2

I login to a website and provide a UserID, Password and one-time PIN delivered via EMail or SMS. I also select the "Register Device" check box to register my desktop.

On a subsequent login, I only have to provide my UserID and Password. Presumably, a cookie created during device registration is sent to the site as well.

My question is, is the second login considered MFA (Password + registration cookie), or does the cookie suspend MFA for some time and the second and subsequent logins are NOT MFA? Does it depend on the content of the cookie or the server-side implementation?

The web site is arguing that the second login is MFA as the device registration cookie constitutes an authentication factor, but it doesn't feel right to me.

1

Your question is really more about definitions than about the actual real security of the system. So let's define some terms before getting to your question:

As I learned it, there are three broad categories of authenticators:

  • Knowledge (something they know) - passwords and other secrets
  • Possession (something they have) - access to an email account to retrieve the one-time PIN
  • Inherence (something they are) - usually biometrics like facial recognition, finegerprint or iris scan

Borrowing from the tag wiki for (which I wrote):

If you are required to provide a proof of identity from more than one of the above categories, then it is properly "Two Factor Authentication", or "Multi-Factor Authentication". If you are providing multiple items from the same category, then it's called "Multi-Step Authentication", which is obviously weaker than multi-factor.

Wikipedia seems to agree with this definition.


Cool. So as for your website,

I login to a website and provide a UserID, Password and one-time PIN delivered via EMail or SMS.

  • Password = Knowledge
  • Email/SMS = Possession.

==> Pass! This is MFA.

My question is, is the second login considered MFA (Password + registration cookie)?

  • Password = Knowledge
  • Cookie = Knowledge (of the text)? Possession (of the device)? Uncertain.

==> Questionable.

Arguments for "yes": if the cookie is implemented properly, then it counts as possession of the device.

Arguments for "no": possession-type factors really ought to be immune to record&replay attacks; with any kind of one-time codes - hardware tokens, apps, email, SMS, etc - the server won't let you use the same code twice. Same with crypto USB sticks / cards you need to insert into your laptop. In this case, someone intercepting your traffic to the website will snatch both your password and cookie in the same packet and then be able to log in as you somewhere else.

That said, it does protect your account against, for example, their password database getting stolen, or you re-using a password of yours from a different site that shows up in a leaked passwords database. Questionable.


On a technicality it probably is 2FA / MFA, and offers more security than either password or cookie by itself, but less than continuing to do the Email / SMS thing.

  • Does email counts as possession, rather than knowledge of credentials? – Chris F Carroll Oct 11 '18 at 12:53
  • @ChrisFCarroll I would say yes. – Mike Ounsworth Oct 11 '18 at 17:47

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.