8

(There is a highly related question, however I believe mine is not a duplicate, since it deals with resetting a password without access to the account, not changing it while being logged in.)

Say someone has gained access to my email that I used to register some accounts with. Assume also that these accounts all have some kind of 2FA, be it a 30-second code generated by an app, a U2F key - the type doesn't matter for my question.

In my understanding, in order for the attacker to change the password of an account, there are two ways:

  • Log into the account and change the password in the internal settings, without using the associated email. Even if we leave our computer/phone unattended with an active session of the relevant account, therefore bypassing the need for the hacker to also guess the account password, the change is still impossible. This is because, as explained in the question linked above, this would require at least 2FA verification, possibly 2FA + the original account password.

  • On the log-in screen for the account, use the 'reset password' option to send a reset email to the email account that we assumed the hacker had access to. I am confused as to what happens then:

    1. is the 2FA needed to send the reset email in the first place? If not,
    2. is the attacker able to reset the password, but not to actually log in, since the 2FA is still in place? This essentially means that they can't access the account, but nor can we.
    3. is the attacker able to reset the password and log into the account, since the 2FA somehow becomes void?

Of course, scenario 1) is the most desirable from the perspective of the legitimate user, 2) is significantly worse, 3) is tragic. But which one actually happens when someone tries to reset a password for an account with 2FA enabled?

  • 2
    Why do you think the you can't access the account in 2 and why do you think the 2FA becomes void in 3? – Limit May 11 at 2:48
  • 1
    @Limit In 2), they can change my account password and also email password, which locks me out of both and prevents from reverting the changes. 3) was a hypothetical situation, I was asking IF that ever happens. – dzejkob May 11 at 12:35
  • 1
    With my bank that uses "2FA", the answer is "you can obtain the username, reset the password, and then log in all using SMS, whether you want that to be true or not." Oh, and the security codes for that are indistinguishable from the codes they send you to prove your identity over the phone, which they will always ask you for if they call you. If you're asking because you're wondering if there's a way around 2FA on a particular site, I'd recommend you try changing your password and see what happens, regardless of what they claim. – Kat May 11 at 15:37
  • @Kat looks like you might want to ask the question "Who do I rat my bank out to for having poor security practices?" – HAEM May 12 at 13:59
26

Technically, this is a question about how you should implement 2FA (or how you should expect it to be implemented), since there's nothing inherent in 2FA that answers your questions in either direction. With that said, there are certainly best practices.

2FA (or multi-factor authentication in general) should apply whenever the user is being asked to prove their identity in any way (that is, to authenticate). So you should prompt for MFA when the user is doing anything where you would normally request a password (such as changing their current password or email address, or changing MFA settings). You should also prompt for MFA any time the user is doing anything that takes the place of a password, such as clicking a link in a password reset email.

For your three scenarios, #1 is unlikely just because requesting a password reset email usually doesn't require any authentication at all, so it'd be an odd place to put a MFA demand. However, using the email in any way - that is, actually resetting the password - should require MFA. So #2 is technically incorrect - an attacker can't reset the password - but it's true that they can't log in either. The correct answer is sort of "#1.5".

However, again, "which one actually happens" will depend 100% entirely on how that particular service implemented MFA, and there's no guarantee they've done it correctly. I've seen sites that do it like #3.

| improve this answer | |
  • That's a good point in the first paragraph. I guess "1.5" is good enough from the user's perspective - the hacker can send the reset email, but not actually use it. However, it's very worrying that scenario 3 exists out there in the real world... – dzejkob May 11 at 12:41
  • How do you handle the situation where a user no longer has access to their MFA method and forgets their password? – Prime May 11 at 18:05
  • Everyone does it like #3, and they let you use the second factor (typically SMS) as the only factor needed to reset the password... 🤦🤦🤦 – R.. GitHub STOP HELPING ICE May 11 at 18:06
  • 1
    @Prime Well, if they lose their MFA access (including backups like recovery codes), it barely matters if they've forgotten the password; they can't log in! With that said, there are account recovery options. If it's something super-important, like a bank account or whatever, you would typically have to show / provide government-issued ID. If it's something where they prioritize convenience a lot, like Facebook, they probably have some complicated account recovery process based on what they know about you. If it's something super-secure like a password manager or crypto exchange, you're SOL. – CBHacking May 12 at 12:41
1

If i'm not wrong, 2FA has to be manually disabled, it will not be voided with a change of password. Some sites/applications might require 2FA to change the password. So you have to look at the attacker POV on how to disable 2FA.

Disabling 2FA varies from sites to sites. For example, cryptocurrency sites requires manual identification like a video or a picture of yourself with the necessary ID/Passport. Some is as simple as an OTP to your phone number, some through a secondary email?

If the attacker is able to reset password, he will still need 2FA, which answers your point 2. For point 1, resetting password simply do not require 2FA. Just think about it, you click on "Forgotten your password?" > enter your email that you want to reset your password > 2FA prompt? The answer is no, no prompt for 2FA at that stage.

| improve this answer | |
  • 3
    Your first sentence is a matter of implementation choice, not anything inherent to 2FA. With that said, the design you describe is the generally accepted best practice, and furthermore, actually disabling the additional factor often requires re-authentication itself. – CBHacking May 11 at 3:59

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.