Questions tagged [multi-factor]

a multi factor authentication requires at least two sets of credentials. This is typically something you know (e. g. a password) and something you own (e. g. a token generator or mobile phone), but could also be something you are (a biometric).

Filter by
Sorted by
Tagged with
0
votes
1answer
100 views

How I Could Have Hacked Any Instagram Account - The Zero Hack

I am new to the field of security. I thought a lot about the following scenario and could not come up with a good solution 1) Suppose I go to instagram forgot password page. I enter a persons mobile ...
2
votes
2answers
38 views

Separate Auth DB for Increased Security

I'm a dev working on an app that has a monolith DB (PostgreSQL). We are using a third party provider for AUTH and MFA, but want to move MFA back into our control. The plan was to move the encrypted ...
0
votes
1answer
61 views

With 2-factor authentication, is a backup email address or phone a good recovery option?

A lot of sites offer 5 or 10 recovery codes as the backup mechanism if the user loses access to their primary 2FA (usually a phone number). Can we just simply use a backup email address instead, or a ...
0
votes
1answer
51 views

For two-factor authentication is it a security issue to have phone authentication and Google Titan Security Key?

I am trying to setup my Google account to have some proper security. But I'm finding parts of it confusing. I used to just use my phone as my 2FA device. Where I would get a texted code. Then I ...
-2
votes
0answers
43 views

FreeOtp setup instruction [closed]

I would like to change from Google authenticator to FREEOTP. However i don't know how to setup FreeOTP in Protonmail. If someone knows how, I would be glad if he manage to help me.
0
votes
1answer
81 views

Can 2FA keys be duplicated?

I want to order a 2FA key (like yubikey) online and I want to know if someone could make a duplicate of whatever key I order during shipping. I don't want to discuss if someone could access my package....
1
vote
1answer
87 views

Diagram of personal information security vulnerability?

Is there a standard diagram format or language for illustrating a security model and what information is needed to access specific accounts? Something like UML for passwords and 2FA? I was recently ...
0
votes
0answers
37 views

Gmail's MFA for team?

We have mailboxes on G-Suite from Goole. Currently, we are enabling MFA for all boxes in our team, but what boxes which are used by different people? For now, I found a few solutions, each with its ...
0
votes
0answers
41 views

Sufficient to only require 2FA for su elevation?

I have a small web-facing server on my home network. It is headless, and the only way to log in is to ssh with pubkey authentication from within the local network. I wanted to turn on a 2FA ...
1
vote
1answer
67 views

What point in Authenticator App 2FA when SMS fallback is enabled

I would like to move away from SMS 2FA (because of Should 2FA over SMS be considered insecure in the wake of recent SS7 attacks? for example). But some services that provide Authenticator apps ...
0
votes
0answers
29 views

Azure AD — How to only allow MFA configuration from a trusted network?

Hopefully someone as an idea... In Azure AD, how can we allow MFA setup by a user but only allow that configuration to occur on a trusted network? We have trusted networks defined but everything we ...
2
votes
3answers
101 views

How to provide two factor authentication code text messages, so that they are not shown on the lock screen?

It's a commonly discussed problem that when a service sends an authentication to the user's phone, the code is often displayed in the preview on the lock screen, which means it's visible to anyone who ...
2
votes
1answer
104 views

Best practice for multi-factor re-authentication

We just introduced multi-factor authentication (MFA) to access a remote business network. This has a re-authentication option: to prompt the user to re-enter the password and MFA code periodically. ...
2
votes
0answers
44 views

2FA options for single yubikey and many hosts

I'm considering using yubikey (5 NFC model) as second factor for couple of Linux hosts. I'm interested in sticking it somewhere in PAM stack, so things like sudo are protected. Most of those hosts are ...
0
votes
1answer
54 views

Securing shared key in TOTP Implementations

I'm currently learning about Time-based One-Time Password implementations (see RFC6283). I see that a shared secret is part of the algorithm. This shared secret is exposed to the user (see example ...
3
votes
0answers
141 views

Can SS7 attacks intercept SMS sent to a Google Voice number?

