The Stack Overflow podcast is back! Listen to an interview with our new CEO.

Questions tagged [authenticator]

The tag has no usage guidance.

Filter by
Sorted by
Tagged with
0
votes
1answer
45 views

What security considerations should be made when choosing a universal authenticator app? [closed]

The USPTO has two-step authentication: recommended applications comprise: Google Authenticator Microsoft Authenticator Oracle Authenticator Assume that I use my Gmail address as the USPTO username. ...
1
vote
1answer
93 views

What point in Authenticator App 2FA when SMS fallback is enabled

I would like to move away from SMS 2FA (because of Should 2FA over SMS be considered insecure in the wake of recent SS7 attacks? for example). But some services that provide Authenticator apps ...
0
votes
0answers
86 views

Tomcat OIDC Authenticated Realm

I am currently using a tomcat authenticator implementation (https://github.com/boylesoftware/tomcat-oidcauth). The authenticator is implemented as a tomcat valve. This implementation still requires a ...
0
votes
1answer
70 views

Which party stores the link between user and device in WebAuthn?

Looking at the online resources regarding WebAuthn, I still haven't been able to figure out which of the involved components (or parties) that store the link between the user and his/her authenticator ...
0
votes
1answer
64 views

How does DUO push button method and other methods actually work?

Google authenticator uses HOTP and TOTP algorithm for TFA. What is the basic working principle of DUO push? What brings security to DUO push?
0
votes
1answer
359 views

How does Google Authenticator interact with apps on an iPhone?

I am clear on how Google Authenticator works when logging on to a website and I am clear on that. However, these days everyone is using apps for everything. The Twitter app, the Facebook app, the ...
0
votes
0answers
21 views

what were the impacts when a user affected with data breach when he signed up with third party authentication [duplicate]

Background : Recently quora got breached and database were reported to be stolen, Myself used to have a habit of signing in through google login. Problem statement : What were the possible ...
4
votes
2answers
435 views

Do all Authenticator Apps use the same algorithm?

I've tried some Authenticator Apps (Google,Microsoft,Authy,Lastpass,...) and all of those apps generate same one time passwords at the same time ? So, these apps are use the same algorithm which is a ...
3
votes
1answer
109 views

Having sudo mode in a web application, why use a password instead of one time passwords?

Online services, like GitHub, have Sudo mode. Sudo mode means, that a user performing delicate actions has only to authenticate every couple of minutes, but than again, although they are already ...
16
votes
3answers
188k views

Where to find Google Authenticator backup codes?

I'm slightly confused about obtaining Google Authenticator backup codes. I can find my Google Account backup codes at: https://myaccount.google.com/signinoptions/two-step-verification But have no ...
0
votes
4answers
136 views

What is a good method to authenticate users and make sure they don't give their credentials to someone else?

I'm new here I hope this is the right place to ask this question, I work at a call center and I've been asked to create a TimeClock system however we have the problem that agents share their ...
1
vote
0answers
38 views

Does producing TOTP tokens weaken the stored secret? How much? [duplicate]

I am using Google Authenticator as a second factor on some sites, (including my Google Account). Every now and then I need to produce a token to log in. If some attacker received those tokens over ...
6
votes
6answers
385 views

When should I issue more than one multi-factor device to a user? Is it OK to give several active tokens vs none at all?

Most of the conventional IT.Sec thinking I've seen says that a user can only have one multi factor authentication device. I'd like to challenge that defacto-thinking and ask if there is ever an ...