Questions tagged [authenticator]

The tag has no usage guidance.

Filter by
Sorted by
Tagged with
31 votes
2 answers
5k views

What is the point of entering numbers in the two-factor authentication app?

Nowadays, 2FA apps usually require you to insert a number which you are presented with when trying to authenticate. For example, the following screenshot is from Microsoft Authenticator: This is ...
hb20007's user avatar
  • 417
0 votes
1 answer
172 views

Is Using an Authenticator App on the Same Device as the Passwordless Application a True 2FA?

I am building an application that a user can receive an access to by an internal worker. This works using a magic link, where the user will receive a one time link to authenticate in the app. Now I ...
Luka Demetrashvili's user avatar
0 votes
2 answers
209 views

Security of password managers vs. risk of losing access

Is it safe not to have a 2FA for a password manager itself? It seems that using an app for TOTP authentication for a password manager could increase the security. But it turns out that in this case I ...
Broadways2's user avatar
22 votes
2 answers
5k views

What, if anything, can a person accomplish who has intercepted an emailed QR image for Authenticator?

A web hosting company has emailed me a QR code so I can have Authenticator generate a 6-digit PIN to use as the second factor after I've logged into my portal with username and password. What, if ...
Tim's user avatar
  • 341
1 vote
2 answers
683 views

How MS Authenticator works

When using MS Authenticator on a Microsoft account, the user fills in the email address or username. After that, the user presses one of the three numbers in the MS authenticator app and is logged in. ...
Martijn's user avatar
  • 51
1 vote
0 answers
86 views

Is it secure to also make the mobile app client the authenticator app?

Most services that support it seem to have a standalone 2FA authenticator app (Microsoft Authenticator, Google Authenticator) instead of integrated authentication in their mobile apps (admittedly, ...
minseong's user avatar
  • 207
2 votes
1 answer
96 views

Is there any security reason to not allow adding authenticators for a certain account?

I have recently added 2FA for my Google account using an authenticator installed on my mobile phone. After doing this, I have realized that it would be nice to also have the authenticator installed in ...
Alexei's user avatar
  • 2,183
2 votes
1 answer
201 views

Backup Google Authenticator transferring QR code

I understand that saving a screenshot of the QR code during the OTP setup process is enough to back up a single account, however, is this the same for the QR code generated during the Google ...
lucasresck's user avatar
2 votes
1 answer
912 views

The Wrong Icon for NordVPN on Authy

I recently turned on the multi-factor authentication on NordVPN and I use Authy for the authenticator. After scanning the QR code on the website, I found that the icon displayed in the Authy app was ...
Gary Hu's user avatar
  • 23
1 vote
0 answers
103 views

What is Threat Profile is Microsoft addressing with the MSAL URI format?

Applications built for MSAL 1.0 and MSAL 2.0 have a default application URI of MSAL://GUIDHere/AppName This is in contrast with what other IDP's are doing. Can anyone explain the benefits or drawbacks ...
makerofthings7's user avatar
0 votes
1 answer
147 views

Two factor verification apps IOS

I have an iPhone XR with the latest updates. I use Microsoft Authenticator for some 2 step verification for work related stuff. Today I enabled the Instagram two factor security option and choose the ...
CaptainAhab's user avatar
0 votes
1 answer
274 views

How safe is my login system (conceptually)?

I implemented a 2FA authentication for a web app with PHP and Google Authenticator. In order to login to my system there are a few steps: User types in a complex master password in order to access ...
Asperger's user avatar
  • 145
3 votes
2 answers
3k views

How do backup codes work in TOTP, like Google Authenticator?

My understanding is that in TOTPs are like HMAC where code is derived from time. However, I am struggling to understand the concept of Backup Codes in Google Authenticator, and how are they ...
blackbox007's user avatar
0 votes
1 answer
114 views

What security considerations should be made when choosing a universal authenticator app? [closed]

The USPTO has two-step authentication: recommended applications comprise: Google Authenticator Microsoft Authenticator Oracle Authenticator Assume that I use my Gmail address as the USPTO username. ...
gatorback's user avatar
  • 1,541
3 votes
1 answer
405 views

What point in Authenticator App 2FA when SMS fallback is enabled

I would like to move away from SMS 2FA (because of Should 2FA over SMS be considered insecure in the wake of recent SS7 attacks? for example). But some services that provide Authenticator apps ...
Qortex's user avatar
  • 341
0 votes
1 answer
416 views

Which party stores the link between user and device in WebAuthn?

Looking at the online resources regarding WebAuthn, I still haven't been able to figure out which of the involved components (or parties) that store the link between the user and his/her authenticator ...
Lars Andren's user avatar
0 votes
1 answer
338 views

How does DUO push button method and other methods actually work?

Google authenticator uses HOTP and TOTP algorithm for TFA. What is the basic working principle of DUO push? What brings security to DUO push?
Jay's user avatar
  • 3
1 vote
1 answer
1k views

How does Google Authenticator interact with apps on an iPhone?

I am clear on how Google Authenticator works when logging on to a website and I am clear on that. However, these days everyone is using apps for everything. The Twitter app, the Facebook app, the ...
Tasos's user avatar
  • 21
6 votes
4 answers
4k views

Do all Authenticator Apps use the same algorithm?

I've tried some Authenticator Apps (Google,Microsoft,Authy,Lastpass,...) and all of those apps generate same one time passwords at the same time ? So, these apps are use the same algorithm which is a ...
mongkonsrisin's user avatar
3 votes
1 answer
327 views

Having sudo mode in a web application, why use a password instead of one time passwords?

Online services, like GitHub, have Sudo mode. Sudo mode means, that a user performing delicate actions has only to authenticate every couple of minutes, but than again, although they are already ...
tjati's user avatar
  • 294
24 votes
3 answers
237k views

Where to find Google Authenticator backup codes?

I'm slightly confused about obtaining Google Authenticator backup codes. I can find my Google Account backup codes at: https://myaccount.google.com/signinoptions/two-step-verification But have no ...
a.s.t.r.o's user avatar
  • 343
0 votes
4 answers
192 views

What is a good method to authenticate users and make sure they don't give their credentials to someone else?

I'm new here I hope this is the right place to ask this question, I work at a call center and I've been asked to create a TimeClock system however we have the problem that agents share their ...
user3044096's user avatar
1 vote
0 answers
47 views

Does producing TOTP tokens weaken the stored secret? How much? [duplicate]

I am using Google Authenticator as a second factor on some sites, (including my Google Account). Every now and then I need to produce a token to log in. If some attacker received those tokens over ...
Marcel's user avatar
  • 4,086
6 votes
6 answers
463 views

When should I issue more than one multi-factor device to a user? Is it OK to give several active tokens vs none at all?

Most of the conventional IT.Sec thinking I've seen says that a user can only have one multi factor authentication device. I'd like to challenge that defacto-thinking and ask if there is ever an ...
makerofthings7's user avatar