Questions tagged [multi-factor]

a multi factor authentication requires at least two sets of credentials. This is typically something you know (e. g. a password) and something you own (e. g. a token generator or mobile phone), but could also be something you are (a biometric).

Filter by
Sorted by
Tagged with
3 votes
1 answer
104 views

How does 2FA help with fake websites?

According to https://techcrunch.com/2018/12/25/cybersecurity-101-guide-two-factor: Only the legitimate site will send you a working two-factor code. That might be true, but how would this help if ...
user avatar
0 votes
2 answers
45 views

Storing backup keys (2FA) for online accounts

So I spent the day looking for a good solution of storing the backup keys or the 2FA codes and can't seem to find a convenient way for me, many people have different takes on this, so far I found 2 ...
user avatar
  • 1
1 vote
1 answer
86 views

Is it possible to crack a 2FA/MFA secret key provided you know enough of the previous generated codes?

I have two accounts that won't show me the 2FA/MFA "Secret Key" used to generate the multifactor codes. Because of this, I am forced to use specific MFA apps rather than my preferred one. If ...
user avatar
  • 13
-1 votes
1 answer
56 views

Can using 2FA compromise me in any way if the website owner goes rogue?

Context This question concerns a website that has no commercial or business background, it is a purely personal project. This website is ran by 2 strangers from the internet, who lend access to ...
user avatar
  • 101
0 votes
2 answers
147 views

Is this really two-factor-authentication?

In the country I live in, most authentication for online banking or authorities (such as tax) is based on an app. It has two operation modes: Enter personal number on website (the personal number is ...
user avatar
  • 163
0 votes
1 answer
58 views

Does splitting auth SSO and MFA parts, between client and service companies have any issues?

My company provides a single SaaS product for corporate clients. For one client we are implementing SSO with them as authentication provider (via Azure AD/SAML for now, but the library we are using is ...
user avatar
0 votes
1 answer
66 views

How to improve 2FA security when a hacker has access to the user's email

We have a web app which is used by many companies. Each user of the web app could work for more than one of these companies. We want each company to have the ability to enable 2FA for all the users in ...
user avatar
0 votes
1 answer
110 views

Doesn't 2FA increase the vulnerability of an account?

You create an account on an online service X with login=your email + password. Compare these 2 situations: No 2FA enabled. The only risk is if your email is compromised: the "I lost my password&...
user avatar
  • 3
3 votes
2 answers
648 views

Is a "trusted device" a factor on its own?

Inspired by a discussion elsewhere, I've been wondering if the concept of a "trusted device" is considered a factor - on it's own - in multi-factor authentication? Given context is that a ...
user avatar
  • 163
0 votes
1 answer
28 views

Will Lastpass ignore old 2FA tokens from the Yubikey? (tokens leaked accidentally)

Somestimes I press on my yubikey accidentally and it writes the token on the screen and even sends automatically to the person I'm talking to on some chat, because it presses enter. This happened ...
user avatar
0 votes
1 answer
37 views

SOTP - Signed One Time Password

I was thinking of a OTP algorithm that signs a randomly generated password. There are two things at play here: The MFA portal Knows the public key of the user's MFA app The user's MFA app Has a ...
user avatar
0 votes
1 answer
35 views

Creating Password from 2 different part

I’m looking for Term Or Some platform for managing Password Authentication with this way : Password construct from 2 Part , First one is static and you can make it and second Part Generate From TOTP ...
user avatar
0 votes
2 answers
77 views

Implementing geo-location factor for authentication

I recently had an idea about this: Why is the geo-location not used as authentication to ensure ownership of an account/login in addition to a password? This would work over GPS which is quite precise ...
user avatar
  • 31
0 votes
1 answer
24 views

Does 2FA security protect data stored on the back end?

I want to know how my data is protected if I enable 2FA on my account on the back end side. I am using a MDM service to manage our company phones. My company works with sensitive data of clients. I ...
user avatar
0 votes
1 answer
40 views

Multifactor auth in OAuth2 Password flow

This resource (and others) mention that OAuth2 Password flow doesn't provide mechanism for multi-factor authentication. Does that mean other flows do? How does MFA fit in the OAuth2 framework? What ...
user avatar
-1 votes
1 answer
49 views

Is a 2fa app really better than SMS 2fa with sim-pin?

A sim-pin safeguards against sim-swapping, which is the primary advantage of using an authenticator app instead of SMS, is this not so?
user avatar
  • 9
1 vote
0 answers
56 views

Is it secure to also make the mobile app client the authenticator app?

