0

Some websites make it easy to enrol multiple TOTP apps at the same time but make it difficult to disable these apps. For instance, the user would have to completely reset the MFA settings instead of just disabling one TOTP app, or the user would have to provide a state-issued ID to have this done by user support.

What type of threat scenario does this address? After all, an attacker who would be able to authenticate as a legitimate user would then be able to change the password and lock the legitimate user out, so what is the difference?

  • What are the "some websites"? I don't believe this is for security, but just how they have implemented the TOTP. – Esa Jokinen Jun 1 at 14:28
  • I was thinking of OVH (registrar and cloud service provider) and Amazon (the regular Amazon website, not AWS). – Alex Jun 1 at 23:17
0

What type of threat scenario does this address?

If a password dump of ServiceA leaks, and it contains the credentials for a user, and this user have an account at ServiceB protected by 2FA, nobody will be able to authenticate as him, even with the correct password. As password reuse is a common problem with credentials (the vast majority of users have few passwords and use the same passwords on every service).

After all, an attacker who would be able to authenticate as a legitimate user would then be able to change the password and lock the legitimate user out, so what is the difference?

If the account is protected by MFA, an attacker will only be able to authenticate as the user if the MFA token was stolen too. If the attacker have the password but not the MFA, those procedures would help protect the account in the case of a password leak.

If, for example, the legitimate user lose his phone with the MFA token, or his hardware token, but knows the password, he can prove ownership of the account by supplying his ID or another details proving he is the owner, before disabling the 2FA and allowing him to login again.

| improve this answer | |
  • By the What type of threat scenario I don't believe OP was meaning MFA in general, but disallowing revoking only a specific TOTP instead of them all. – Esa Jokinen Jun 1 at 14:27
  • Indeed, I was trying to find a scenario where the attacker would already have a valid password and a valid TOTP generator (in that case why would you disallow revoking a specific TOTP). But perhaps this restriction just depends on how authentication is implemented on specific websites as you point out. – Alex Jun 1 at 23:51
  • @Alex If the server that contains data that links an account to a specific hash the user was given to enter into a TOTP app, was to get hacked and those specific data stolen, then it is possible for an attacker to have both the password and the TOTP. – Amol Soneji Jun 2 at 4:44
  • @Amol Soneji But if the attacker gets there then what is the pount of preventing them from revoking a TOTP while they can add their own TOTP and change the password? – Alex Jun 2 at 9:56
  • @Alex I was just trying to help you think of a scenario similar to "where the attacker would already have a valid password and a valid TOTP generator". – Amol Soneji Jun 4 at 1:36

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.