2

I found a code by SMS or TOTP on a phone as a second factor of authentication to be a good solution for when you're using your computer to login to a website. Most people have a phone which can either receive a text, or can install an app.

But more people are using their phone to login to websites as well. If you then configure the two factor authentication on the same device, it kind of loses a big security advantage as it's all on the same device. Are there any best practices for this issue? Anyway to kind of restore the advantage you have when using both pc/phone?

  • What attacker are you concerned about? Since you have 2 factor authentication and ideally a password protected phone, then the only attacker who could impersonate you is one who has your phone password and website password already. If you use a phone with no screen lock, you save your passwords in your phones browser and you lose your phone, then yeah anyone can log in. But if you're the type of person using 2 factor authentication I doubt you have left yourself that vulnerable. – Owen Jul 26 '15 at 15:38
  • I guess you're right. The disadvantage is in practice very minimal. – Arie Jul 27 '15 at 21:32
2

You still have the same advantage. Two factor authentication with SMS/TOTP is based on two things :

  • Something you know - your password
  • Something you have - your phone

If you log in using your phone you need to know the password and... have the phone. This way it's still the same amount of security.

  • But if your phone gets stolen they have the second factor. Although in practice, unless very targeted, it won't be a critical issue, but it seems less safe than having the factors separate on two devices. – Arie Jul 26 '15 at 11:55
  • 2
    It's still something you have and something you know. You could try out double "something you have " authentication. For example a smart card or something similair. However, this is how "Something you have" works. You need to have something, and know something. If they steal your phone, they have it. – Cube Jul 26 '15 at 11:57

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.