1

Many sites have a step during registration when you have to create security questions and answers for them. Is this type of security layer considered as 2FA? From what I know, 2FA is used for the purpose of typing in data which is not permanent, like SMS message which comes to you when you are logging in. You don't know it before it comes. So, is answering remembered security questions is 2FA according to 2FA principles and the framework of security questions?

1
  • 1
    Have a look at the tag wiki for [multi-factor]. – nobody Mar 3 at 9:14
3

There are main 3 factors

  • Something You know - Password, Question, PIN..etc (Type 1)
  • Something you have - Token, Smart card...etc (Type 2)
  • Something you are - Iris scan, Fingerprint...etc (Type 3)

If you want to multifactor you can use combination of them. Security question and password are in same category. That mean it is not a two factor.

In addition that

  • Somewhere you are
  • Somewhere you are not

also consider as deferent factors. You can use combination of these factors as well. Then it will become multi-factor.

11
  • I heavily disagree with the idea that "something you know" and "something you have" are two distinct things. They're more like liquids and gasses. For example, the password Lemonade1 is clearly "something I know". The password K27%=Fj^d?xHQ7KgrBzhZtkn=qU8UB3Z, that I had to store in my password manager becomes "something I have". A physical key is "something I have", but if I know a key's depth and spacing, it suddenly becomes "something I know", because I can replicate it at will. What I am getting at is don't get too hung up on categorizations, as they're not as clear cut as it seems. – MechMK1 Mar 3 at 9:42
  • 3
    I cannot agree with your point, because according to your explanation nothing can categorize. Because even biometric device authentication can be misuse. Simply face recognition can be cheated with high definition image. That mean if i have HD image of someone else, it becomes something you have category. I understand in different way. Password or anything based on your knowledge is "Something you know". Any authentication based on physical device you have is "Something you have". – Infra Mar 3 at 10:04
  • As per your physical key explanation, although you know how to replicate exact key. You still need replicate key to open that door. You cannot use your knowledge to open door. Otherwise if i know door access system will be failed to secure open state when power is gone. I can bypass biometric based door access system by just disconnecting power and it also based on my knowledge.. – Infra Mar 3 at 10:11
  • 2
    The distinction between categories of factors is a design guideline. The idea being that someone able to find one factor of a category is likely to be able to find another in the same category. However, this distinction is irrelevant to the question of the OP. – A. Hersean Mar 3 at 10:24
  • 1
    @MechMK1: Then you can say the same about any other authentication factor :) Token or smart card or smartphone are not auth. factors if you give them to somebody else. Fingerprint is not an auth. factor if you allow everyone to have a copy of it. Etc. :) – mentallurg Mar 3 at 19:11
2

Security questions, such as "what is the name of your first pet?" are not 2FA because they substitute to your password.

In 2FA, you need to input the two factors to authenticate (log in). For example, you need to type your password and present a badge. Or type a password and then type a PIN code you receive by SMS or read on an electronic token. Thus, the overall strength of the authentication is the combination (multiplication of combinations, or sum of entropy) of the two factors.

Security questions, on the other hand, substitutes to your primary authentication method (in the following, I'll suppose it's a password, but it works the same with any authentication method). If you do not know the password (because you forgot it or because you try to break in), you can instead input a "security answer". Knowing or guessing either the password or the "security answers" is enough to authenticate. Therefore, the overall strength of the authentication is the weakest (the minimum) of the two factors. That's why "security questions" are a security anti-pattern that usually weaken the overall security.

7
  • "because they substitutes to your password" - this is not a reason why it cannot be used for 2FA, because password does not have to be a part of 2FA. A 2FA can be implemented without password, e.g. based on fingerprint and smart card. – mentallurg Mar 3 at 17:51
  • But if you have to input both password and answers for security questions? – NoName Mar 4 at 8:16
  • @mentallurg For ease of reading I assume that the primary authentication factor is a password, because it is most often the case. – A. Hersean Mar 4 at 10:02
  • @NoName Then it can be 2FA. But that's rarely how security questions are used. – A. Hersean Mar 4 at 10:04
  • @A.Hersean: 1) This is not the case when we can speak of ease of reading. 2) "most often the case" - Why do you say that? Do you have any statistics? There are millions of smartphones where authentication is done based of face recognition. There are even more smartphones and laptops where authentications is done based on fingerprint. Your statement could be fine 10 or 15 years ago, but not now days. – mentallurg Mar 4 at 11:03
0

Security question can only substitute to a password: they are something you know because you do not need a specific object to answer them (not something you have) and anybody knowing the response can anwser (not something you are).

But you should be aware that they are now seen as a poor quality password substitution. Because as you should remember them easily, people knowing you, or finding information on social medias could guess the answers. For example, they are known to have allowed the compromission of Sara Palin's mail account.

So being a poor way of doing something you know, you should better avoid them, and avoid to put them in a multifactor authentication procedure, which is expected to be based on secure components.

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.