Linked Questions

36
votes
7answers
19k views

Could SQRL really be as secure as they say?

I just came across https://www.grc.com/sqrl/sqrl.htm With Secure QR Login, your phone snaps the QR code displayed on a website's login page . . . . and YOU are securely logged in. This seems ...
19
votes
5answers
8k views

Does Google use extended validation certificates?

I just changed a password on a Google account while using the Chrome browser. After doing so, I noticed that the https connection to Google was not highlighted in green signifying that it was an "...
24
votes
3answers
2k views

Why are developers using embedded user agents for 3rd party auth? What are the alternatives?

I've noticed a trend in mobile and desktop apps in recent years with the advent of OAuth (and it may also affect other frameworks) to request a user to sign up or log in using 3rd party authentication ...
11
votes
1answer
8k views

YubiKey or Google authenticator?

I'm using lastpass and I would like to implement a 2FA in my account, but I don't know which one is the most secure, a software authenticator such as google authenticator or an USB device as Yubikey. ...
8
votes
3answers
1k views

2-factor authentication - Who am I trusting?

I'm confused about the risks of 2-factor authentication. I'm a developer, who has to do some ops, and considering turning it on for my DigitalOcean and GitHub accounts. Both offer TOTP(?) and ...
6
votes
1answer
1k views

Are there any risks associated with using a single U2F/FIDO key with multiple sets of credentials?

I recently got a FIDO U2F key (AKA a Yubikey). I currently only use it across a range of services, but could this be a security risk in any way? For example, if I use my U2F key to authenticate on a ...
2
votes
3answers
1k views

Vulnerabilities despite FIDO U2F?

FIDO U2F seems much more secure than one-time-passwords (OTP), especially TOTP, because of the challenge-response architecture. In what ways is a U2F user still vulnerable? I presume if a user's ...
5
votes
2answers
2k views

App-based 2FA versus Hardware-based 2FA

How do apps like Symantec VIP / Okta Verify and similar implementations compare to using a hardware auth token such as the recent U2F devices? How real is the possibility of an Android system being ...
5
votes
1answer
290 views

How does the attestation mechanism of U2F guarantee the provenance of the key material?

I'm trying to understand Yubico's documentation of the U2F standard, and getting hung up on the PIV attestation piece. The security claim appears to be that the authoritatively-signed attestation ...
-1
votes
3answers
299 views

Is 2FA secure, and can it ever be broken?

Having weak passwords are so easily cracked by hackers and quantum computers that people introduced an extra layer of security, called Two Factor Authentication. How it works is it sends a message to ...
7
votes
1answer
256 views

fake website used for phishing purposes

Our real web site is www.abc.com. Recently Intel notified us of another web site www.fake.com having some parts of the site appearing the same as our real site. This is obviously a phishing site. Not ...