Questions tagged [multi-factor]

a multi factor authentication requires at least two sets of credentials. This is typically something you know (e. g. a password) and something you own (e. g. a token generator or mobile phone), but could also be something you are (a biometric).

Filter by
Sorted by
Tagged with
11
votes
3answers
4k views

If we fixed SIM jacking would SMS then become a valid way to send an MFA token to?

And if not would like specific reasons why. I have this suspicion that, although an inferior method these days to MFA applications, believe that the security is adequate enough as most phone companies ...
0
votes
0answers
42 views

If I receive Google verification codes that do not work, is my phone compromised? [duplicate]

I know that something similar has happened to other people before (see for instance here or here), but the situation and the question are slightly different. I wanted to log in to my Gmail account ...
0
votes
0answers
39 views

Azure Impossible Travel

So I am trying to hammer out the best process of handling impossible travel alerts and suspicious VPN activity. In my current environment I dont have admin privileges to immediately disable user ...
0
votes
2answers
63 views

What are security benefits (if any) of using multiple passwords (device, password manager, …) vs single strong passphrase when paired with FIDO U2F?

I am evaluating security benefits of requiring employees (in enterprise context) to use multiple passwords (or passphrases) vs single strong randomly generated passphrase (minimum of 8 words) when ...
2
votes
1answer
52 views

Are the authentication factors considered to be of the same strength?

Are the authentication strength of the different authentication factor categories (knowledge-factors, posession-factors and inherence-factors) ranked in any way, like "inheritance-factors are ...
1
vote
3answers
133 views

Using Password Managers to store multiple factors, would this reduce security? [duplicate]

Assume I have a password manager that stores the credentials for a login to a 3rd party service. In this credentials the username, password and a TOTP-seed is stored and the current TOTP-token is ...
75
votes
6answers
19k views

Why is SMS used as a way of verifying a user's mobile, when it is not even encrypted in transit?

I did some research about how secure and private SMS messages are. Providers and governments can see these SMS messages in plaintext, but what is weird is that these messages are not encrypted in ...
0
votes
1answer
67 views

Using SSO, does this count as only one authentication factor?

When using Google SSO, does this count as only one factor of authentication or as many factors as I use for my google account? If it counts as a single factor, would this be "something I have&...
1
vote
0answers
32 views

Do I need TFA if I have a strong password? [duplicate]

This is the inverse of this question here. Google keeps prompting me to enable Two-Factor Authentication for my Google account. I don't like the inconvenience of TFA, such as mandating that I will ...
29
votes
9answers
6k views

When does 'something you have' NOT become 'something you know'?

I am currently trying to get an understanding of multi factor authentication. The biggest issue so far: When does "something you have" NOT get reduced to "something you know"? I ...
0
votes
0answers
30 views

Does a previously logged-in device count as an authentication factor?

Is a device I used previously an a website an additional authentication factor? I would imagine yes, but the device somehow has to send something to the server to prove that it was previously logged ...
2
votes
1answer
72 views

Can possession of device certificate be considered a factor in MFA? [duplicate]

We have had a discussion in our organization about whether possession of a server-issued device certificate can be considered a factor in MFA. The certificate asserts that only enrolled devices can ...
1
vote
1answer
79 views

Trying to determine if our application login constitutes 2FA

Our organization uses a Voip "push to talk" type app on Android and IOS devices. The application connects to a server on premises through the internet. To use the app, the user is assigned ...
5
votes
3answers
1k views

Using Public Key Cryptography for improving 2FA?

When using 2-factor-authentication using plain TOTP, the secret is stored on both the client and the server. This in turn means, that anyone with access to the database (and a key for it) knows the ...
2
votes
2answers
69 views

easy way to share 2fa codes both app and text based

With COVID and everything happening, I have been thinking of death and estate planning a lot lately. I have added my family to my password manager, but not sure what is the easy way to share 2FA ...
0
votes
0answers
73 views

What's the best practices for storing 2fa tokens? [duplicate]

What are the best practices for securely storing TOTP secrets as an extra layer of security for user accounts? This would be used in a webapp login and stored in a server database so that the user can ...
0
votes
0answers
41 views

Why would I need a password manager when I use 2FA? [duplicate]

I have come across many questions concerning what security benefit 2FA provide a password manager. (e.g. this question) On the other hand, if I already use 2FA, why would I need a password manager? ...
0
votes
2answers
89 views

How can scammers reset passwords without accessing the email account?

