Questions tagged [authenticator]
The authenticator tag has no usage guidance.
15
questions
1
vote
0answers
40 views
What is Threat Profile is Microsoft addressing with the MSAL URI format?
Applications built for MSAL 1.0 and MSAL 2.0 have a default application URI of MSAL://GUIDHere/AppName
This is in contrast with what other IDP's are doing.
Can anyone explain the benefits or drawbacks ...
0
votes
1answer
74 views
Two factor verification apps IOS
I have an iPhone XR with the latest updates.
I use Microsoft Authenticator for some 2 step verification for work related stuff.
Today I enabled the Instagram two factor security option and choose the ...
0
votes
1answer
123 views
How safe is my login system (conceptually)?
I implemented a 2FA authentication for a web app with PHP and Google Authenticator. In order to login to my system there are a few steps:
User types in a complex master password in order to access ...
3
votes
2answers
1k views
How do backup codes work in TOTP, like Google Authenticator?
My understanding is that in TOTPs are like HMAC where code is derived from time.
However, I am struggling to understand the concept of Backup Codes in Google Authenticator, and how are they ...
0
votes
1answer
56 views
What security considerations should be made when choosing a universal authenticator app? [closed]
The USPTO has two-step authentication: recommended applications comprise:
Google Authenticator
Microsoft Authenticator
Oracle Authenticator
Assume that I use my Gmail address as the USPTO username. ...
1
vote
1answer
197 views
What point in Authenticator App 2FA when SMS fallback is enabled
I would like to move away from SMS 2FA (because of Should 2FA over SMS be considered insecure in the wake of recent SS7 attacks? for example).
But some services that provide Authenticator apps ...
0
votes
1answer
218 views
Which party stores the link between user and device in WebAuthn?
Looking at the online resources regarding WebAuthn, I still haven't been able to figure out which of the involved components (or parties) that store the link between the user and his/her authenticator ...
0
votes
1answer
116 views
How does DUO push button method and other methods actually work?
Google authenticator uses HOTP and TOTP algorithm for TFA.
What is the basic working principle of DUO push? What brings security to DUO push?
1
vote
1answer
890 views
How does Google Authenticator interact with apps on an iPhone?
I am clear on how Google Authenticator works when logging on to a website and I am clear on that.
However, these days everyone is using apps for everything. The Twitter app, the Facebook app, the ...
6
votes
2answers
2k views
Do all Authenticator Apps use the same algorithm?
I've tried some Authenticator Apps (Google,Microsoft,Authy,Lastpass,...) and all of those apps generate same one time passwords at the same time ?
So, these apps are use the same algorithm which is a ...
3
votes
1answer
180 views
Having sudo mode in a web application, why use a password instead of one time passwords?
Online services, like GitHub, have Sudo mode. Sudo mode means, that a user performing delicate actions has only to authenticate every couple of minutes, but than again, although they are already ...
21
votes
3answers
223k views
Where to find Google Authenticator backup codes?
I'm slightly confused about obtaining Google Authenticator backup codes.
I can find my Google Account backup codes at:
https://myaccount.google.com/signinoptions/two-step-verification
But have no ...
0
votes
4answers
138 views
What is a good method to authenticate users and make sure they don't give their credentials to someone else?
I'm new here I hope this is the right place to ask this question, I work at a call center and I've been asked to create a TimeClock system however we have the problem that agents share their ...
1
vote
0answers
42 views
Does producing TOTP tokens weaken the stored secret? How much? [duplicate]
I am using Google Authenticator as a second factor on some sites, (including my Google Account).
Every now and then I need to produce a token to log in.
If some attacker received those tokens over ...
6
votes
6answers
395 views
When should I issue more than one multi-factor device to a user? Is it OK to give several active tokens vs none at all?
Most of the conventional IT.Sec thinking I've seen says that a user can only have one multi factor authentication device. I'd like to challenge that defacto-thinking and ask if there is ever an ...
