Questions tagged [multi-factor]

a multi factor authentication requires at least two sets of credentials. This is typically something you know (e. g. a password) and something you own (e. g. a token generator or mobile phone), but could also be something you are (a biometric).

Filter by
Sorted by
Tagged with
5
votes
2answers
26 views

Should the average user with no special access rights be worried about SMS-based 2FA being theoretically interceptable?

Security experts are constantly discouraging users from using SMS-based 2FA systems, usually because of worries the auth code could be intercepted by an attacker, either through a SIM swap or a MitM ...
3
votes
2answers
175 views

2-step authorization (using SMS) less secure than being without 2FA at all?

I've been thinking about a paradoxical but a theoretically possible event: Even though SMS-based 2-step authorization increases security generally, on the other hand, in some cases, it might become ...
1
vote
1answer
42 views

2FA/MFA and Session management

Background Recently observed researchers reporting bugs related to a situation where a website would not invalidate secondary (separate) active session once 2FA/MFA has been enabled in primary ...
1
vote
3answers
137 views

Are repeated multi-factor authentication codes a problem

The library I am using (ASP.NET Identity) to generate multi-factor authentication (MFA) codes will produce the same code for a given user within a certain period of time. Therefore if the user ...
-1
votes
0answers
15 views

How can I create a 2FA usb for using sudo? [migrated]

I want to create a secure system in which logging in to the system and using sudo requires using both password and a usb. Is there some way I can turn a regular usb into 2FA key? Can you explain the ...
0
votes
0answers
41 views

Should I offer 'Any n or' or 'n Random' MFA in my webapp, or just 'All MFA'?

I am building a new webapp and I am currently working on the multi factor authentication part. I would like to offer choice when it comes to MFA, and I've been thinking about what choices I can offer. ...
4
votes
1answer
54 views

Generating and securely storing MFA/2FA recovery tokens

I'm trying to implement 2FA on my site, and cannot figure out how to generate and then securely store recovery tokens. From what I've seen, if for whatever reason you cannot MFA (lost your device ...
2
votes
1answer
63 views

Does trusting a device negate the security benefits provided by 2FA?

I have read 2FA adds a beneficial layer of security when logging into accounts. However, many organizations often ask me if I would like to trust the device that I am using permanently so I don't have ...
0
votes
0answers
29 views

Active Directory with multi factor authentication for an existing web application

Customer is asking for LDAP / Active Directory authentication along with OTP (one time password) / multi-factor authentication for an old existing web application written in (asp.net MVC2). Is this ...
0
votes
2answers
61 views

How to authorize user between each step in Multi-Factor-Authentication?

Assume an authentication process that has multiple stages ( eg: username/password then OTP) How you can authorize and identify user between each steps? If JWT tokens are used, is it an option to use ...
1
vote
2answers
174 views

Is it safe to save a screenshot of my QR code?

For MFA I now use Authy (owned by Twilio) instead of Google Authenticator. I find Authy more convenient because it syncs your accounts between several devices and several authy installations which ...
3
votes
0answers
50 views

Is it a good idea to store TOTP tokens in a (synchronised) password safe? [duplicate]

Bitwarden (as an example) allows you to store your TOTP tokens in it. That is: you can use the mobile app to scan the QR code that (e.g.) Amazon AWS gives you, and then it'll generate TOTP codes. So ...
2
votes
4answers
98 views

How to secure VPN credentials on end-user devices?

I have a VPN and PKI in place with MFA. My question is: What's the best method/solution for protecting the integrity and identity of end-user certs? I want to make sure that users only able to use VPN ...
35
votes
6answers
5k views

Should 2FA be enabled on service accounts?

