I was asked to provide a public web interface which is given an email addresses (which belong to our users) for public clients (e.g. a web application or native mobile application) whether or not a user has activated two-factor authentication. Currently, I'm evaluating the security risk introduced with this requirement. I have a bad feeling but so far I didn't find any big issue with that. This is what I can think of:
- The information whether or not a user has activated 2FA could be used by an attacker to focus on weak accounts first (e.g. online password guessing attacks). Nevertheless, it is well known that just a very small fraction of users have 2FA enabled. Hence, an attacker wouldn't save that much effort if he distinguishes between 1FA and 2FA accounts and so the advantage is quite small.
- By knowing that a user has 2FA enabled the attacker also knows that the user has given us a phone number as we use SMS codes as the second factor. I don't see any advantage here for the attacker as 1) it should be very unlikely that a user doesn't have a (mobile) phone and 2) other users (without 2FA) might have given us their phone numbers as well.
- An attacker might guess that a user has data which is worth to be protected. This is currently the biggest issue I can see. In case there is some vulnerability on our site which allows an attacker to get our users' data an attacker could focus on 2FA accounts first to get as much valuable data as possible before the attack is detected.
Did I miss something?