1

It seems silly to ask about using two-factor authentication without TLS/SSL but, I have a vendor that is using public IP without TLS and asking for login creds.

Would the login be more secure if two-factor authentication was enabled without TLS?

Using something like Google Authenticator and, knowing the keys are ephemeral the window for stealing the credentials would be about <30 seconds, correct? It seems a bit more secure but not by much. What are your thoughts?

  • I assume you mean < 30 seconds? – Voidpaw May 18 '15 at 14:56
  • startssl certs are free, if that's the issue – Neil McGuigan May 18 '15 at 19:28
5

2FA will decrease the chance that an attacker can steal a complete set of login credentials because, as you point out, the second factor is likely limited by lifetime or a once-use policy.

But 2FA will not affect snooping or session hijacking. So, while an attacker may find it more difficult to login as you, they can watch your communication stream and send messages that appear to be from your session.

Besides providing confidentiality, SSL also ensures that you are actually talking to the server. Without SSL, a MiTM attack can pretend to be the server. For example, you can try to logout from the server to kill your session but a MiTM can intercept the logout command and return you to a page that makes it looked like you were logged out though you really weren't.

So it may prevent future false login attempts but doesn't really make you secure at all.

0

As you have stated yourself: it is slightly more secure because it is limited to a < 30 seconds timeframe, but that really doesn't matter much in the grand scheme of things: it is still very insecure and it will mostly just increase the effort legitimate users will have to put in.

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.