Hackers are able to steal 2FA SMS messages by exploiting SS7. As far as my understanding goes, this means gaining access to the SS7 system and then broadcasting a message akin to "This number is ...
0
votes
0answers
51 views

User access control and management in AWS Environment

wondering what other SMBs are doing to manage dynamic access requirements for AWS platform. Currently we have 3 IAM roles (admin, dev, readonly) which users can choose after authenticating with https:...
31
votes
6answers
14k views

Why can't I share a one use code with anyone else?

I noticed in some cases when I get a verification code from Google it may say something along the line of: "You should not share this code with anyone else and no one from Google will ever ask for ...
2
votes
1answer
70 views

Are there security advantages to adding an OTP to SSH connections?

Are there any tangible improvements to gain from enabling TOTP (google-authenticator PAM plugin) over existing public key based SSH connections? Does it make security sense to enable TOTP based Two-...
62
votes
2answers
9k views

How are one-time password generators like Google Authenticator different from having two passwords?

Google Authenticator uses the TOTP algorithm to generate your One-Time Password (OTP). TOTP works like this : The server generates a secret key and shares with the client (you) when the client ...
0
votes
1answer
49 views

Preventing account enumeration with 2FA

What are some methods for preventing account enumeration on login when accounts have optional two factor authentication? Without two factor authentication we would just return the same response for ...
1
vote
3answers
228 views

What security benefit does 2FA provide a password manager?

It's no secret that many popular password managers (1Password, Dashlane, LastPass, KeePass, and many others) support some form of two-factor authentication. This is often implemented via TOTP or other ...
0
votes
1answer
52 views

Need help on 2FA QRcode security

In reference to OTP 2FA Auth apps: I'm trying to understand the concept of the QRcode being more secure in-transit than SMS? Is it because the QRcode itself is not of any value to fraudulent ...
1
vote
1answer
56 views

Multi Factor and order of authentication [duplicate]

I'm questionning the design and architecture around 2FA/MFA controls while authenticating to services and servers. On major platforms(*), the end-user is: first prompted for credentials (username/...
1
vote
1answer
61 views

MFA for multiple accounts?

We are thinking about enabling 2FA with Google Authenficator for all our services. But the only concern for me now is that users will have to have a dedicated Authenticator's account for every ...
0
votes
1answer
115 views

Two Factor Authentication Multiple Devices

Most websites (that I have seen) that implement two factor authentication don't support multiple two factor authentication devices linked to one account. The biggest reasons I can think of for that ...
0
votes
1answer
90 views

Does FIDO2 token works as two-factor on password-less authentication?

As authentication factors, I know the following You are (e.g. Biometrics) You have (e.g. USB) You know (e.g. Password) If I use a FIDO2 certified fingerprint reader for password-less authentication ...
0
votes
1answer
88 views

Two Factor Authentication Secret Storage

I found this NPM package that looks like can be used to verify two factor authentication for websites, and also generating tokens for signing into other websites. In the README there is a section ...
0
votes
0answers
18 views

Is password + laptop a multiple factor authentication? [duplicate]

The definition according to Wikipedia: Multi-factor authentication (MFA) is an authentication method in which a computer user is granted access only after successfully presenting two or more ...
1
vote
1answer
94 views

What attack vector is prevented by using the 'coupling code'?

In The Netherlands, one can access government services using a login platform called DigID. Some services require a two factor authentication, for which one can use a mobile app. This requires the ...
0
votes
1answer
44 views

Impact on required password entropy when introducing two-factor authentication [duplicate]

Is there a best practice or rule of thumb for the impact of introducting two-factor authentication on the required entropy of a used password? Say we consider 80 bits of entropy to be sufficient for ...
46
votes
8answers
10k views

Force user to remove USB token

I'm looking at setting up secure laptops using BitLocker with pre-boot PIN and startup key. I'm wondering if there is a way to force the user, who is remote, to remove the USB with the startup key ...
-1
votes
1answer
46 views

Security issues with 2-Step Verification Using SMS - Am I missing any vulnerabilities?

