2-Factor Authentication vs Security Questions

Question

I have an account with a bank that has additional security option.

When it does not recognize a device being used to access the account, it will either:

1. Prompt with 1 of 3 security questions
2. Send a one-time token via text message to cell phone.

I determined that it "recognizes" a device via cookie (when I clear my browser cookies is when it prompts me again for the additional security option).

Let's assume that the security questions / answers I have chosen are not subject to social engineering from browsing facebook/linkedin/etc.

Just had a few questions:

1. Can anyone help me enumerate all the reasons that the one-time token is more secure than the security questions? Here are some one of the ones I could think of:

   • It is true 2 Factor: what-you-know (login/password credentials), what-you-have (cell phone).
     As opposed to what-you-know (login/password credentials) and another what-you-know (secret question/answer)
   • It is dynamic and only provides access for a given amount of time.
   • Are there others I am missing?

2. Is the fact that they are using cookies to "recognize" a device and thus no longer prompting for the one-time token subverting this security mechanism (like putting an iron gate out front and leaving the back door unlocked)?

3. Have an account with a different bank that uses similar security. However, when I clear my cookies, they still recognize my device. I would assume they are tracking the known device(s) by IP Address and possibly other HTTP header information. Would this be a better / more secure way to "recognize" than the cookie?

Thanks,

Answer 1

1. Are there others I am missing?

The one-time password has more entropy than dog's name and is less vulnerable to enumeration/dictionary attacks.

On a phishing site, it is fairly easy to display some trivial personal question (e.g. what is your dog's name). The phishing site doesn't need to know the answer. On the other hand it is pretty difficult to spoof a one-time password sent to your phone, since the phisher won't know your number.

2. putting an iron gate out front and leaving the back door unlocked?

Maybe a little bit. Probably not a concern if the cookie has sufficient entropy, i.e. is hard enough to guess. If the hacker has some means of actually getting the cookie-- e.g. has physical access to the computer-- you're screwed anyway.

3. when I clear my cookies, they still "recognize" my device

There are a couple possible explanations for this.

One explanation, as you have noticed, is IP address, although this wouldn't work very well for mobile devices or certain ISPs (IPv4 addresses do change from time to time).

Another explanation is that the cookie is backed up by a different token, e.g. a Flash token, which is not cleared when you clear cookies.

A third explanation is that they are not really checking whether they "know" your computer. Instead they are performing a risk-bases analysis of your browser's fingerprint, cookies, IP address, etc. and deriving a score. You get prompted for the MFA if your score isn't good enough. A lack of cookie doesn't necessarily trigger it.

Answer 2

The one-time token offers much more security than the secret question simply because it implements 2-factor authentication; all things being equal, 2FA (password + code via SMS, password + RSA SecurID token, etc) is always safer than a simple password.

On the other hand, the infamous "secret question" - so often offered by web services as a security enhancement similar to 2FA - not only does not offer any improvement over a password, but it diminishes security. This because secret answers have much less entropy ("What is your favourite color?") and are subject to be guessed ("What was the name of your high school?").

The fact that your bank allows you to bypass 2FA via cookie is done to improve user accessibility (it somehow marks your computer as "safe" so all subsequent logins from there will be done via a simple password). It might be a security risk if your laptop is stolen or infected with a trojan. Personally I'd recommend that you clear the cookies after each session so to be forced to always authenticate yourself via 2FA.

Answer 3

1. Can anyone help me enumerate all the reasons that the one-time token is more secure than the security questions?

To assess the security of a system we need not only praise its advantages but also its drawbacks. So I am rather focusing on this last aspect as you and @JohnWu mentioned the essential positive sides of OTPs but which are vulnerable to these attacks:

• Pharming
• Real-time replay
• Man-in-the- middle
• Man-in-the Browser

Some solutions are deployed to resolve some aspects of these vulnerabilities, one of them is hardened browsers, others suggested the use of encrypted tokens. Personally I prefer OATH tokens that are used for example by Google.

Also there are some other considerations (even if they are extreme but still likely to happen cases) such as when your device (laptop/phone) is stolen just before you use the token you've got. Note that depending on the country and the method used to generate and deliver the token, some banks used to charge clients for it (at least in the past).

3. Have an account with a different bank that uses similar security. However, when I clear my cookies, they still "recognize" my device. I would assume they are tracking the known device(s) by IP Address and possibly other HTTP header information. Would this be a better / more secure way to "recognize" than the cookie?

Check my answer to your second question:

2. Is the fact that they are using cookies to "recognize" a device and thus no longer prompting for the one-time token subverting this security mechanism (like putting an iron gate out front and leaving the back door unlocked)?

There are much things an attacker can do with a hijacked cookie but in the context you describe (banking system), it is useless if your cookie is compromised. Your question is too serious if the cookies are the only factor used by banks to recognize your device, but fortunately other effective techniques such as browser fingerprinting are used in parallel (some other methods are listed here too: How do banks determine when to ask for two factor authentication?