2

I am developing an application and users are able to add 2FA to their account. however if a user has lost backup codes of 2FA and logged out of account on all of devices, is it safe making them able to disable 2FA using pre-set 2 security questions ?

1 Answer 1

2

I wouldn't say using security questions for pretty much anything is "secure".

There have been so many compromises of personal information, ranging from financial (Equifax) to social (Facebook) it's not unlikely that answers aren't compromised.

Questions like mother's maiden name, school history, first car, etc. Could be part of a breach, or phished out of an email or dating app (commonly show occupation and education history by default now).

The ability to bypass or disable 2FA is one of the current weaknesses in how it's been employed recently. Depending on your resources I would suggest a few alternatives.

  • Let them pick 'nothing' (and the account is forever locked)

  • Consider allowing users to use their Google/Facebook accounts to login (you don't hAve to worry about 2FA as that's Google/FBs issue)

  • let them specify a recovery email (other than their normal email, which gets recovery email)

  • send a physical letter to the account on file

  • send an email/call/SMS then wait a period of time (days) and if you don't hear back from the account owner allow a login without 2FA (idea is they would respond if the attempt was invalid/not from them).

1
  • 1
    Actually, you quite often don't even need to use phishing to get the info asked for in a lot of security questions. In many countries, you can figure out someone's mother's maiden name or the name of the hospital where they were born with some rather trivial public records requests. A lot of the other things asked for are also things people who know a person well would know. And all that isn't even account for all the misguided individuals who share such information freely on social media. Oct 15, 2018 at 18:26

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .