3

When users store complicated and unremembered passwords in password manager service such as lastpass, what authentication factor does the lastpass access represent? Does forcing the need for a password manager make the secret no longer a knowledge factor but only a value to the URL key stored in an external system?

Combined with the hardware token, do we have 1.5FA rather than 2FA or is it only 1.05FA? Once the password is leaked/stored the factor appears unknown, or does it still count as knowledge?

The purpose of this question is to evaluate a 2FA policy of 'knowledge' and 'possession' that is allegedly juxtaposed with a complex password policy.

FYI here is a google doc of the full password policy I want to pitch.

0

This is where the concept of placing authentication factors in specific categories (what you know, what you have, what you are) becomes complicated. While these categories tend to be thought of as independent, they do overlap in certain areas.

Passwords are traditionally 'what you know' and I'd guess many people would always classify them that way even in this scenario where the user doesn't actually know them. Other people would say the treatment of the password in this situation has converted it from a 'what you know' to a 'what you have' factor. Some might even claim it fits into both categories simultaneously.

From the authenticating system's perspective it can't really tell whether you've memorized a password or not. It probably makes sense from a threat assessment perspective for the system owners to assume the authentication factor is being used in a traditional way, even if it might not be. But from the user's perspective they should probably assess the risk associated with how they actually manage their passwords.

All this to say that I don't think there is clear consensus on the answer to your question, but the majority would probably still classify the passwords as a 'what you know' factor. And I don't think most people would consider the use of a stored password as multi-factor authentication (MFA) without adding another factor besides the password.

UPDATE: With regards to the new concern you edited into your question, I don't believe that a complex password policy requirement necessitates that users will use a password manager. Most people do not use password managers (only 12% use them sometimes) despite any password complexity requirements on the Internet sites they frequent. There may be some correlation between users recording a password and extreme complexity/length requirements, but I'm not aware of a study showing this.

It looks like you're trying to make a case that relaxing a current password complexity policy will decrease the use of personal password storage. Your alternative appears to be an XKCD passphrase style system that primarily cares about meeting a minimum length of 16 characters. And while I agree that these passphrases can offer better security without unduly affecting usability, I'm not sure you'll make much of an impact on password storage. A study that compared use of passwords and XCKD style passphrases found that both sets of participants stored (e.g. wrote it down, had their browser save it, saved in password manager, etc) passwords and passphrases a pretty similar percent of the time. Both sets of users worry about forgetting their secrets, and take steps to prevent this. Even if a new policy allows passwords or passphrases that appear easier to remember than a previous policy it may not immediately change user behavior.

But back to your concern, while people may not agree on whether writing a password down changes its factor category, I haven't heard any serious discussion that this practice means a system relying on it as a knowledge factor loses MFA/2FA status when this happens. I believe most people would still consider it 2FA.

If you want to write up a justification on relaxing your password complexity requirements and advocating XKCD style passphrases I think there are better arguments for this change that don't count on eliminating password managers as a benefit.

  • Right, without those categories, then one can not have MFA. For example, for our auth I might require 'something you have' (mfa device token) and 'something you know' password factors and feel warm & fuzzy over our 2FA policy. BUT if we have a super complicated password policy that forces the use of a manger - do we still have 'something you know'? This is why the categorization of the factors is important. I understand the issue of lack of "clear consensus". – Tom Feb 23 '17 at 17:08
  • @Tom When you say the password complexity policy "forces the use" it seems like that's an assumption of user behavior on your part, right? There's nothing actually forcing a user to start storing it in a password manager? – PwdRsch Feb 23 '17 at 20:57
  • Yes, that is what I am suggesting - storing the password is leaking the password. The complex password becomes an unknown value of password manager. – Tom Feb 24 '17 at 5:23
  • @Tom Updated my answer with further feedback based on your question edits. – PwdRsch Feb 24 '17 at 7:25
  • Accepted the answer but wanted to note a key difference in the cited study (for others to ref). The study uses system generated pass phrases rather than letting users pick one. I do not have data but suspected users will leak their own password less then an assigned one. – Tom Feb 24 '17 at 20:41
3

You could say that the password manager has MFA, because you have to have the database and know the master password.

