My company issues us RSA tokens: RSA Token

We use these when logging in remotely, and are presented with a prompt similar to:



Security code:

This all seems fairly standard; you give your company username and password, followed by the code on your token. The first time you log in, you are prompted to create a PIN, which you then append to the beginning of the RSA token code from that point forward when logging in.

Why is this done this way? Isn't the RSA token itself the second factor in the 2FA? What's the marginal gain from doing this, if an attacker rubber-hoses a company password out of me, why not the PIN as well? What other attacker surface is being protected?

I will note I've done this before with a yubikey; but the 2FA there is pretty obvious.

| improve this question | | | | |
  • 1
    It isn't a 3-factor authentication as the token is something you have and pin+password are both things you know. For it to be 3-factor authentication it should include 3 different ways to autheticate you, usually something you know (Password), something you have (Token) and something "you are" (Biometrics) – Mr. E Mar 14 '17 at 20:51
  • Maybe the RSA ACE server is misconfigured why you need to add the PIN. – cornelinux Mar 15 '17 at 15:59

The scenario you have provided is still 2FA and not 3 (as your question states). This still only uses something you know and something you have to authenticate. Now, moving on to why a pin and password would be needed. You are right, in that asking both doesn't increase the 'number of factors'. I have seen some companies not use the password, and just ask for the username and PIN + RSA code. But, if the PIN and the password were to be stored in two different data stores (2 different DBs, regions etc), compromise of one still wouldn't be enough to crack one of the two factors needed to authenticate.

| improve this answer | | | | |
  • So the risk mitigation here is of compromise on the backend, not at the endpoint? – agentroadkill Mar 14 '17 at 20:59
  • Well, it could also be because the user mistakenly shared their password but not their pin with someone. – katrix Mar 14 '17 at 21:01
  • Fair point, wouldn't the token alone prevent that? – agentroadkill Mar 14 '17 at 21:02
  • 1
    That would be the primary reason for using the token as a second factor. And again, I agree that asking for a password might seem overkill when 2FA is already in place. That said, we could always find scenarios tending to the implausible (someone you shared your RSA pin with also stole your token). So, while it might not seem necessary, also asking for a password doesn't seem wasteful unless there is good reason to not have it. – katrix Mar 14 '17 at 21:06
  • 1
    One possible answer is that the system evolved from a username/password system to a 2FA system. I could see implementation decisions leading to a system like you describe which doesn't necessarily make security sense, but could be a natural outcome nonetheless. – Cort Ammon Mar 14 '17 at 22:43

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.