Questions tagged [authenticator]
The authenticator tag has no usage guidance.
1
vote
1answer
58 views
What point in Authenticator App 2FA when SMS fallback is enabled
I would like to move away from SMS 2FA (because of Should 2FA over SMS be considered insecure in the wake of recent SS7 attacks? for example).
But some services that provide Authenticator apps ...
0
votes
0answers
31 views
Tomcat OIDC Authenticated Realm
I am currently using a tomcat authenticator implementation (https://github.com/boylesoftware/tomcat-oidcauth). The authenticator is implemented as a tomcat valve. This implementation still requires a ...
0
votes
1answer
56 views
Which party stores the link between user and device in WebAuthn?
Looking at the online resources regarding WebAuthn, I still haven't been able to figure out which of the involved components (or parties) that store the link between the user and his/her authenticator ...
0
votes
1answer
53 views
How does DUO push button method and other methods actually work?
Google authenticator uses HOTP and TOTP algorithm for TFA.
What is the basic working principle of DUO push? What brings security to DUO push?
0
votes
1answer
213 views
How does Google Authenticator interact with apps on an iPhone?
I am clear on how Google Authenticator works when logging on to a website and I am clear on that.
However, these days everyone is using apps for everything. The Twitter app, the Facebook app, the ...
0
votes
0answers
21 views
what were the impacts when a user affected with data breach when he signed up with third party authentication [duplicate]
Background :
Recently quora got breached and database were reported to be stolen, Myself used to have a habit of signing in through google login.
Problem statement :
What were the possible ...
3
votes
2answers
283 views
Do all Authenticator Apps use the same algorithm?
I've tried some Authenticator Apps (Google,Microsoft,Authy,Lastpass,...) and all of those apps generate same one time passwords at the same time ?
So, these apps are use the same algorithm which is a ...
3
votes
1answer
102 views
Having sudo mode in a web application, why use a password instead of one time passwords?
Online services, like GitHub, have Sudo mode. Sudo mode means, that a user performing delicate actions has only to authenticate every couple of minutes, but than again, although they are already ...
12
votes
3answers
172k views
Where to find Google Authenticator backup codes?
I'm slightly confused about obtaining Google Authenticator backup codes.
I can find my Google Account backup codes at:
https://myaccount.google.com/signinoptions/two-step-verification
But have no ...
0
votes
4answers
133 views
What is a good method to authenticate users and make sure they don't give their credentials to someone else?
I'm new here I hope this is the right place to ask this question, I work at a call center and I've been asked to create a TimeClock system however we have the problem that agents share their ...
1
vote
0answers
37 views
Does producing TOTP tokens weaken the stored secret? How much? [duplicate]
I am using Google Authenticator as a second factor on some sites, (including my Google Account).
Every now and then I need to produce a token to log in.
If some attacker received those tokens over ...
6
votes
6answers
384 views
When should I issue more than one multi-factor device to a user? Is it OK to give several active tokens vs none at all?
Most of the conventional IT.Sec thinking I've seen says that a user can only have one multi factor authentication device. I'd like to challenge that defacto-thinking and ask if there is ever an ...
