Stack Exchange Network

Stack Exchange network consists of 174 Q&A communities including Stack Overflow, the largest, most trusted online community for developers to learn, share their knowledge, and build their careers.

Visit Stack Exchange

Questions tagged [multi-factor]

a multi factor authentication requires at least two sets of credentials. This is typically something you know (e. g. a password) and something you own (e. g. a token generator or mobile phone), but could also be something you are (a biometric).

1
vote
0answers
15 views

How to enforce E-mail Account Security with regards to Custom Domains & 2FA?

Lately I've been bothered by the fact that should one of my e-mail accounts be in some way compromised despite its long and randomized password phrase. I'd have hell to pay since it is effectively a ...
1
vote
1answer
46 views

Is using WebAuthn alone considered as two factor authentication?

Will using WebAuthn for an application make it two factor? I am specifically interested in using Ondevice biometrics and achieve passwordless authentication. For a true two factor authentication you ...
0
votes
0answers
30 views

THC Hydra: Login form within login form

I'm testing a website and one must first login, then there is an access code form after logging in, and inaccessible otherwise. If I am attempting to brute-force this access code form, how do I tell ...
1
vote
3answers
174 views

Why 2FA is not considered flawless when used to secure an account?

Often I see it being discussed that if configured and enabled, 2FA will increase the security of an account, it will add an additional security layer, however an attacker could still gain access to ...
0
votes
0answers
2 views

Skip password for Azure MFA with SSH [migrated]

When configuring SSHD on a Linux server to use Azure MFA via RADIUS, is it possible to configure the MFA server to not ask for a first factor? My use case is that I want public key authentication ...
8
votes
3answers
206 views

Is a second, “old” (dumb) phone dedicated just to receiving bank tokens as safe as “modern” (smart) phone?

Are old phones safer / safe / as safe as modern smartphones when it comes to auth-tokens / confirmations tokens? Is SMS encrypted?
3
votes
1answer
58 views

Is Duo MFA vulnerable to a SIM swap exploit?

I'm looking into MFA options for a group of around 1000 people. Duo is intriguing, but I'm not sure I'm comfortable implementing something that incorporates text messaging (in contrast to something ...
0
votes
0answers
15 views

Generate new session on auth: before or after 2FA?

I'm following the owasp cheat sheet to handle sessions in my web app: https://www.owasp.org/index.php/Session_Management_Cheat_Sheet It is recommended to always generate a new session on any ...
1
vote
2answers
93 views

What is the point of 2FA if the recovery code (which is only one factor) can be used to access the account anyway?

I think the title says it all, but to elaborate: If, say, someone were to find my recovery code, could they not then gain access to my account? Similarly, could then someone not just hack my recovery ...
4
votes
1answer
63 views

Generating QR code from seed in browser - possible security issue?

I need to implement 2FA in my web app. I'm doing this the standard way: the newly created user's seed is retrieved from the server(I use speakeasy) and the QR code is generated. The thing is, it's ...
1
vote
0answers
55 views

Two factor authentication and plausible deniability for disk encryption

Can you prove, for the most common disk encryption programs like Veracrypt or LUKS/dmcrypt, that a second factor like a yubikey or a keyfile on a USB disk is required? If this is not the case is there ...
1
vote
4answers
152 views

How can I maintain my two factor authentication when my phone is in for repairs?

I recently got a new phone that has various hardware issues with it. As such, before the warranty expires, I need to send it back for repairs. Unfortunately, I already have Google Authenticator ...
2
votes
1answer
56 views

Is it secure to make user able to disable 2FA with 2 security questions if they have lost backup codes?

I am developing an application and users are able to add 2FA to their account. however if a user has lost backup codes of 2FA and logged out of account on all of devices, is it safe making them able ...
0
votes
1answer
90 views

Does the device you are logging into count as one of the factors for MFA when you are using device biometrics? [duplicate]

Yes it does because I 'have' the physical device I 'am' the owner of the fingerprint But no it doesn't because 1=>2 : If you have my device the fingerprint is now something you can get. Which ...
0
votes
1answer
75 views

Gmail sign-in with 2 step verification secure enough for money-generating YouTube channel [closed]

My goal is to find out if the sign-in process of a personal Gmail account with 2-step verification turned on, is enough from a security point of view, to serve as the sign-in process for a YouTube ...
1
vote
1answer
91 views

Can a scanning id system like trusona really be secure?

I became aware of Trusona recently (see their demo on this page https://www.trusona.com/ ). They want to 'end passwords'. I believe in the idea that 'reasonable security' = {something you are + ...
-1
votes
2answers
121 views

Is it a good idea to have a new laptop just to generate 2FA keys?

I am very concerned about people putting keyloggers or trojans on my computer. That can happen because I use my computers for many things. Work. Playing games. Watching movies. Accessing many ...
0
votes
1answer
34 views

What are possible security issue if any of automatically inserting 2FA in 1password? [duplicate]

I've heard that 1password have a feature. We basically stored the QR codes for google 2FA in 1 password. 1 password then tell us the google 2FA keys everytime we logged in. https://support....
5
votes
6answers
296 views

Is it safe to store 2FA tokens together with passwords in 1password?

I'm using 1password and I've seen 1password allows you to store 2FA tokens in the same place where you store the password. I don't like the idea of having everything in the same place as if someone ...
0
votes
0answers
23 views

Setup own infrastructure for a ChipTAN generator

Smartcard readers can not just read bank cards, but also RSA smartcards. I wonder if it is possible to use a ChipTAN generator for other cards too. What is needed to set up a personal infrastructure ...
25
votes
6answers
5k views

Why do apps with phone verification send the user a message, rather than have the user send one to them?

