Does 2-Factor Authentication protect against malware?

Question

My question has to do with whether 2-Factor Authentication protects against a compromised system (malware). There are a couple of scenarios in which I wonder whether it does:

1. Every time you login to a web-service (let's say: e-mail) you enter your password and generated one-time password every single time.
2. You only login once on a web-service and tick a "Remember me" checkbox (causing you to not have to authenticate for a month or even longer).
3. You login in an application (let's say Steam) and you enter your password and generated one-time password every single time.
4. You only login once in a application (let's say Steam) and tick a "Remember this device" checkbox (causing you to not have to authenticate for a month or even longer).

Does 2FA protect against malware in none/any/all of these situations? As you may be able to decipher from my questions, I am especially wondering whether:

1. Can browsers build a safe "Remember this device" feature or does the web simply now allow for it?
2. If browsers can't implement a safe "Remember this device" feature, are application also not able to (application do have more access to unique system information)?
3. Should I never tick any "Remember me/this device" checkboxes because they're insecure, and does this mean that I have to login using a OTP every single time?

Answer 1

2FA done properly helps protects your authentication to a system by making the login credential time limited. If you use a normal username/password and I obtain it, I can do bad things, as you, whenever I like. With 2FA I have maybe a minute or two to carry out my dastardly plans.

If you (or the service you're connecting to) has malware installed then you still have an issue. Part of your credentials may be obtained and combined with other weaknesses to do BadThings later, or it could be possible to establish a bridgehead on the target system to later exploit. Or maybe even go ahead and do something evil right there and then.

Saved credentials in the browser, remember me tick-boxes etc are by nature a reduction in security in return for greater convenience. If it's your login on your machine which nobody else uses and your anti-virus, patches etc are up to date then it's probably minimal risk. Also depends what the service is too - commenting on Stacks, El Reg etc is very different to treasury operations for a Global100 corporation.

Answer 2

Two-factor authentication is a form of multifactor authentication (MFA): your username and password are things you know, your phone is something you have. You could add biometric authentication; something you are.

Something you know can be stolen without you knowing, MFA prevents a stolen/reused password from being abused.

In practice, most accounts get compromised by either reused passwords being stolen and used, or malware stealing them out of the browser or with a keylogger. MFA protects against someone on the other side of the world logging in with your stolen account, so it is a great protection against that.

On the other hand, there is also sone banking malware that edits your browser page once you're verified.

Android malware is especially nasty, if you don't type in your password on another device, it might sniff it and also read an SMS containing an MFA code.