1

To log in to a enterprise web app, our security team is insisting on 2FA as it is hosted on our internal network.

The proposed solution is to have a standard username (email address) and password login, which will then trigger a four digit PIN emailed to the user which they will have to enter to log in.

To my mind that is two sides of the same coin (something the users knows) - using the email address, rather than sending the PIN to a phone number or a physical token.

Is this strictly 2FA? Is it significantly more secure, or is it just an additional inconvenience to the user in return for little gain?

3

From a pure security standpoint I wouldn't regard this as 2FA (which is traditionally defined as "two of something you know, something you have, something you are).

From a practical standpoint I can see some potential issues with this in an enterprise setting. In many companies login to applications is tied to Active Directory sign-in which is also used for access to the e-mail system, so an attacker with access to the users account username/password would likely also be able to get access to the token.

Even if they're not formally linked a lot of corporate users in my experience will practice a kind of informal single sign-on where they manually sync up their passwords for all corporate systems, so again an attacker with access to one will get access to the others, bypassing your 2FA.

If you consider another likely attack scenario (malware on the users PC) again it would bypass this requirement as it would be possible to access the users passwords for the application and e-mail service using a keylogger.

So in summary, I'd say that of your two options this is more an additional inconvenience in return for little gain. If the risk profile of the application justifies 2FA, I'd look at full 2FA style solutions (e.g physical tokens or biometrics)

  • Thanks. Sorry I should be more clear - it will also be accessed by external customers as well as internal users, but it is hosted within our enterprise network. I think that doesn't really affect your answer though. – Midas Jun 5 '14 at 8:57

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.