3

Is there any Security Benefits/Risk in keeping old "Here is your 2FA login code" in email and text?

I always wonder if seeing one that is unread could queue me in to something bad happening but also concerned that keeping such a long history might reveal some secrets with the length of history if they are all kept.

Has anybody written any material on this matter in the Security Sphere?

I feel this is different from HOTP with as HMAC hashing algoritme a hash from the SHA-2 family because I'm asking about security posed by long-term storage of old access codes.

3
  • You question duplicates this one: HOTP with as HMAC hashing algoritme a hash from the SHA-2 family. Usually TOTP uses HMAC + SHA-1. It is not broken. Having a set of previous known values does not give an attacker any advantage.
    – mentallurg
    Commented Nov 2, 2022 at 8:10
  • Who's to have access to the old 2FA messages? Just you or they can be consumed by a SIEM?
    – user284677
    Commented Nov 2, 2022 at 9:00
  • At the moment just me, but I'm sort of asking in case of a compromise would those leaking out cause issues.
    – Mallow
    Commented Nov 2, 2022 at 14:11

2 Answers 2

2

Usually there is no main security risk or benefit when it comes to keeping old emails and text containing time-bound 2FA codes.

There are potential enumeration opportunities where an attacker could know when you logged in and first set up MFA by analysing the codes received by datetime, however this is a stretch and if they already have access to your phone/mail, they will be able to do far worse with less effort.

Roger Grimes wrote a book with Wiley specifically around Hacking Multifactor Authentication, however these attacks are more related to security issues around SMS based MFA, and MFA fatigue attacks.

0

The difference in doing so versus not doing so is miniscule in practice.

The only real information either you or an attacker can get is when you logged onto which online service. That may or may not be useful in some circumstances.

So for example, an attacker could tell you logged into e-Bay on the 15th of April 2021 at 20:43. This in turn would indicate you had an e-Bay account associated with that address at that time.

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .