Many sites have a step during registration when you have to create security questions and answers for them. Is this type of security layer considered as 2FA? From what I know, 2FA is used for the purpose of typing in data which is not permanent, like SMS message which comes to you when you are logging in. You don't know it before it comes. So, is answering remembered security questions is 2FA according to 2FA principles and the framework of security questions?
-
1Have a look at the tag wiki for [multi-factor].– nobodyCommented Mar 3, 2021 at 9:14
Add a comment
|
3 Answers
There are main 3 factors
- Something You know - Password, Question, PIN..etc (Type 1)
- Something you have - Token, Smart card...etc (Type 2)
- Something you are - Iris scan, Fingerprint...etc (Type 3)
If you want to multifactor you can use combination of them. Security question and password are in same category. That mean it is not a two factor.
In addition that
- Somewhere you are
- Somewhere you are not
also consider as deferent factors. You can use combination of these factors as well. Then it will become multi-factor.
-
I heavily disagree with the idea that "something you know" and "something you have" are two distinct things. They're more like liquids and gasses. For example, the password
Lemonade1is clearly "something I know". The passwordK27%=Fj^d?xHQ7KgrBzhZtkn=qU8UB3Z, that I had to store in my password manager becomes "something I have". A physical key is "something I have", but if I know a key's depth and spacing, it suddenly becomes "something I know", because I can replicate it at will. What I am getting at is don't get too hung up on categorizations, as they're not as clear cut as it seems.– user163495Commented Mar 3, 2021 at 9:42 -
3I cannot agree with your point, because according to your explanation nothing can categorize. Because even biometric device authentication can be misuse. Simply face recognition can be cheated with high definition image. That mean if i have HD image of someone else, it becomes something you have category. I understand in different way. Password or anything based on your knowledge is "Something you know". Any authentication based on physical device you have is "Something you have".– InfraCommented Mar 3, 2021 at 10:04
-
As per your physical key explanation, although you know how to replicate exact key. You still need replicate key to open that door. You cannot use your knowledge to open door. Otherwise if i know door access system will be failed to secure open state when power is gone. I can bypass biometric based door access system by just disconnecting power and it also based on my knowledge..– InfraCommented Mar 3, 2021 at 10:11
-
2The distinction between categories of factors is a design guideline. The idea being that someone able to find one factor of a category is likely to be able to find another in the same category. However, this distinction is irrelevant to the question of the OP. Commented Mar 3, 2021 at 10:24
-
1@MechMK1: Then you can say the same about any other authentication factor :) Token or smart card or smartphone are not auth. factors if you give them to somebody else. Fingerprint is not an auth. factor if you allow everyone to have a copy of it. Etc. :) Commented Mar 3, 2021 at 19:11
Security questions, such as "what is the name of your first pet?" are not 2FA because they substitute to your password.
In 2FA, you need to input the two factors to authenticate (log in). For example, you need to type your password and present a badge. Or type a password and then type a PIN code you receive by SMS or read on an electronic token. Thus, the overall strength of the authentication is the combination (multiplication of combinations, or sum of entropy) of the two factors.
Security questions, on the other hand, substitutes to your primary authentication method (in the following, I'll suppose it's a password, but it works the same with any authentication method). If you do not know the password (because you forgot it or because you try to break in), you can instead input a "security answer". Knowing or guessing either the password or the "security answers" is enough to authenticate. Therefore, the overall strength of the authentication is the weakest (the minimum) of the two factors. That's why "security questions" are a security anti-pattern that usually weaken the overall security.
answered Mar 3, 2021 at 10:21
-
"because they substitutes to your password" - this is not a reason why it cannot be used for 2FA, because password does not have to be a part of 2FA. A 2FA can be implemented without password, e.g. based on fingerprint and smart card. Commented Mar 3, 2021 at 17:51
-
But if you have to input both password and answers for security questions?– NoNameCommented Mar 4, 2021 at 8:16
-
@mentallurg For ease of reading I assume that the primary authentication factor is a password, because it is most often the case. Commented Mar 4, 2021 at 10:02
-
@NoName Then it can be 2FA. But that's rarely how security questions are used. Commented Mar 4, 2021 at 10:04
-
@A.Hersean: 1) This is not the case when we can speak of ease of reading. 2) "most often the case" - Why do you say that? Do you have any statistics? There are millions of smartphones where authentication is done based of face recognition. There are even more smartphones and laptops where authentications is done based on fingerprint. Your statement could be fine 10 or 15 years ago, but not now days. Commented Mar 4, 2021 at 11:03
Security question can only substitute to a password: they are something you know because you do not need a specific object to answer them (not something you have) and anybody knowing the response can anwser (not something you are).
But you should be aware that they are now seen as a poor quality password substitution. Because as you should remember them easily, people knowing you, or finding information on social medias could guess the answers. For example, they are known to have allowed the compromission of Sara Palin's mail account.
So being a poor way of doing something you know, you should better avoid them, and avoid to put them in a multifactor authentication procedure, which is expected to be based on secure components.
answered Mar 4, 2021 at 10:27
