Questions tagged [multi-factor]
a multi factor authentication requires at least two sets of credentials. This is typically something you know (e. g. a password) and something you own (e. g. a token generator or mobile phone), but could also be something you are (a biometric).
684
questions
1
vote
2
answers
76
views
How am I meant to back up my second factors?
I currently use MFA wherever possible. To do so, I mainly use the Google Authenticator app, as well as a YubiKey. However, I recently realized that backing these up is very, very difficult.
YubiKey
...
- 111
0
votes
2
answers
88
views
How MS Authenticator works
When using MS Authenticator on a Microsoft account, the user fills in the email address or username. After that, the user presses one of the three numbers in the MS authenticator app and is logged in. ...
- 31
0
votes
1
answer
93
views
Implementing secure two factor authentication with Google Authenticator?
I would like to add two factor authentication to a login screen. My understanding of the process is the following:
Generate a QR Code
Scan this Code with Google Authenticator app
Use a library to ...
- 121
1
vote
1
answer
72
views
Should I display the 2FA secret only once or it can be always available?
A logged-in user enables 2FA for his account and a QR code with the secret is displayed.
Is it correct to display the same QR code again when the user visits the 2FA settings page after some time? Or ...
- 123
0
votes
1
answer
41
views
Does this implementation of 2FA expose valid credentials?
I have come across scenarios where a website would send OTP once a user has supplied valid username/password. A confirmation dialog e.g. An OTP has been sent to your registered mobile number would be ...
- 185
4
votes
2
answers
184
views
LastPass - Can MFA stop hackers from cracking a local vault?
After the recent LastPass security incidents (where old backup copies of users' encrypted vaults have leaked), I was wondering if an account had MFA configured at the time, it makes a difference for ...
- 141
0
votes
2
answers
140
views
How does a single mobile banking app implement a two factor authentication? [duplicate]
Recently I had more or less the same discussion with the helpdesk of several banks; a bank has a new mobile app that allows logging in without sending an SMS and without asking a confirmation code by ...
1
vote
1
answer
93
views
Why is physical security key helpful, since most accounts have alternative 2FA methods a hacker could use?
I would like to know why a physical security key is useful to have as default 2FA method given most accounts have some form of account recovery/alternative 2FA method. Google has had a bunch of ...
- 113
1
vote
1
answer
82
views
How should 2FA/MFA be implemented so it isn't easily bypassed?
At least twice now I heard most sites implement 2FA/MFA poorly and after X amount of attempts it should lock you out. They didn't give clear enough information for me to know what they're talking ...
- 11
1
vote
1
answer
190
views
How to interpret a Google "Someone is trying to sign in to your account from another device" message?
I received this message on my Pixel 4a phone yesterday evening:
I pressed "No, it's not me" and then saw this message:
I was at home with cat and five year old son. I was cooking and son ...
- 1,609
9
votes
2
answers
3k
views
Security of 2FA codes in-transit
I work on a service that handles user authentication & authorization. I recently added 2FA support (email, sms, TOTP) and while it works great, I was wondering about the security of the one-time ...
- 193
0
votes
0
answers
34
views
Benefit of only having MFA challenge on the very first login
I'm trying to select a suitable password store for a team - one of my main requirements is that users be authenticated via a removable key file rather than simply a master password.
I have been using ...
- 101
3
votes
2
answers
172
views
Is there any Security Benefits (auditing) to keeping old emails/text that give 2FA account codes?
Is there any Security Benefits/Risk in keeping old "Here is your 2FA login code" in email and text?
I always wonder if seeing one that is unread could queue me in to something bad happening ...
- 133
1
vote
0
answers
75
views
Going about sharing 2FA key between multiple login methods on a Synology NAS + browser & SSH authentication
I've recently acquired a Synology server (DS720+) and have it accessible outside my LAN via a VPN. I have 2FA on for logins to the server via the web portal, but I have found many use cases for ...
- 11
1
vote
1
answer
46
views
Does using TouchID and WebAuthn with a password manager defeat the 2FA?
For quite some time WebKit and others support WebAuthn. This allows for a pretty seamless 2FA experience with a key, like Yubico. On Apple devices TouchID/FaceID can also be used as a hardware key.
...
- 141
0
votes
1
answer
84
views
Why can't SMS be read online?
I am looking for a technical explanation from a security standpoint why SMS is, seemingly by principle, made impossible to read online whereas it looks it should be easily implemented. I have recently ...