In order to increase security on sensitive data, I want to add 2-Step Authentication, using SMS. Note, this would be used on a website that should never have more than perhaps 30 users. I'm ...
0
votes
1answer
39 views

What are the risks when using QR to authenticate when using offline MFA in cases network is unavailable due to a network outage

if the PingID service is unreachable the user will receive a QR code on an offline authentication screen. in case of Offline MFA when the network is unavailable due to a network outage (i.e. in an ...
0
votes
2answers
56 views

Disable Office 365 2FA before period of leave without phone?

On enablement of 2FA in Office 365 Admin center, the only offered 2FA methods are Text message Call Notification in Authenticator app Passcode in Authenticator app Obviously, all of them require me ...
2
votes
2answers
155 views

Does 2-Factor Authentication protect against malware?

My question has to do with whether 2-Factor Authentication protects against a compromised system (malware). There are a couple of scenarios in which I wonder whether it does: Every time you login to ...
2
votes
1answer
178 views

Why does Microsoft Authenticator app ask me to choose a number?

I've got the Microsoft Authenticator app installed on my Google Pixel phone. When I sign into a Microsoft site, the site shows me a two-digit number (e.g. 34) and the app on my phone asks me to choose ...
0
votes
1answer
56 views

How does DUO push button method and other methods actually work?

Google authenticator uses HOTP and TOTP algorithm for TFA. What is the basic working principle of DUO push? What brings security to DUO push?
1
vote
2answers
137 views

When you enable 2FA, why is your second factor required to reset password?

In a conversation with a coworker the other day, I had trouble successfully defending why, when you enable 2FA on a service, you're required to enter a second factor before changing your password (in, ...
2
votes
2answers
136 views

Is stand-alone one-time password less secure than OTP + traditional password auth?

I have a client that would like to use one-time passwords (via SMS or Email) for their app, and their requirements spec does not include traditional password-based authentication. I haven't seen this ...
0
votes
0answers
246 views

Two-factor authentication on Galaxy Watch - should secrets be encrypted, and is this SQLite example secure?

I recently got a Galaxy Watch and to get acquainted with developing apps for it I'm writing a simple two factor authenticator to generate TOTP codes from entered secrets using the Google Authenticator ...
-2
votes
3answers
182 views

Why do services that use 2-factor authentication still ask you to provide a password?

The idea of 2 factor authentication is that if you can prove that you have both a password and a device, you are trusted to be who you say you are. My question is, why does the service still ask you ...
2
votes
1answer
89 views

Problems with this 2 factor authentication implementation

I'm implementing my own 2 factor authentication using SMS. We have a gift card service and the users are sent a link to their gift card. Every time they click on their link, we are verifying it's ...
5
votes
2answers
201 views

2 factor authentication, fob management

I love the idea of 2 factor authentication but how can I make sure I'm not caught in the wind without such keys? I thought about switching to a fob for services that support it. Is there a fob that I ...
1
vote
3answers
148 views

Can I get 2FA for my private domain e-mail account? [closed]

Is it possible to somehow get 2FA for my e-mail accounts even if they're hosted on custom / private domains? (e.g mymail@mycooldomain.com and not gmail)
2
votes
1answer
66 views

Does password strength matter when using a YubiKey? [duplicate]

I'm considering buying a YubiKey. I already use a password manager which can generate strong passwords, but I wonder if there's even a point with the YubiKey. I guess it just makes one extra step......
0
votes
1answer
38 views

Does the number of fingerprints we leave represent a security threat to the banking system?

A number of major banks are allowing users to log in to their bank accounts with only fingerprints. It was occurring to me, though: how many fingerprints does the average person leave per day? How ...
0
votes
2answers
57 views

Must the different multi-factor “factors” be correlated if possible?

We are in the process of securing our internal servers and there is a requirement of using two factor authentication (SSL client&server certificates and username-password). One doubt that has ...
0
votes
1answer
82 views

What should be done if 2FA was turned off in an unexpected manner?

Today when I logged in Facebook, no 2FA was shown. I have been using SMS message as the second authentication factor. When I looked at the security settings, 2FA seemed to be disabled. I immediately ...
4
votes
3answers
403 views

Is receiving an OTP via email any more secure than receiving it via SMS?

I understand that getting OTPs via email and SMS are the weakest forms of 2FA, but given a situation where these two are the only options for 2FA, is email any better than SMS? (Assuming the email - ...