We have a system in place which requires employees to login using a 2 step verification process ( password & Username) + (a defined number of characters from a chosen Memorable word). If the user fails to provide memorable word information he is prompted to provide answers to some security questions, for example his/her National insurance number before being able to reset their memorable word.

My question is:

Is there any advantages to the above approach compared to sending a reset email to the user?

  • What benefit do you feel you're getting from the memorable word portion of the authentication? It seems no more secure to me than a username and password alone. – Neil Smithline Mar 2 '16 at 22:30
  • You can send the reset link only if he is able to provide the email address (public knowledge) and a security question. An attacker would not only have to get access to your email account but also get to know the answer to the security question. This should be two different kind of attack vectors and thus increasing security. – cornelinux Mar 3 '16 at 11:50

First, I'd like to point out this is not considered a 2-step verification process because all of the components you suggest are "something you know." In order to have 2-step verification, you must have "something you are" (e.g. biometrics) or "something you have" (e.g. a security key or Google Authenticator token). See Wikipedia under "Components" for Two-Factor Authentication.

The only advantage to this process would be that if the user's email is compromised, this may prevent an attacker from being able to reset their password. However, security questions are often predictable and one can research the target to find the answers; such as birthday's and mother's maiden names which are often matters of public record.

Thus, while it does have some minimal security advantages, a system like this shouldn't be construed to be "two factor authentication" and instead is just "additional security questions" of questionable value. By allowing password resets based on security questions which may be researched by an attacker, you actually open up a separate attack vector/vulnerability as well.

  • I do not know if the word two step verification is officially defined. Often it is used the same as two factor authentication. But you are right that this is no two factor authentication. (I also do not add a 2nd factor when doubling the length of my password ;-) – cornelinux Mar 3 '16 at 11:47
  • @cornelinux It actually is well defined and "two step" and "two factor" authentication are synonymous, as noted in the beginning of the Wikipedia article. – Herringbone Cat Mar 3 '16 at 18:21

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.