8

the scenario is in a corporate environment and not connected to internet. The other day I was arguing with my colleague on whether email is good enough to be the second factor in a 2FA system.

My administrators will log in to the system via our corporate network, and then an OTP will be sent to his email which he will use to enter the system.

However my colleague is for the OTP to be sent to the mobile phone. I said that even if he is going to use a mobile phone, he is still going to be in the internal network to key in the OTP. It will not differ much because the email server is also in the internal network. I also mentioned that it's much easier to lose a mobile phone, whereas an email server won't fail that easily since it can be running in redundancy.

What are your opinions? Does more secure organizations today rely more on mobile phones for OTP?

7

By definition, 2FA is if you authenticate users based on two of the following:

  • Something you know (like a password)

  • Something you have (like a key)

  • Something you are (biometrics)

I see that people often argue in which category e-mail should belong. Although many argue that it belongs in the "Something you have" category, I think that it should rather belong to the "Something you know" category because it is most often just protected by a password. Therefore, password+email OTP is not really 2FA. And also, could a person be using the same password for his e-mail as for the system logon?

Using password + mobile phone OTP would be real 2FA (Something you know + Something you have)

  • Thanks for your reply. In that case, i can classify my email server the same as a phone? An email server is something I have as well, isn't that true? – Pang Ser Lark Jul 15 '15 at 14:18
  • 7
    An SMS sent to a mobile phone is no more "something you have" than an email. There are more weaknesses in SMS delivery, and in many of they devices they are delivered to (smartphones with a gazillion apps with SMS access), than in a properly configured email setup. Other than that, I agree with everything you said. – KristoferA Jul 15 '15 at 14:26
  • Thats true. If the mail server is internal, if the users never use the same password for mail and system logon and if you encrypt the mail traffic, than it has advantages over the mobile phone version because the OTP is never leaving your network. But i would still not call it 2FA. Maybe just enhenced authentication. – stanko Jul 15 '15 at 14:32
2

I also discourage using email in this scenario.

Obviously - if you are only using it internally - the attacker could only be internal (or an external first have to become interal). The email flow internally is probably more easy to sniff than dealing with the BTS for delivering the SMS.

But both ways deliver the second component (to avoid the discussion about "factors";-) via a not necessarily that secure channel.

So you might take into account providing even more secure ways to authenticate. You could achieve this by using smartphone apps, hardware tokens or even seedable hardware tokens. In case of seedable hardware tokens like the Yubikey you are the one to create the secret cryptokey that is used to generate the One Time Passwords, while in case of "preseeded" hardware, the vendor did.

You might want to take a look at privacyIDEA, which is an open source solution, that supports all these kind of tokens, email, sms, smartphone, hardware, seedable. Then you can decide which system or which administrator requires which security level.

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.