See the title. I'm involved in a security audit right now, and am wondering whether 2FA should be enabled on not just human login accounts but also on service accounts (non-human accounts)? If so, how ...
7
votes
1answer
137 views

TOTP brute force prevention

Lets use Google Authenticator as example. A 6 digit code is generated every 30 second. Each random attempt has 1/1,000,000 chance of success. Server will usually accept code of ±30s which increased ...
1
vote
0answers
16 views

Security of Passwords vs Biometrics [duplicate]

Would a password with multi factor authentication be more secure than biometrics? I am asking due to the fact that if biometric data gets compromised, there is no way to change it, and in data ...
0
votes
1answer
158 views

How I Could Have Hacked Any Instagram Account - The Zero Hack

I am new to the field of security. I thought a lot about the following scenario and could not come up with a good solution 1) Suppose I go to instagram forgot password page. I enter a persons mobile ...
2
votes
2answers
53 views

Separate Auth DB for Increased Security

I'm a dev working on an app that has a monolith DB (PostgreSQL). We are using a third party provider for AUTH and MFA, but want to move MFA back into our control. The plan was to move the encrypted ...
0
votes
1answer
71 views

With 2-factor authentication, is a backup email address or phone a good recovery option?

A lot of sites offer 5 or 10 recovery codes as the backup mechanism if the user loses access to their primary 2FA (usually a phone number). Can we just simply use a backup email address instead, or a ...
0
votes
1answer
61 views

For two-factor authentication is it a security issue to have phone authentication and Google Titan Security Key?

I am trying to setup my Google account to have some proper security. But I'm finding parts of it confusing. I used to just use my phone as my 2FA device. Where I would get a texted code. Then I ...
0
votes
1answer
92 views

Can 2FA keys be duplicated?

I want to order a 2FA key (like yubikey) online and I want to know if someone could make a duplicate of whatever key I order during shipping. I don't want to discuss if someone could access my package....
1
vote
1answer
94 views

Diagram of personal information security vulnerability?

Is there a standard diagram format or language for illustrating a security model and what information is needed to access specific accounts? Something like UML for passwords and 2FA? I was recently ...
0
votes
0answers
42 views

Gmail's MFA for team?

We have mailboxes on G-Suite from Goole. Currently, we are enabling MFA for all boxes in our team, but what boxes which are used by different people? For now, I found a few solutions, each with its ...
0
votes
0answers
44 views

Sufficient to only require 2FA for su elevation?

I have a small web-facing server on my home network. It is headless, and the only way to log in is to ssh with pubkey authentication from within the local network. I wanted to turn on a 2FA ...
1
vote
1answer
78 views

What point in Authenticator App 2FA when SMS fallback is enabled

I would like to move away from SMS 2FA (because of Should 2FA over SMS be considered insecure in the wake of recent SS7 attacks? for example). But some services that provide Authenticator apps ...
0
votes
0answers
33 views

Azure AD — How to only allow MFA configuration from a trusted network?

Hopefully someone as an idea... In Azure AD, how can we allow MFA setup by a user but only allow that configuration to occur on a trusted network? We have trusted networks defined but everything we ...
2
votes
3answers
110 views

How to provide two factor authentication code text messages, so that they are not shown on the lock screen?

It's a commonly discussed problem that when a service sends an authentication to the user's phone, the code is often displayed in the preview on the lock screen, which means it's visible to anyone who ...
2
votes
1answer
115 views

Best practice for multi-factor re-authentication

We just introduced multi-factor authentication (MFA) to access a remote business network. This has a re-authentication option: to prompt the user to re-enter the password and MFA code periodically. ...
2
votes
0answers
46 views

2FA options for single yubikey and many hosts

I'm considering using yubikey (5 NFC model) as second factor for couple of Linux hosts. I'm interested in sticking it somewhere in PAM stack, so things like sudo are protected. Most of those hosts are ...
0
votes
1answer
56 views

Securing shared key in TOTP Implementations

I'm currently learning about Time-based One-Time Password implementations (see RFC6283). I see that a shared secret is part of the algorithm. This shared secret is exposed to the user (see example ...
3
votes
0answers
190 views

Can SS7 attacks intercept SMS sent to a Google Voice number?

Hackers are able to steal 2FA SMS messages by exploiting SS7. As far as my understanding goes, this means gaining access to the SS7 system and then broadcasting a message akin to "This number is ...
0
votes
0answers
53 views

User access control and management in AWS Environment

wondering what other SMBs are doing to manage dynamic access requirements for AWS platform. Currently we have 3 IAM roles (admin, dev, readonly) which users can choose after authenticating with https:...
31
votes
6answers
14k views

Why can't I share a one use code with anyone else?