Most services that support it seem to have a standalone 2FA authenticator app (Microsoft Authenticator, Google Authenticator) instead of integrated authentication in their mobile apps (admittedly, ...
user avatar
10 votes
7 answers
4k views

Does the new Danish authentication solution for online contact with municipality etc. genuinely use 2FA?

In Denmark, the current digital identification/authentication solution for pretty much any online contact with the municipality, state, etc. is being switched over to a setup consisting of the ...
user avatar
0 votes
0 answers
34 views

How are MFA mobile notifications implemented?

Consider mobile authentication applications, such as Microsoft Authenticator, Google Authenticator, and LastPass Authenticator. They all offer 6-digit MFA authentication, but this is not my focus; my ...
user avatar
  • 101
0 votes
0 answers
43 views

How to best support multiple hardware keys (yubikeys, etc.) as a web app?

I've implemented second factor authentication for my web app via FIDO U2F, and am testing using a Yubikey. I have read that it is best practice to associate multiple hardware keys in case one is lost, ...
user avatar
1 vote
1 answer
46 views

Should a user refill their 2FA when they login into a different account and back?

Some of our users on our website have two or more accounts they use to log in. With each device they log in a specific device ID is generated. This device ID is stored on the device itself and on the ...
user avatar
  • 113
0 votes
0 answers
56 views

In addition to username and password, can client ID and secret be considered as a multi-factor authentication?

Two-factor or multi-factor authentication is based on three possible forms of authentication: Something you know Something you have Something you are Since username and password are considered as &...
user avatar
0 votes
3 answers
151 views

How could someone's account that is secured by MFA Yubikey be compromised?

Let's say that I purchased a MFA Yubikey device to secure my accounts. If an attacker wanted to compromise my accounts that are secured with this YubiKey, would this be possible without having the ...
user avatar
1 vote
2 answers
81 views

"encrypting" a physical copy of a number by remembering a series of mathemtical operations rather than a key. Is this safe?

For example I want to have a hard copy of my backup 2FA codes so that if I lose/destroy/don't have my phone or laptop on me. I, of course, do not want them in plain text. I don't want to encrypt them ...
user avatar
1 vote
3 answers
108 views

How can losing 2FA render encrypted data inaccessible?

As per Bitwarden's FAQ If you don’t have your Recovery Code saved somewhere outside of your Vault, there is unfortunately no way for the team to recover the account or data therein. You’ll need to ...
user avatar
0 votes
0 answers
91 views

Can a file on your computer be the "something you have"?

I've read a lot of advice against storing your 2FA codes in your password manager and I don't understand why. Isn't a file on your computer something you have? There is the added benefit that you don'...
user avatar
  • 121
2 votes
1 answer
66 views

Is there any security reason to not allow adding authenticators for a certain account?

I have recently added 2FA for my Google account using an authenticator installed on my mobile phone. After doing this, I have realized that it would be nice to also have the authenticator installed in ...
user avatar
  • 2,173
0 votes
1 answer
72 views

How can 2FA help prevent formjacking?

This article by Avira (part of NortonLifeLock) claims that 2FA (2-Factor Authentication) may be sufficient to protect against formjacking: Enable 2-Factor Authentication: Create strong and complex ...
user avatar
0 votes
1 answer
71 views

O365 MFA: Challenge (Approve or Deny) sign on - dangerous?

I have been searching resources online about proper MFA/2FA (with O365 specifically) considerations. How is the MFA push challenge notification to Approve or Deny a sign-on not dangerous? I have yet ...
user avatar
  • 1
5 votes
3 answers
378 views

Is it a bad idea to replace passwords with OTP?

As I understand things, given a user with proper password management (e.g. with a libre password manager like KeePassXC) the only realistic threat is having passwords leaked the following ways: A: ...
user avatar
  • 189
1 vote
2 answers
277 views

Virtual Yubikey [closed]

If reports are to be believed, Google and others are starting to force 2FA on user accounts starting late ~2021: https://www.theverge.com/2021/10/5/22710421/google-security-2fa-inactive-account-...
user avatar
  • 27
1 vote
1 answer
126 views

Why do services generate multiple 2FA backup codes?

In case you lose access to your two-factor authentication (2FA) codes, you are only required to enter one of the backup codes. So why do services like Google generate multiple codes if it doesn't ...
user avatar
  • 113
-1 votes
1 answer
76 views

As Multi-Factor Authentication (MFA) seems to be the holy grail to much of the threats, are there any cases where MFA is compromised? [closed]

As Multi-Factor Authentication (MFA) seems to be the holy grail to much of the threats we see today, are there any cases where MFA is breached or compromised? What are the threat vectors to MFA?
user avatar
0 votes
2 answers
106 views

is it ok to reveal number of digits in a muti-factor code input screen?

