I was asked to provide a public web interface which is given an email addresses (which belong to our users) for public clients (e.g. a web application or native mobile application) whether or not a user has activated two-factor authentication. Currently, I'm evaluating the security risk introduced with this requirement. I have a bad feeling but so far I didn't find any big issue with that. This is what I can think of:

  • The information whether or not a user has activated 2FA could be used by an attacker to focus on weak accounts first (e.g. online password guessing attacks). Nevertheless, it is well known that just a very small fraction of users have 2FA enabled. Hence, an attacker wouldn't save that much effort if he distinguishes between 1FA and 2FA accounts and so the advantage is quite small.
  • By knowing that a user has 2FA enabled the attacker also knows that the user has given us a phone number as we use SMS codes as the second factor. I don't see any advantage here for the attacker as 1) it should be very unlikely that a user doesn't have a (mobile) phone and 2) other users (without 2FA) might have given us their phone numbers as well.
  • An attacker might guess that a user has data which is worth to be protected. This is currently the biggest issue I can see. In case there is some vulnerability on our site which allows an attacker to get our users' data an attacker could focus on 2FA accounts first to get as much valuable data as possible before the attack is detected.

Did I miss something?

  • 1
    "An attacker might guess that a user has data which is worth to be protected" - that correlation might be weaker than you think. There are cryptonerds who protect completely worthless information with convoluted schemes and there are companies which have ridiculous security standards for information worth millions of dollars. – Philipp Jul 26 '18 at 12:43
  • You're missing that (if you really are talking about Google here) you ALREADY leak some of this information. I just verified this on my own account, but if I go to the "forgot my password" link, one verification option I receive is using my authenticator device. That's already revealing anyone that has even better 2FA enabled. I can't create an account without a phone number associated with it, so I don't know what recovery options it offers if I've never given Google a phone number. But it sounds like you're already leaking that information too. – Steve Sether Jul 26 '18 at 14:30
  • I think the point is that if you're going to add further authentication protocols, this is going to become "visible security". That's not necessarily a bad thing. – Steve Sether Jul 26 '18 at 14:32

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Browse other questions tagged or ask your own question.