My question has to do with whether 2-Factor Authentication protects against a compromised system (malware). There are a couple of scenarios in which I wonder whether it does:
- Every time you login to a web-service (let's say: e-mail) you enter your password and generated one-time password every single time.
- You only login once on a web-service and tick a "Remember me" checkbox (causing you to not have to authenticate for a month or even longer).
- You login in an application (let's say Steam) and you enter your password and generated one-time password every single time.
- You only login once in a application (let's say Steam) and tick a "Remember this device" checkbox (causing you to not have to authenticate for a month or even longer).
Does 2FA protect against malware in none/any/all of these situations? As you may be able to decipher from my questions, I am especially wondering whether:
- Can browsers build a safe "Remember this device" feature or does the web simply now allow for it?
- If browsers can't implement a safe "Remember this device" feature, are application also not able to (application do have more access to unique system information)?
- Should I never tick any "Remember me/this device" checkboxes because they're insecure, and does this mean that I have to login using a OTP every single time?