I noticed in some cases when I get a verification code from Google it may say something along the line of: "You should not share this code with anyone else and no one from Google will ever ask for ...
2
votes
1answer
71 views

Are there security advantages to adding an OTP to SSH connections?

Are there any tangible improvements to gain from enabling TOTP (google-authenticator PAM plugin) over existing public key based SSH connections? Does it make security sense to enable TOTP based Two-...
62
votes
2answers
9k views

How are one-time password generators like Google Authenticator different from having two passwords?

Google Authenticator uses the TOTP algorithm to generate your One-Time Password (OTP). TOTP works like this : The server generates a secret key and shares with the client (you) when the client ...
0
votes
1answer
59 views

Preventing account enumeration with 2FA

What are some methods for preventing account enumeration on login when accounts have optional two factor authentication? Without two factor authentication we would just return the same response for ...
1
vote
3answers
262 views

What security benefit does 2FA provide a password manager?

It's no secret that many popular password managers (1Password, Dashlane, LastPass, KeePass, and many others) support some form of two-factor authentication. This is often implemented via TOTP or other ...
0
votes
1answer
56 views

Need help on 2FA QRcode security

In reference to OTP 2FA Auth apps: I'm trying to understand the concept of the QRcode being more secure in-transit than SMS? Is it because the QRcode itself is not of any value to fraudulent ...
1
vote
1answer
60 views

Multi Factor and order of authentication [duplicate]

I'm questionning the design and architecture around 2FA/MFA controls while authenticating to services and servers. On major platforms(*), the end-user is: first prompted for credentials (username/...
1
vote
1answer
63 views

MFA for multiple accounts?

We are thinking about enabling 2FA with Google Authenficator for all our services. But the only concern for me now is that users will have to have a dedicated Authenticator's account for every ...
0
votes
1answer
182 views

Two Factor Authentication Multiple Devices

Most websites (that I have seen) that implement two factor authentication don't support multiple two factor authentication devices linked to one account. The biggest reasons I can think of for that ...
1
vote
1answer
145 views

Does FIDO2 token works as two-factor on password-less authentication?

As authentication factors, I know the following You are (e.g. Biometrics) You have (e.g. USB) You know (e.g. Password) If I use a FIDO2 certified fingerprint reader for password-less authentication ...
0
votes
1answer
93 views

Two Factor Authentication Secret Storage

I found this NPM package that looks like can be used to verify two factor authentication for websites, and also generating tokens for signing into other websites. In the README there is a section ...
0
votes
0answers
18 views

Is password + laptop a multiple factor authentication? [duplicate]

The definition according to Wikipedia: Multi-factor authentication (MFA) is an authentication method in which a computer user is granted access only after successfully presenting two or more ...
1
vote
1answer
95 views

What attack vector is prevented by using the 'coupling code'?

In The Netherlands, one can access government services using a login platform called DigID. Some services require a two factor authentication, for which one can use a mobile app. This requires the ...
0
votes
1answer
51 views

Impact on required password entropy when introducing two-factor authentication [duplicate]

Is there a best practice or rule of thumb for the impact of introducting two-factor authentication on the required entropy of a used password? Say we consider 80 bits of entropy to be sufficient for ...
46
votes
8answers
10k views

Force user to remove USB token

I'm looking at setting up secure laptops using BitLocker with pre-boot PIN and startup key. I'm wondering if there is a way to force the user, who is remote, to remove the USB with the startup key ...
-1
votes
1answer
56 views

Security issues with 2-Step Verification Using SMS - Am I missing any vulnerabilities?

In order to increase security on sensitive data, I want to add 2-Step Authentication, using SMS. Note, this would be used on a website that should never have more than perhaps 30 users. I'm ...
0
votes
1answer
45 views

What are the risks when using QR to authenticate when using offline MFA in cases network is unavailable due to a network outage

if the PingID service is unreachable the user will receive a QR code on an offline authentication screen. in case of Offline MFA when the network is unavailable due to a network outage (i.e. in an ...
0
votes
2answers
59 views

Disable Office 365 2FA before period of leave without phone?

On enablement of 2FA in Office 365 Admin center, the only offered 2FA methods are Text message Call Notification in Authenticator app Passcode in Authenticator app Obviously, all of them require me ...