In two step authentication, should I check step 1 before proceeding to step 2 or check both at the end?

Question

I asked this question first on Stack Overflow but it was suggested that Information Security would be a better place for it (pretty obvious in hindsight).

https://stackoverflow.com/questions/24304756/in-two-step-authentication-should-i-check-step-1-before-proceeding-to-step-2-or

I have a typical web application forms authentication process with two steps:

• Step 1: Request username and password
• Step 2: Request some characters (for example, 2nd, 5th and 8th) from a secret phrase

Should I authenticate the username and password before going to Step 2? Or should I collect all three bits of information (username, password and characters) and check them at the end?

Most websites I've seen check the username and password and if they don't authenticate, never ask for the characters. On the other hand, it could be argued that checking everything at the end and if they don't match, displaying an error message that doesn't explain which bit failed would be more secure. That gives away less information like displaying "Username or password is incorrect" (without specifying which) in a simple 1 step authentication.

The problem with the second approach (aside from being less user-friendly) is that Step 2 requires obtaining a valid user in Step 1, otherwise it's hard to know the length of the secret phrase to ask for valid characters (there's no point asking for the 10th character if the phrase is only 9 characters long). The application would also have to hold on to the password in a secure manner between the two steps.

So which one is better? Is there a third approach I should consider?

Answer 1

Don't do this! This is stupid. If it is a client requirement, push back on the client. You are supposed to be the expert. Tell the client when they are doing something that doesn't serve their interests. This is simply an elaborate single factor authentication and provides absolutely zero additional security over a slightly longer password requirement.

The client may think that this is a second factor, but it is not. For two factor authentication it must be two DIFFERENT factors from something you have, something you know and something you are. These are both something you know, so no additional security is provided beyond the extra characters on the password, it is just a little more convenient that having to type the entire phrase (which is basically a long but very weakly chosen password). It also has no impact on preventing hash attacks against the stored password (and online brute force shouldn't be possible due to account lock outs.)

If the client still wants this despite the lack of any actual security benefit, I don't see any way not to do it as two steps since, as you point out, you don't know how many characters to choose from unless you know the length of the phrase that it is going to be working off of and hopefully at least the secret phrase is protected by their password (though I somehow doubt it).

Answer 2

Typically a multifactor challenge happens either after password authentication or at the same time.

I don't think telling your customers what went wrong during login is going to hurt your security so much that it justifies the amount of frustration that you'll be subjecting them to if you don't tell them what went wrong.

If they misspelled their username, or their account is locked, that is useful information for them to have. Telling them that the password is wrong, doesn't weaken the password. Telling them that the MFA challenge failed, doesn't weaken the MFA.

Wrong username can be discovered usually anyways by the 'i forgot my ' anyways, so streamlining the process for forgetful human beings would be appreciated, instead of locking their account.

For working from home this morning, I logged in with multifactor and since it is conditional to where I log in (in the office I don't have to MFA), MFA happens after normal authentication as a second step.

For logging into my password manager from a non-trusted machine, I require MFA, and that comes as a second stage, not the same stage. Making it a second stage of authentication lets you make it conditional. Not everyone with my password manager chooses to require MFA. In this way you can turn it off for people that don't appreciate it.

Oh and I agree with AJ Henderson, that second stage using random chars from a secret word is a mickey mouse idea from someone that doesn't know what they are doing. So if you're doing that instead of true MFA, its a placebo anyways, don't worry too much about it.