I've read some of the other questions here but I still can't fully wrap my head around this. I know there are different 2FA implementations but, assuming the hacker can't access the email account, how ...
2
votes
2answers
290 views

Will Google Authenticator stop a sim-swap attack from compromising my Coinbase?

If I use Google Authenticator for Coinbase, and someone sim-swaps my phone number and gains full access to my email account, can they drain my Coinbase account? They would be in control of my email, ...
0
votes
0answers
50 views

How exactly is U2F more secure than OTP? [duplicate]

I've been trying to understand U2F and still don't see why it's more secure than ordinary OTP in some instances. For example if I log into a website with a password and an OTP generated by Google ...
7
votes
1answer
679 views

How should a company manage physical 2FA tokens?

Physical 2FA tokens, such as smart cards or YubiKeys, are becoming more popular in large companies for authentication purposes. However, one issue with them is availability: When a physical 2FA token ...
0
votes
1answer
44 views

Should I use in-app 2fa If I login with google (and have 2fa on google on)

All users in my google domain use 2fa on google accounts. We have on-premise software (gitlab for example) that allows us use google accounts to login. Also, gitlab has a feature of 2fa. Should we use ...
0
votes
0answers
34 views

Can a client with x509 certificate and server side validation of ip-address and deviceId considered a trusted system for less secure login method?

we are working on an web application in which users needs to be able to switch easily between user accounts while working on the same computer. The idea is to have: a strong login (email,password) ...
4
votes
2answers
521 views

Sending OTP before authentication / password verification

One of my old, rarely used computers had still an old password for my pyszne.pl / takeaway.com account stored in my browser's password manager. I tried to log into my account from that computer and ...
-1
votes
3answers
131 views

What's stronger: phone/text 2FA or authenticator app? [duplicate]

I noticed some very advanced sites don't offer 2 factor authentication via phone/text. Example Salesforce's Heroku: Is phone/text based 2 Factor Authentication generally weaker than using an ...
1
vote
0answers
81 views

What are the security risks to NFC based YubiKeys?

What are the risks of using NFC on a YubiKey versus just a hard connector? I imagine it would be possible to sniff some data off of these security keys? How real is the risk of sniffing and what could ...
1
vote
1answer
63 views

How do Services recognise 2-Factor Authentication codes as correct?

Something about the flow of setting up 2-factor authentication is not clear to me. This is the flow of setting up a Service* to use a 2-factor auth app**: Choose setup 2-factor auth in the account ...
12
votes
6answers
5k views

2FA: Why do I need to keep my backup codes for each platform on paper?

I'm looking into setting up 2-factor authentication for my registered accounts. However, when setting up 2FA, for example Reddit, you need to write down backup codes in order to regain access to your ...
1
vote
2answers
86 views

Does it make sense to split two factor authentication between identity providers

A common multi factor authentication solution will ask a user for a username+password and a one-time password. In all documents I can find both factors are asked by the same identity provider. This ...
1
vote
0answers
51 views

MFA authentication to O365 - remote workers users without mobile phone. Which secure solution? [closed]

We are deploying O365 in my company (Teams, Sharepoint, Exchange online, Office suite). In order to connect outside our network (remote workers especially during this pandemic), we've implemented MFA ...
1
vote
2answers
129 views

Are offline OTP systems really secure? [duplicate]

I know that OTP (One-time password) system is the most secure method for now if online. Online OTP systems, like sending code to a phone is secure because the attacker cannot know the code if he doesn'...
0
votes
4answers
100 views

2-factor authentication everywhere: is this possible?

I'm wondering if there is a way to require 2-factor authentication on webpages and Android apps that don't have it by default. I am already using a password manager but I feel that this may not be ...
1
vote
0answers
74 views

Why do I receive so many password reset/welcome emails from services I'm not a customer of? [closed]

Over the years I've received the occasional password reset from a service I've never used (or even heard of sometimes). As far as I can tell, the emails are genuinely being generated and sent by the ...
1
vote
1answer
96 views

Generation of OTP in a 2FA email method

I am aware of the fact that authentication via email is discouraged, but in some specific applications and given as secondary method, we all agree that it may be useful. Having said that, what is the ...
0
votes
1answer
72 views

Does syncing local data to the cloud count as MFA?

