7

Basically 2FA relies on the idea that instead of just something you know, using a service also requires something you own.

I am quite confident, especially when used on iOS (which has a better system level app segregation), that this gives a pretty good security. Though I am not sure about adding a desktop 2FA utility.

In my understanding, an attacker would need to intercept my password (likely through a keylogger on my desktop machine were I log most) and an access to my phone, or to the key stored on my phone. But I can likely picture that someone able to setup a keylogger could steal enough information to reuse any 2FA system available on my desktop computer.

Writing this I am understanding that this is based on the perception that:

Computer integrity < Phone integrity < iOS integrity

Computer are more likely to be corrupted through the pile of junk I am installing on it and their more important "openness" to system changes.

Smartphones have a more restrictive ecosystem and a shorter livespan, thus a lighter probability to be infected.

iOS, is comparatively the most closed ecosystem where unlike on Android most access are not opened in API and the app checking is more thorough.

Improve this question
1
  • 2
    More importantly, a piece of malware on your computer can't access your phone directly. It's two different devices, with different vulnerabilities.
    – vidarlo
    Dec 17, 2017 at 16:21

1 Answer 1

Reset to default
10

You made an assumption that affects your outcome, and you cannot forget that you are making this assumption: that one "likely" gets your password via the desktop computer (i.e. keylogger). If that is your threat analysis, that's perfectly fine, just don't forget that you have made this differentiation.

Since your threat analysis is desktop-based, then yes, your conclusion is correct that adding a security function to the already-assumed-to-be-compromised desktop does not add a layer of security. If one can get your password, then one can get your 2FA code.

But, a desktop 2FA option is not useless if we change our assumptions. If we assume that one is more likely to get our passwords from the services we use (instead of our desktops), or even that one can get passwords from our mobile devices, then the desktop security measure legitimately adds a useful security function.

The ultimate question becomes: what is the most likely vector of password compromise? And that question changes constantly. And that's why being mindful of our threat assessments and reviewing them from time to time is very important.

So, the desktop 2FA option is a valid one, depending on your threat analysis.

Improve this answer
9
  • what I understand from your answer, and please correct me if I'm wrong, is that 2FA is something companies do to cover their basses. In this way, 2FA does increase protection when it comes to companies messing up, but it does little to nothing to increase protection when it comes to customers messing up. I suppose I just wrongly assumed that the 2 factors of authenticating are the password and the pin, but actually is the company and the client. In the sense that the (1fa) company and the (2fa) client needs to mess up for a breach of security. Or just the client twice, but who keeps count...
    – Andrei
    Nov 2, 2021 at 14:05
  • No, 2FA is an extremely effective control against stolen passwords. If the device that generates the 2FA code is compromised, it is possible that the protection is weakened. But you can't talk about security or controls in such stark, absolutist terms. Passwords and 2FA are both shared secrets. The 2FA code has better protections than a memorised password.
    – schroeder ♦
    Nov 2, 2021 at 14:16
  • "against stolen passwords", but it really makes a huge difference where those passwords are stolen from the company, or from the user. How does the 2FA compromised device only reduces security, and it doesn't break it, when almost always, which means always in practical terms, a 2FA device also saves the first factor? I see how 2FA is an extremely effective control against stolen passwords from the company, but I don't understand what security 2FA brings against stolen passwords from the user, aka the 2FA device.
    – Andrei
    Nov 2, 2021 at 15:51
  • You are making broad assumptions about how the passwords were stolen and the context. On a phone apps are separated from each other, so the compromise of a browser does not mean the compromise of the 2FA app. But the context here is the desktop. So, just like the OP, you need to keep your assumptions and risk context in mind.
    – schroeder ♦
    Nov 2, 2021 at 15:57
  • 1
    My point is that 2FA codes generated on the desktop can create problems.
    – schroeder ♦
    Nov 2, 2021 at 16:47

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .