
  • @schroeder hence the emphasis on implementation Jan 17 '16 at 23:15
  • implementation does not affect attack surface - implementation affects risk
    – schroeder
    Jan 17 '16 at 23:21

Two factor authentication is a great way to help prevent unauthorized access especially if you use a product that's already been in development and had time to mature. Should you choose to roll your own 2-factor from scratch you expose yourself to many risks thus widening you attack surface. When looking for a provider I would look at something like RSA's SecurID which is a excellent implementation of 2-factor.

  • 2
    Isn't RSA proprietary? I think Google Authenticator is a fine, free option. Jan 17 '16 at 21:03
  • @NeilSmithline, I believe that it is too but just as an example enterprise product I mentioned RSA.
    – Nobeater
    Jan 17 '16 at 21:06
  • I didn't say you were wrong, just thought there were likely better options for the OP. Jan 17 '16 at 21:08

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.