There are a variety of options available for 2FA - LastPass, for example, offers all of the following options:

  • LastPass Authenticator
  • Duo Security Authentication
  • Google Authenticator
  • Yubikey Multifactor Authentication
  • RSA SecurID
  • Sesame Multifactor Authentication

... and so on. I've heard of other 2FA options too - SMS, SmartCard, TOTP (not sure exactly what that is), and so on.

As near as I can tell, it seems like the main distinction is between hardware-based solutions (e.g., Yubikey) and software-based solutions (e.g., the various 'Authenticator' smartphone apps).

From an information security POV, does one of these options offer a higher level of security? Put another way, for the average user, what's the most secure form of 2FA available?

  • 1
    There is no universal 'more secure', only what meets your requirements and threats. SMS is really weak, but stronger than passwords. There are attacks against hardware tokens and they are expensive. If you have consultants, then reusable licenses and software tokens might be better. If you need to meet PCI requirements, you will need 2FA for non-console admin access, etc. etc. – nowen Jun 15 '16 at 17:41
  • @nowen - I'm a graduate student in computer engineering who's had his data stolen in the OPM hack (and possibly a couple others). So I guess by "average user", I mean "me" haha. It seems you're saying that hardware tokens are generally a bit more secure for personal use? Or am I reading into that too closely and the first sentence ("there is no universal 'more secure'") is most important? – tonysdg Jun 15 '16 at 17:47
  • lol, no I guess you are not. You in particular need to worry about SE attacks that might use your personal data in some way. I do not think anything is 'more secure' or 'less secure' except in relation to your goals and environment. If you are most worried about the lost data about you, then you should avoid services that rely on it for password resets or initial validation. You sound savvy enough to avoid malware on your device, so tokens there are fine. However, SMS relies on the security of the carrier and not just you, so that's a different equation. – nowen Jun 15 '16 at 21:12
  • TOTP is an algorithm that is used by e.g. the Google Authenticator. HOTP can be used by Yubikey. ietf.org/rfc/rfc4226.txt, tools.ietf.org/html/rfc6238. RSA SecurID uses a proprietary algorithm. – cornelinux Jun 15 '16 at 21:34

Generally speaking, all of these security products are solid enough for casual end-users. When it comes to end-users, most of the vulnerabilities come from the way the person uses it, not from weakness in the method itself. For example, do you leave your RSA SecureID card where your kids have easy access to it? If you use a code generating app, then does your phone have a strong password lock on it?

As mentioned by @SteffenUllrich, if you happen to get spyware on your mobile device with root access - which is more common than you might expect (see StageFright and drive-by downloads) then your SMS, email, and maybe even app based methods could be compromised.

I think that if you've careful about how you use it, and have good security practices on your devices, then any of these methods are fine for the average end-user worried about drive-by (ie non-targeted) password cracking from database leaks. If you want to go the extra mile and sacrifice some convenience, then I suppose the ordering would be SMS/email < app/OTP/TOTP < hardware token.

Now, if you're not an "average" end-user, but a high-value target that nation state actors are trying to break into, then everything changes. For example, if you've made enemies with the US government's NSA then they can sniff any code sent to you over SMS or email, and can likely sniff the packets of the first-time setup of the Google Authenticator app (or, you know, just ask Google for the code). In this case, hardware tokens really are king because they are entirely "out of band" (ie nothing sensitive ever crosses the internet).

Just for completeness, here is a copy of the tag wiki from the tag (which I wrote).

You can break 2FA methods into three broad categories:

  1. Something you know - information, like a password, or your mother's maiden name, or a public key stored in a key file.

  2. Something you have - usually a physical object like the phone that can receive SMS at your number, or a One-Time-Password (OTP) token or public-key enabled smart card / USB stick:

  1. Something you are: aka "biometric" like fingerprints, iris, voice, typing rhythm, etc.

The reason for splitting auth methods into these categories is that each one requires a very different kind of theft in order for a hacker to acquire it.

If you are required to provide a proof of identity from more than one of the above catogories, then it is properly "Two Factor Authentication", or "Multi-Factor Authentication". If you are providing multiple items from the same category, then it's called "Multi-Step Authentication", which is obviously weaker than multi-factor.

  • I think there is a major difference between specialized hardware tokens and apps on the smartphone or SMS. In the latter case it is often sufficient that an attacker manages to install a privileged application to get to the secrets or to read the SMS. And because of insufficient security of the phones such installations might be done using a MMS, a drive by download or similar. – Steffen Ullrich Jun 15 '16 at 18:07
  • @SteffenUllrich That's a good point, I'll edit. – Mike Ounsworth Jun 15 '16 at 18:14

When thinking of two factor authentication or multi factor authentication you have to take a look at the 2nd factor - in case of possession.

  • The possession factor needs to be unique
  • You need to realize, when it was stolen / compromized
  • You need to be able to revoke this and reenroll it. (bad for biometrics)

Authentication devices

You can differentiate authentication devices like

hardware <--> software

seedable <--> not seedable

Hardware devices will store the secret key, which in fact in the incarnation of the possession factor in hardware. The secret key can "not" be stolen without you realizing it.

But You also have to take care about the distribution process. non seedable hardware will come with a seed file on a disc. If the vendor keeps a copy of the seeds the hardware tokens may be compromized, without you knowing it.

seedable tokens are a great way to avoid this. But note: A google authenticator is also a "seedable" token. You yourself are generating the secret key. But the storage of this secret key is not that good, as we are dealing with a software token...

Authentication backend

Also you need to take a look at the authentication backend. You need to make up your mind if you are fine with a hosted service. So you need to trust the provider. If you are running on premise, you may choose between closed source and open source solutions. Pick this one, which you feel more secure with.

Disclaimer: I am involved with privacyIDEA, which is an open source on premise authentication solution which supports all mentioned token types above.

Bottom line

I wanted to point out, that it is difficult to define a security level ranking. As the security is... ...multi dimensional and depends on a lot of factors to take into account.

If you decide for a certain technology or solution. Write down your thoughts and the decision making process, so that you know which side effects or drawbacks you are willing to take. Security is never 100%. And it is always good to know the weeknesses or limitations of the system you are using.

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.