3

I found a code by SMS or TOTP on a phone as a second factor of authentication to be a good solution for when you're using your computer to login to a website. Most people have a phone which can either receive a text, or can install an app.

But more people are using their phone to login to websites as well. If you then configure the two factor authentication on the same device, it kind of loses a big security advantage as it's all on the same device. Are there any best practices for this issue? Anyway to kind of restore the advantage you have when using both pc/phone?

Improve this question
2
  • What attacker are you concerned about? Since you have 2 factor authentication and ideally a password protected phone, then the only attacker who could impersonate you is one who has your phone password and website password already. If you use a phone with no screen lock, you save your passwords in your phones browser and you lose your phone, then yeah anyone can log in. But if you're the type of person using 2 factor authentication I doubt you have left yourself that vulnerable.
    – Owen
    Jul 26, 2015 at 15:38
  • I guess you're right. The disadvantage is in practice very minimal.
    – Arie
    Jul 27, 2015 at 21:32

1 Answer 1

Reset to default
3

You still have the same advantage. Two factor authentication with SMS/TOTP is based on two things :

  • Something you know - your password
  • Something you have - your phone

If you log in using your phone you need to know the password and... have the phone. This way it's still the same amount of security.

Improve this answer
2
  • But if your phone gets stolen they have the second factor. Although in practice, unless very targeted, it won't be a critical issue, but it seems less safe than having the factors separate on two devices.
    – Arie
    Jul 26, 2015 at 11:55
  • 2
    It's still something you have and something you know. You could try out double "something you have " authentication. For example a smart card or something similair. However, this is how "Something you have" works. You need to have something, and know something. If they steal your phone, they have it.
    – Cube
    Jul 26, 2015 at 11:57

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .