2

I am working on an App that has a login page with a field for username and password, if the password is entered correctly it then asks for the users pin (4-digit code).

My question, does having a pin as the second factor to login really make it any more secure?

If a hacker brute forces a users password, wouldn't using brute force against the pin be even easier since it's only 4 digits and only 0-9?

Also, is there anything else I could do to make it more secure? (Without adding another step to login)

  • 1
    Exponential back off for failed attempts so brute force becomes unfeasiable, this prevents an account lock out which affects the user. – McMatty Mar 1 '18 at 1:57
  • 2
    Note that this is not two-factor authentication (2FA). 2FA is defined as two different factors (usually something you know and something you posess, such as a token). Just having two passwords is not 2FA. – sleske Mar 1 '18 at 10:14
7

So two factor is when you authenticate with two pieces of information:

  • Something you know, passphrase for example
  • Something you have, yubi key, RSA token or a google authenticator

This way if an attacker has one - which in most cases will be a passphrase it will not authenticate without the piece you have. Your pin will only work if it is a OTP (One-time-password) otherwise you have actually just added a second password to your login process which will only slow an attacker not prevent them from breaching your site given the first passphrase.

3

This is not 2fa.

Two-factor authentication consists of two different, separate methods of authentication that are put together so that if one is compromised the other still stands.

You are combining a pin with a password, two things that are practically the same.

Typical 2fa consists of a physical device that stores secrets and proves that it knows them. This could be Google Authentication, etc, proving that it shares the correct secret with the server by generating correct codes, or it could be a yubikey encrypting something similar to the server, helping protect against phishing.

2

Its not secure at all. 4 digit code can be brute forced very easily. In case if you want to make it more secure, you have to use other security measures such as Authentication tokens (e.g. Google Authenticator). But all of this depends on your application scope, budget and how much sensitive data you are storing on your app.

If you do not want to use any other countermeasure, then you should keep your app safe from bruteforce attacks (e.g. Lock account after unsuccessful logins, Forced secure passwords etc. )

1

Like anything susceptible to brute force, you can can institute a throttling scheme sufficient to make brute force implausible.

With 2FA codes specifically, a user which provides a correct username and password but fails to 2FA many times indicates a compromised account and might be worthy of having that account flagged for later review and recovery.

Primarily though, 2FA code should be designed to change constantly and not just be a second password. Common schemes are time-based one-time password (TOTP) cryptographically derived from a secret key and the current time, or a nonce rotated/regenerated for each authentication attempt and delivered via a second channel (e.g. SMS, email). Either scheme makes brute force attacks implausible.

0

The fundamental idea behind two factor authentication is that if one factor is compromised then the second prevents unauthorized access. For example, consider Google 2 factor authentication. If you sign in from an unusual IP address, it sends a one time passcode to your phone. So if your credentials were compromised via, let's say, a phishing attack, you are still protected unless the attacker has your phone as well -- which is not likely.

In your case, a phishing attack could ask for not just credentials but the pin as well and unsuspecting users might surrender both. And as you mentioned, depending on your login policy, the attacker might brute force your pin. So while it adds another step, it does not elevate security all that much as a proper OTP 2nd factor authentication would.

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.