Bitwarden uses TOTP as the multi-factor authenticator method for their password manager. Bitwarden stores and syncs your data so you need the master password + TOTP to get access to your account ...
0
votes
1answer
125 views

Is it safe to use 2FA within a password manager relative to using a separate app for 2FA? [duplicate]

Nowadays, many Password managers offer options for 2-Factor Authentication such as TOTP. I am really confused regarding this. Isn't the whole point of 2FA is to prove you have a second way of proving ...
1
vote
3answers
302 views

Are security questions considered as 2FA?

Many sites have a step during registration when you have to create security questions and answers for them. Is this type of security layer considered as 2FA? From what I know, 2FA is used for the ...
8
votes
3answers
436 views

Why would password managers provide support for OTP codes? [duplicate]

Can anyone explain me what's this trend of providing passwords and OTP codes on the same service? What benefit or value are they trying to bring to the table? We, as security professionals, have been ...
2
votes
2answers
192 views

How is mailbox.org 2FA method referred to as, correctly?

Their 2FA to log in to their web interface requires two things: something you know (PIN); something you have (OTP, generated by app for example). After that, you need to log in by: input email ...
1
vote
1answer
87 views

2FA on Stack Exchange, Where Is It Or What I am Missing?

Not sure if this is the right spot to post this, but I have not been able to find how to enable 2FA (such as authy, MS/google authenticator, yubikey etc...) on stack exchange using email ...
0
votes
0answers
54 views

Protect breached email accounts

We are a big supermarket chain and have had complaints about fraudulent activities from a few customers who have used a particular email domain. We are in the process of implementing MFA on our site. ...
4
votes
0answers
110 views

Is asking the e-banking username/password from a 3rd party site compliant with 3dsecure and PSD2?

Recently I tried to make an online purchase in one of the biggest e-commerce sites in Greece. During checkout, and after providing debit card details, it asked me to provide the username/password (not ...
0
votes
1answer
86 views

2FA with blower.io SMS

I'm currently planning to deploy a project on Heroku and was wondering if it is safe to send 2FA sms messages with the blower.io heroku addon? Also is it safe/ok to send a short lived authentication ...
1
vote
3answers
162 views

OTP vs two-factor

A vendor implements two-factor authentication that requires us to enter a TOTP code generated, for example by FreeOTP, after user/password. I asked them how it is possible that using two different ...
0
votes
0answers
36 views

OpenVPN certificates vs. SSO with MFA

I am wondering, is using certificates with OpenVPN gives any advantages vs. using SSO with MFA to authenticate to OpenVPN? Are there any disadvantages for combining both?
2
votes
1answer
313 views

Storing 2FA seeds in a password manager [duplicate]

Does it make sense to store the 2FA seeds (i.e: the codes used to generate a time based OTP) in my password manager? If my password manager has a strong password and 2FA using a third-party app, is ...
1
vote
4answers
316 views

Is 2FA a false sense of extra security on a mobile phone?

I understand that 2FA increases security if you are using two different devices, for instance a computer and a mobile phone. I fail to understand how these security measurements help if you are doing ...
0
votes
1answer
64 views

Push button in Security key used for 2FA/MFA

I have come across many security keys from different manufacturers such as solokeys, yubico etc.., for the purposes of 2FA/MFA. Products vary basically w.r.t features such as USB-A, USB-C, Apple ...
1
vote
0answers
34 views

2FA/MFA in a resource-constraint product

I'm working on a resource-constraint product and asked to enable support for MFA/2FA for all maintenance services. Given that MFA/2FA is about using two elements out of three(something you have, know, ...
1
vote
1answer
75 views

Which factor of authentication is an X.509 certificate

Given 3 factors of authentication: Type 1: something you know Type 2: something you have Type 3: something you are Which factor of authentication would be an X.509 certificate, assuming this ...

1
2 3 4 5
13