However, the attacker can still gain access to the application by obtaining your application password. Actual MFA would prevent him from accessing your account, because he doesn't have access to your phone or keyfob. This is missing with a password manager.

So it depends on the attack scenario. An offline password manager such as KeePassX has two-factor authentication in the sense that you need both the database and the password. But this does not change anything about the applications where you use those passwords.

  • 2
    Exactly, Keepass -has- MFA, but it -is- not MFA in itself – J.A.K. Feb 23 '17 at 9:01
0

When talking about multi-factor authentication, it's helpful to remember the purpose. The purpose is to make it more difficult for someone to steal your authentication credentials.

If someone has installed a keylogger on your computer, then they probably have access to your passwords, whether you directly typed them or not (some password managers have defenses against this). They can't, however, reach out of the computer into your pocket and borrow your Yubikey. Hence, two factors.

Similarly, if someone mugs you and steals your key, they don't have access to your password manager's stored passwords (unless they took your phone and it has the decrypted store unlocked). Two factors.

It's not really so much a matter of "Does this count as something I know?" so much as "Is this something that could be stolen in the same way as something I know?". Most ways you look at it, the answer is yes, which means you should consider them only one factor.

  • 2FA, MFA, are not just "more difficult for someone to steal" - it it is known security practice and standards that can be relied upon. The question is if password managers circumvent the known standard. – Tom Feb 23 '17 at 17:03
  • @Tom They aren't more difficult to steal than a password, just different - it is the combination of multiple methods that makes overall account breaching more difficult. If you're referring to formally defined standards (e.g. something from ISO), then you'll have to read it to decide whether a password manager counts in its definition - but the answer is likely no, given how strictly they tend to define things. If you're talking instead about practical security, then that's what my answer addresses. – Xiong Chiamiov Mar 26 '17 at 22:04
0

Whether it is stored in a password vault or not a password is just something you know. You could write it on a paper, give it to someone else and that is enough for him to use it, while you can still use it at the same time. Simply as it is a long and complex password, it is expected to be more strong than the mere 123 string!

On the opposite, a smartphone receiving a unique key via SMS is something you have. If I give someone else the phone for him to receive the SMS, I can no longer use it.

So here as the password can be used without the vault, there is no MFA.

  • This is addressing the question, thank you. But, how is a password I don't know but have (on paper, in a vault) count as a something you know factor? Why doesn't it become something you have factor instead? – Tom Feb 23 '17 at 17:02
  • Simply because different persons can use it simultaneously in different places, which is impossible for a material object that you have. And if you think about copies of physical keys, each copy is a different object and the lock accepts any of these object, so if I have copy n° 1 in my pocket you must have a different copy to open my home door. – Serge Ballesta Feb 23 '17 at 17:13
0

So you have to look at Multi-Factor Authentication in regards to the service you are specifically authenticating against.

As an example, you are trying to login to your HR website to look at your pay stub. This access is authenticated by providing your non-private username and a private password in this example. The fact that you store your private password in a secure location like a KeePass store or LastPass vault, does not make using that private password a multi-factor authentication.

Multi-factor authentication is only used in direct regards to the service you're authenticating against, the HR website doesn't know anything about the password used other than it's something only you should know. Now if the HR website asked for that password and then asked for a private key file that you generated previously, that would be both something you know (your password, protected in a password manager) and something you have (the file), because you are proving your identity to the service with those 2 factors.

Now you can protect those factors with other factors, such as a password to decrypt your encrypted passwords or a fingerprint reader on your phone where you receive a second factor code, but that doesn't authenticate you in more than 1 way to the service you're trying to access.

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.