To respect the 2FA philosophy, after a 1st factor of authentication (login/password), we need to request a 2nd factor of authentication.

But for a mobile app, I suppose we can't use SMS OTP, email OTP or TOTP (with another mobile app) because all of theses techniques could be accessed from the same mobile?

Thereby for a mobile app the only 2nd factor authorized are a separate device (eg: Yubikey, Nitrokey, etc)?

Is it enough if we request something we known (userID + hex PIN code) and something we have (this mobile device only)? There is a ECDSA private key installed on the device and the server can check it's the good mobile device with the signature.

  • We would like to protect against someone access to the account. The local biometric (fingerprint or face recognition) are not secure on ios/android for web, because the server can't be sure it's ok. API only return "true" or "false". It's easy for an attacker to bypass this part.
    – lakano
    Nov 6, 2017 at 11:54
  • Then 2FA on the device is just fine, according to your threat model.
    – schroeder
    Nov 6, 2017 at 12:33

1 Answer 1


It all depends on what threat you want to counter. Your proposed threat mitigation (requiring a separate device) is appropriate for the threat of someone gaining unauthorised access to the device. But it is over-provisioned for your stated threat of someone gaining unauthorised access to a user's account via the app.

In your stated threat scenario, the unauthorised actor installs the app and uses the victim's credentials to log in. This can be mitigated by using MFA processes on the authorised user's authorised device.

There are different ways to do this: sending OTP codes, a local TOTP generating app, or having a process to register and authorise the device.

Authorising the device is a "what you have" form of the MFA methodology.

There is just one thing you have to consider: the security of the processes around registering that device.

If an attacker has the credentials of the user, can they also register an unauthorised device? If so, then you need to consider this new threat scenario.

This is where having a completely separate authentication process to your own is very useful, like a TOTP app on the phone. In this way, the attacker needs the credentials to your service and the credentials to the TOTP service.

  • In my scenario, if an attacker has the credentials of the user, he can't connect from an unknown device. So, a mobile phone is « something we have », and only if I can identify it correctly I suppose (ECDSA keys), and it's 2FA. So I'm curious to known, if a laptop or computer authorized (same method) could also be considered as « something we have », to be also 2FA ?
    – lakano
    Nov 6, 2017 at 15:25
  • 1
    Sure, some apps use client-side certificates to achieve this. A few years ago, desktops used a read-only USB key with a key file on it. But again, be mindful about how a malicious actor might acquire a valid set of keys or a cert. It becomes its own threat scenario.
    – schroeder
    Nov 6, 2017 at 15:28

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .