10

the scenario is in a corporate environment and not connected to internet. The other day I was arguing with my colleague on whether email is good enough to be the second factor in a 2FA system.

My administrators will log in to the system via our corporate network, and then an OTP will be sent to his email which he will use to enter the system.

However my colleague is for the OTP to be sent to the mobile phone. I said that even if he is going to use a mobile phone, he is still going to be in the internal network to key in the OTP. It will not differ much because the email server is also in the internal network. I also mentioned that it's much easier to lose a mobile phone, whereas an email server won't fail that easily since it can be running in redundancy.

What are your opinions? Does more secure organizations today rely more on mobile phones for OTP?

Improve this question

2 Answers 2

Reset to default
7

By definition, 2FA is if you authenticate users based on two of the following:

  • Something you know (like a password)

  • Something you have (like a key)

  • Something you are (biometrics)

I see that people often argue in which category e-mail should belong. Although many argue that it belongs in the "Something you have" category, I think that it should rather belong to the "Something you know" category because it is most often just protected by a password. Therefore, password+email OTP is not really 2FA. And also, could a person be using the same password for his e-mail as for the system logon?

Using password + mobile phone OTP would be real 2FA (Something you know + Something you have)

Improve this answer
5
  • 1
    Thanks for your reply. In that case, i can classify my email server the same as a phone? An email server is something I have as well, isn't that true?
    – JinPangPang
    Jul 15, 2015 at 14:18
  • 9
    An SMS sent to a mobile phone is no more "something you have" than an email. There are more weaknesses in SMS delivery, and in many of they devices they are delivered to (smartphones with a gazillion apps with SMS access), than in a properly configured email setup. Other than that, I agree with everything you said.
    – KristoferA
    Jul 15, 2015 at 14:26
  • Thats true. If the mail server is internal, if the users never use the same password for mail and system logon and if you encrypt the mail traffic, than it has advantages over the mobile phone version because the OTP is never leaving your network. But i would still not call it 2FA. Maybe just enhenced authentication.
    – pineappleman
    Jul 15, 2015 at 14:32
  • I've just been reading an article , pointing another fact about email. What if your email has 2FA itself ? way better than SMS
    – kommradHomer
    Mar 17, 2020 at 7:53
  • @stank "Therefore, password+email OTP is not really 2FA." This sentence is not really a valid conclusion based on objective reasoning of any kind. It looks like mere paranoid pub talk. The answer starts from a twisted definition of 2FA which attempts to blur the meaning of the F in 2FA using vague categories (what is the difference between to "have" and to "know"?). It also makes no sense how the word "you" is used in the preamble and categories. // To anyone reading this page: OTP by email is perfectly fine as a 2FA. Don't believe the paranoia of these people.
    – WhyWhat
    Nov 17, 2021 at 11:39
3

I also discourage using email in this scenario.

Obviously - if you are only using it internally - the attacker could only be internal (or an external first have to become interal). The email flow internally is probably more easy to sniff than dealing with the BTS for delivering the SMS.

But both ways deliver the second component (to avoid the discussion about "factors";-) via a not necessarily that secure channel.

So you might take into account providing even more secure ways to authenticate. You could achieve this by using smartphone apps, hardware tokens or even seedable hardware tokens. In case of seedable hardware tokens like the Yubikey you are the one to create the secret cryptokey that is used to generate the One Time Passwords, while in case of "preseeded" hardware, the vendor did.

You might want to take a look at privacyIDEA, which is an open source solution, that supports all these kind of tokens, email, sms, smartphone, hardware, seedable. Then you can decide which system or which administrator requires which security level.

Improve this answer

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .