1

Our organization uses a Voip "push to talk" type app on Android and IOS devices. The application connects to a server on premises through the internet. To use the app, the user is assigned a UID, which can only be used from on a single device. When a user logs in for the first time, the server logs the device ID ( which I think is the CPU SN) and the user ID. After that, the user ID can not be used on another device unless the sys admin releases the association between UID and device ID in the server.

Our organisation security is requiring 2FA. Would our current set up count as 2FA since security relies on a device in the users possession, and granting of the user ID?

4
  • 7
    I don't know even if that can be considered 1FA.
    – ThoriumBR
    Commented Jun 24, 2021 at 1:58
  • Concur. Possession of the device is the only factor. Commented Jun 24, 2021 at 4:29
  • It is not even clear if possession of the device as implemented is really a usable factor or if the derived information could be easily used on some other system with a modified client application. Based on this description it is just relying on the client side to report the right value and cannot enforce that the value matches the device. Commented Jun 24, 2021 at 4:31
  • Yikes, Frank. Yikes.
    – hft
    Commented Jun 24, 2021 at 7:34

1 Answer 1

2

Assuming that the login process you describe includes a password along with the system-assigned UID:

The authentication system itself cannot be considered a factor. It's like saying that because you "have" a user account on a system, then that's a factor. The app is part of the authentication system, so it can't be a factor. This question has actually been asked here a few times, so it is a common misunderstanding.

You need an authentication process, not just an identification process. All you are doing is recognising the device and inferring the userID.

If you need 2FA (and there may be some further questions and clarifications on this requirement), then you need to add a factor to your system (assuming you also have a password).

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .