0

Can a file e.g. containing some random key that is generated by my web site/app be acceptable as the second factor (the first factor being a normal password) in 2FA?

Someone said so to me in the past, but i doubt about it, because i think a key in a file is not very different from a password in that it is stored on the hard drive and can possibly be read and copied by adversaries.

I don't know much about hardware security tokens (e.g. USB dongles), but seems to me they can atleast be protected against copying/cloning via ordinary and easy means.

|improve this question
1

As described this scenario wouldn't satisfy any requirements I have for MFA from a vendor or anything, but it is, strictly speaking, a Something you Have. You're perilously close to re-inventing the wheel here, since SSL client certificates and PKI already exist.

A client certificate installed on a device/browser is a valid factor for authentication and combined with a username/password is suitably multi-factor. There are implementation issues with PKI that make it difficult, so it isn't common in many environments.

If you'd like something more whiz-bang there are several options for doing multi-factor with mobile devices that generate codes (TOTP - Authy/Google Authenticator/etc.) or do really fancy push notification and/or one-time passcode generation (Duo Security's service and mobile app).

|improve this answer
  • thank u incumbent! client certificate was a good mention but seems to me that something that can be inserted into the device just in time and then removed quickly/easily better can fit the actual purpose of "something the user has". in other words, something that isn't tied to anything (without the users' explicit consent/intent) but to the user himself. – user273084 Feb 26 '14 at 16:51
  • Please do consider that something inserted into the device and then removed can also be used without the users' explicit consent. Certificate-based authentication has the benefit of not being usable without the user authorizing the request for the certificate, and also providing a passphrase to unlock the certificate for use — one could have a password-protected file on a USB drive or something but, again, that is a duplicated effort in my opinion. – incumbent Feb 26 '14 at 21:13
  • I think client certificates must be installed on the machine before they can be used. right? if yes, then the installation and un-installation process should be more cumbersome/slow than simply inserting and removing a usb drive. please tell me about these to continue. – user273084 Feb 27 '14 at 5:39
0

A file containing a key is considered a second factored of authentication (something you have) opposed to a password (something you know). The important thing here is that you want to protect the thing you have as much as possible. So saving the keyfile together with what it opens isn't the best of ideas. Storing it on seperate media such as a USB drive and only inserting it the moment you need it is better as you the exposure of what you have is limited.

|improve this answer

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.