- 165
3
votes
2
answers
180
views
Is asking users to enrol in SMS 2FA when they already have an authenticator good security practise?
I already have an authenticator for Amazon AWS, and I'm being regularly asked to add an SMS 2FA as well.
If I add SMS MFA, will I become vulnerable to sim-swapping attacks on that MFA?
Same thing with ...
- 1,132
1
vote
0
answers
142
views
Does having authenticator app/OTP generator built into Password Manager defeat its purpose?
For example the KeepassOTP plugin is one of a few plugins for Keepass, that allows users to view their OTP code from within the password manager itself. Does this defeat the purpose of having a OTP as ...
- 283
0
votes
1
answer
181
views
Rogue login to Google account after Windows clean install
Yesterday I downloaded a sketchy .exe on my Windows desktop and executed it. A command prompt window appeared then nothing abnormal happened. I tried running MalwareBytes but it didn't display any ...
- 11
2
votes
2
answers
160
views
What is the name for printed 2FA codes on a wallet card?
What is the correct name for the 2FA device that is printed codes on a wallet card?
These codes are sequentially numbered from 001 to 224. The log in screen displays 2 numbers in that range and the ...
- 943
1
vote
1
answer
220
views
Does Push 2FA protect against phishing/MitM better than TOTP?
I was having the debate of TOPT vs Push Notifications and found this claim online:
Is the 2FA method protected against phishing?
Chart Explanation: The most common method of phishing is persuading a
...
- 258
0
votes
1
answer
29
views
What is the two_factor_authentication.recovery_codes_regenerated security event in the GutHub account
I made some changes to my GitHub account security, notably I added two new hardware security keys and removed SMS as a 2FA backup method.
8 days later today, I randomly checked the GitHub's own ...
- 224
2
votes
1
answer
203
views
Does sending TOTP code along with username and password defeat the purpose of 2FA?
Related: Implementation flow of MFA with TOTP
I'm trying to implement 2FA with TOTP in my web application.
The implementation I've looked at (the ASP.NET Core implementation of 2FA) does something ...
- 23
0
votes
2
answers
63
views
Is this a valid use case for email 2FA?
We have a private website for our clients which needs a username and password for login to see protected information. The users are created by ourselves by petition of our clients for some of their ...
0
votes
1
answer
42
views
Can static IP address be used as a component of MFA? [duplicate]
Can I use static IP address as a component of 2 factor authentication for SFTP login?
0
votes
0
answers
54
views
Can OTPs substitute password? [duplicate]
One-time passwords (OTPs) usually serve as the 2nd factor in a 2FA scheme. But, in isolation, I believe they are more secure than passwords, since they are ephemeral and passwords are still badly ...
- 111
0
votes
0
answers
13
views
Authenticator Apps vs. Yubikey [duplicate]
Which is more secure?
Authenticator apps don't seem easily hacked so long as you are on non-old software on a phone.
Yubikeys seem pretty secure, but do add some friction (extra thing to carry around)
- 182
0
votes
1
answer
392
views
Abnormal Receiving of Google Verification Codes
Recently I have been receiving "Google Verification Codes" that I never requested and for password recovery of the google accounts that are not mine however are similar to mine. It might be ...
- 1
3
votes
1
answer
180
views
Why is email 2FA not common?
SMS is a quite common, albeit insecure, 2FA method. Why is email not more common? If someone is using a computer, they almost certainly have an email address, while it is less certain that they have a ...
- 139
0
votes
1
answer
87
views
Is receiving the same 2FA sms code twice a security risk?
I have noticed that a certain website, which uses sms as two factor authentication service, occasionally sends me the same 2fa code twice if the first attempt to login fails and I try again quickly.
I ...
- 123
0
votes
0
answers
61
views
Why not prompt for password and TOTP simultaneously? [duplicate]
In most common web applications that support multi-factor authentication the user is first prompted for their username and password, and only after a successful first authentication the user is ...
- 101
0
votes
1
answer
98
views
TOTP code with unicode character?
I was signing up for an app for a credit card I have and I encountered an SMS 2FA format I had never seen before. The code was 47𝞍⅗ - that is two digits then capital Phi then the fraction three-...
- 101
0
votes
1
answer
526
views
Does Google Authenticator share device information to website?
I wonder about Google Authenticator privacy. I wonder if the app shares any information to the website owner about devices that we use to add a new key. I mean information like IP address and device ...
