Linked Questions

28 votes
14 answers
7k views

Why do we even use passwords / passphrases next to biometrics?

In the last couple of days there were a lot of talking about passwords and passphrases, not only here, but on several blogs and forums I follow (especially after XKCD #936 saw the light of this world)....
StupidOne's user avatar
  • 2,812
31 votes
10 answers
14k views

Can IP address be a component of 2-factor authentication?

I have a bunch of Linux machines that I wish to administer over the Internet. I currently use SSH keys, but have been advised to use 2-factor authentication. SSH Keys are something you know. Is an IP ...
Mike's user avatar
  • 433
13 votes
5 answers
5k views

Confusion: Why isn't a passhrase encrypted SSH key two factor auth?

I'm trying to figure out the best practices for accessing my dev box from a public terminal. Most sources I've found recommend protecting the box with some kind of two factor authentication, such as ...
Tammer Ibrahim's user avatar
11 votes
8 answers
23k views

Is it possible to steal money directly from the systems of a big bank?

Sometimes I imagine: My money in the bank is just a floating point number in a mainframe's memory... So, if I just change 1 bit, I will win a lot of money... The most common way to steal money in ...
Rodrigo's user avatar
  • 327
10 votes
7 answers
611 views

Aren't permanantly logged in accounts inherently insecure?

The basic premise behind a "keep me logged in until I log out" feature is a cookie is stored with some identifier that is used to log the user in again when returning to the site. While these ...
user avatar
4 votes
4 answers
4k views

Why does my bank use this card reader for 2FA?

I hold my business account with Lloyds TSB [UK] and the process for logging in to their online banking service(s) is as follows: Login page Enter customer number Enter password Put debit card into ...
Anonymous's user avatar
  • 209
11 votes
3 answers
2k views

How secure is a password app that stores both the password and two factor secret in one place?

Take for example 1Password, that now can store your password and one time password secret in a single place (your 1Password vault). I know it isn't truly two-factor anymore, but how much better is it ...
kolossal7's user avatar
  • 111
6 votes
3 answers
1k views

What is the value in asking for a second password for sensitive operations?

When a user has logged in to a system using their primary password, is there any value in asking for a distinct second password when performing sensitive functions? Does it provide any benefit over ...
Craig Curtis's user avatar
9 votes
4 answers
3k views

How does LastPass' grid multi-factor authentication work behind the scenes?

I understand how to use the Grid multi-factor authentication as a user but how does it work technically? Specifically how can just a few letters from the grid be enough to decrypt any secret defined ...
snth's user avatar
  • 995
4 votes
1 answer
1k views

How many authentication factors are there?

The three classes that we all know and love: Something you know. Something you have. Something you are. I've also seen references to "somewhere you are". Is this really a fourth factor? How many ...
logicalscope's user avatar
  • 6,384
1 vote
1 answer
989 views

What regulations *require* multi-factor authentication?

What industries require multi-factor authentication? Please include the following information: Country Industry Regulation name Additional information as you see relevant. Some additional ...
makerofthings7's user avatar