Security-minded UX designer here. Some user interfaces reveal the number of characters in the UI for entering a second-factor security code. Is there risk in doing it this way? How much more secure is ...
user avatar
43 votes
1 answer
5k views

Why is SMS OTP not as secure as Authenticator Applications such as Microsoft Authenticator? [duplicate]

Why is SMS OTP not as secure as Authenticator Applications such as Microsoft Authenticator, etc? Is it because of snooping of mobile communications? or?
user avatar
0 votes
1 answer
118 views

Multiple SMS activation codes received by error

For several days now I am receiving activation codes by SMS that look like this: Your ToYou verification code is 8058 Some are from ToYou, that seems to be a delivery service, others are from similar ...
user avatar
  • 101
1 vote
0 answers
77 views

How secure are passwords, usernames and tokens stored in KeyChain (iOS 15)

As of iOS 15, users can pair their stored passwords with tokens. These are automatically populated by the OS via Safari on websites, when the user tries to login. That means, although the information ...
user avatar
  • 11
0 votes
1 answer
150 views

How is totp considered 2fa?

I was wondering about the design of totp and 2fa. I learned that 2fa is any 2 of the following authentication methods: Something you know (e.g. a password) Something you have (e.g. an email address) ...
user avatar
  • 31
2 votes
1 answer
111 views

Backup Google Authenticator transferring QR code

I understand that saving a screenshot of the QR code during the OTP setup process is enough to back up a single account, however, is this the same for the QR code generated during the Google ...
user avatar
0 votes
2 answers
187 views

Setting Up MFA and/or best security for personal computer for RDS

I am in the process of converting an older computer into a dedicated machine learning server. I want to be able to RDS into it from my current computer and ideally from anywhere. However, I do want to ...
user avatar
  • 53
3 votes
1 answer
533 views

What is Google's "match the number" verification trying to achieve?

When I log into my Google account from my laptop with 2FA enabled, I usually get a prompt on my smartphone in order to confirm the log in. I tap OK and then I am logged in. However sometimes I am not ...
user avatar
  • 133
0 votes
1 answer
107 views

Does having secondary email for 2FA increase security

Bank account have portals that one can access online. After entering my uname/password, OTP is sent via SMS to mobile phone. After entering OTP and password again, one is allowed access to online ...
user avatar
  • 149
0 votes
0 answers
91 views

How safe is LastPass's Remember Password login option when combined with 2FA?

I'm trying to balance ease of use with security on my work computer to use my LastPass vault from a browser extension. I'd like my vault to be inaccessible except when I want to use it. The only way I'...
user avatar
  • 153
2 votes
1 answer
468 views

The Wrong Icon for NordVPN on Authy

I recently turned on the multi-factor authentication on NordVPN and I use Authy for the authenticator. After scanning the QR code on the website, I found that the icon displayed in the Authy app was ...
user avatar
  • 23
2 votes
1 answer
187 views

Is multiple methods of Two-Factor authentication less secure than a single method of 2FA?

If I set up 2FA on my Microsoft account (for example) and I create multiple methods such as SMS, email, and an authenticator app, will I be more vulnerable than if I only set up the authenticator app? ...
user avatar
  • 123
1 vote
1 answer
177 views

Is 2FA based on Google Authenticator Real?

I was reading this response on SE about 2FA: Well, I hate to break this to you, but Google Authenticator plus password isn't really two-factor authentication. Proper 2FA is two separate items out of ...
user avatar
-1 votes
2 answers
210 views

Why is Authy (or TFA in general) considered more secure than just having a long/strong password?

Standard Password When I create an account somewhere, like let's say a crypto exchange, I'm forced to choose a username and a strong password. Let's say I choose: username: thirdratecoder password: ...
user avatar
-1 votes
1 answer
114 views

Is there a way to get 2 factor authentication using an email account instead of a phone app?

So suppose I don't have a phone (or lose it), and I need to do 2fa on an app. I DO always have access to a few email accounts, but I can't seem to find any tricks to have the 2fa go through an email ...
user avatar
0 votes
0 answers
82 views

Is it possible to bruteforce SecurID soft tokens?

We are performing a Red Team engagement for a client. We have obtained a user's STDID file, their PIN, and one output of their token. However, to fully obtain the access granted by their MFA we also ...
user avatar
  • 865
5 votes
4 answers
2k views

Do MFA QR registration codes/keys expire?

MFA recovery codes last forever until used. The TOTP codes expire as per the clock (e.g. 30 seconds). Does the initial QR code to register a MFA device last forever until disabled by a MFA reset? I'm ...
user avatar
  • 123k

1
2 3 4 5
14