- 1
1
vote
0
answers
69
views
Do you know of a reasonable study on MFA value as a function of the nature of the first factor?
Multi Factor Authentication is obviously a lifesaver for passwords, so things that can easily leak (peeking, guessing, stealing, ...). A second/third/... factor of another kind considerably reduces ...
- 8,968
0
votes
0
answers
13
views
Is a TOTP with RFC 6238 and a password in a manager 2FA? [duplicate]
For example Microsoft Outlook web based email service can be configured to require both a username/password combination and a time-based one-time password (TOTP) generated by the algorithm described ...
- 121
3
votes
1
answer
112
views
How does 2FA help with fake websites?
According to https://techcrunch.com/2018/12/25/cybersecurity-101-guide-two-factor:
Only the legitimate site will send you a working two-factor code.
That might be true, but how would this help if ...
- 179
0
votes
2
answers
148
views
Storing backup keys (2FA) for online accounts
So I spent the day looking for a good solution of storing the backup keys or the 2FA codes and can't seem to find a convenient way for me, many people have different takes on this, so far I found 2 ...
- 1
1
vote
1
answer
500
views
Is it possible to crack a 2FA/MFA secret key provided you know enough of the previous generated codes?
I have two accounts that won't show me the 2FA/MFA "Secret Key" used to generate the multifactor codes. Because of this, I am forced to use specific MFA apps rather than my preferred one. If ...
- 13
-1
votes
1
answer
56
views
Can using 2FA compromise me in any way if the website owner goes rogue?
Context
This question concerns a website that has no commercial or business background, it is a purely personal project. This website is ran by 2 strangers from the internet, who lend access to ...
- 101
0
votes
2
answers
163
views
Is this really two-factor-authentication?
In the country I live in, most authentication for online banking or authorities (such as tax) is based on an app. It has two operation modes:
Enter personal number on website (the personal number is ...
- 163
0
votes
1
answer
74
views
Does splitting auth SSO and MFA parts, between client and service companies have any issues?
My company provides a single SaaS product for corporate clients.
For one client we are implementing SSO with them as authentication provider (via Azure AD/SAML for now, but the library we are using is ...
- 51
0
votes
1
answer
94
views
How to improve 2FA security when a hacker has access to the user's email
We have a web app which is used by many companies.
Each user of the web app could work for more than one of these companies.
We want each company to have the ability to enable 2FA for all the users in ...
- 179
0
votes
1
answer
162
views
Doesn't 2FA increase the vulnerability of an account?
You create an account on an online service X with login=your email + password. Compare these 2 situations:
No 2FA enabled. The only risk is if your email is compromised: the "I lost my password&...
- 3
3
votes
2
answers
776
views
Is a "trusted device" a factor on its own?
Inspired by a discussion elsewhere, I've been wondering if the concept of a "trusted device" is considered a factor - on it's own - in multi-factor authentication?
Given context is that a ...
- 163
0
votes
1
answer
72
views
Will Lastpass ignore old 2FA tokens from the Yubikey? (tokens leaked accidentally)
Somestimes I press on my yubikey accidentally and it writes the token on the screen and even sends automatically to the person I'm talking to on some chat, because it presses enter. This happened ...
- 415
0
votes
1
answer
74
views
SOTP - Signed One Time Password
I was thinking of a OTP algorithm that signs a randomly generated password.
There are two things at play here:
The MFA portal
Knows the public key of the user's MFA app
The user's MFA app
Has a ...
1
vote
3
answers
70
views
Creating Password from 2 different part
I’m looking for Term Or Some platform for managing Password Authentication with this way :
Password construct from 2 Part ,
First one is static and you can make it and second Part Generate From TOTP ...
- 11
0
votes
2
answers
221
views
Implementing geo-location factor for authentication
I recently had an idea about this:
Why is the geo-location not used as authentication to ensure ownership of an account/login in addition to a password? This would work over GPS which is quite precise ...
- 41
0
votes
1
answer
29
views
Does 2FA security protect data stored on the back end?
I want to know how my data is protected if I enable 2FA on my account on the back end side.
I am using a MDM service to manage our company phones. My company works with sensitive data of clients. I ...
0
votes
1
answer
112
views
Multifactor auth in OAuth2 Password flow
This resource (and others) mention that OAuth2 Password flow doesn't provide mechanism for multi-factor authentication.
Does that mean other flows do?
How does MFA fit in the OAuth2 framework?
What ...