Many apps allow the user to authenticate with their phone number, by having the user enter it, and then sending an SMS with a code to be entered into the app. Very few (if any that I can find still ...
8
votes
3answers
363 views

Should I delete SMS messages containing one-time passwords?

I have had one-time passwords sent to my phone via SMS. Those one-time passwords include those for 2FA and the occasional password reset. Should I delete those SMS messages after the one-time ...
3
votes
3answers
1k views

Aren't endpoint devices inherently MFA?

I was recently asked if MFA was leveraged for authentication on endpoint devices. My gut reaction is that given MFA is something you have, know, are, and you need to have the laptop to log into it and ...
1
vote
2answers
164 views

Why bother with certain types of 2fa if they can be easily bypassed?

In the wild, there is a method of bypassing 2fa. The gist of it is that the attacker doesn't just phish the password, but they also phish the 2nd factor and use those for a real login on their own ...
2
votes
4answers
94 views

What are some existing or ideas where the use of a password can be replaced to login to a service? [closed]

The password has been a method of authentication for a long time now and we always hear of breaches happening where users passwords get stolen and sometimes are not even hashed at all or correctly. ...
3
votes
1answer
99 views

What to do if a user loses access to his authenticator code?

I have a web service that I set up which allows users to protect their accounts via two factor authentication via an authenticator app like Google Authenticator and Authy. When enabling it, I mention ...
0
votes
2answers
110 views

Can a hacker compromise the system if he can steal one of the factors of the 2FA?

I read this article saying that smartcards used as a 2FA are still susceptible to attacks such as MITM attack: They think 2FA is unhackable...undefeatable, when that clearly isn’t true. They think ...
0
votes
0answers
464 views

OpenVPN use auth-user-pass with a file and authenticator

I have an open vpn configuration with the lines auth-user-pass my-login-creds.conf static-challenge "Enter Google Authenticator Code" 1 in it. When I try to connect with openvpn my-config.ovpn I ...
1
vote
2answers
441 views

Combining a fingerprint scan and password for 2-factor-authentication [closed]

UPDATE: I found the answer to the "How To?" part of my question on superuser: Require Fingerprint AND Password/Pin for Windows Logon Is it possible to require a TOTP on Windows Login using existing ...
1
vote
1answer
138 views

Authy reviewed? [closed]

Authy looks like a great solution - especially for laymen, in order to simplify complexities - but I have some nagging concerns re privacy & security, especially when sensitive data is hosted "on ...
2
votes
1answer
197 views

Are Authy's tokens insecure?

I've been trying out Authy, a Google Authenticator alternative with an optional feature of being able to back up your tokens. They have two types of tokens: Authy-generated tokens and the regular OTP ...
3
votes
1answer
225 views

SMS based 2FA intercepts

Reddit just revealed that they experienced a security breach as a result of an intercepted SMS based 2FA. Another post on SMS 2FA refers to flaw in the telecom’s ss7 protocol that was used to perform ...
2
votes
0answers
35 views

Protecting private keys of common chat applications with 2FA

Say a user uses a common chat application like Telegram, Signal, Whatsapp, Ricochet. His device gets hacked and private keys get stolen. For normal PGP usage with email you can use two factor ...
7
votes
1answer
161 views

Why use one-time codes for two-factor authentication backups?

I am building an web application that uses two-factor authentication. While implementing the recovery feature, I see that most companies (eg Apple, Facebook, Github) provide a set of ~15 backup codes,...
0
votes
1answer
47 views

Do account recovery options defeat stronger 2-factor authentication?

2-factor authentication (2FA) is encouraged in order to reduce the risk of an account being compromised since the attacker has to know more than just your password. There are many ways to deploy 2FA, ...
0
votes
0answers
43 views

Leaking information about 2FA status

I was asked to provide a public web interface which is given an email addresses (which belong to our users) for public clients (e.g. a web application or native mobile application) whether or not a ...
1
vote
0answers
128 views

Hardware-based password manager with per-password verification [closed]

I'm looking for a device to perform hardware password management very similarly to the Trezor, shown here, commonly used as a wallet for cryptocurrencies. Unfortunately, the Trezor only stores a ...
1
vote
3answers
260 views

How do websites protect against 2fa replay attacks?

I'm imagining a scenario where an attacker can read traffic between a user and a server. The attacker grabs the user's password and the 2fa code they used. The attacker then logs in with that ...
0
votes
2answers
136 views

How does google know if I am logging in from a new machine(using web browser)? [duplicate]

Every time i sign into my google account on a web browser on a new machine, it warns me of suspicious activity. How does google know its a new machine? I am trying to implement a similar thing for my ...
1
vote
3answers
123 views

Sharing 2FA tokens

A company I work for wants to share a login to a sensitive application. The application unfortunately does not support multiple users, so a username / password combo is shared between several people ...
1
vote
1answer
115 views

SMS OTP as 2FA - should there be sms session id in sms for user's verification?

Several times I saw SMS 2FA implementation when a web site shows "sms session id" (say, 8 digits token) right after sending sms to user together with OTP prompt. Sms comes with OTP (say, 4 digits) and ...
0
votes
2answers
109 views

Help to review 2FA algorithm

First of all, I know, don't reinvent the wheel... But there's a good reason for this. So I have been implementing a generic 2 factor authentication code generation/validation algorithm in order to re-...
3
votes
1answer
83 views

Duo Security forgot password workflow

I'm updating my company's forgot password workflow. Currently we use Duo Security as our second factor on login (but for the purposes of my question this can be any such service). I've been walking ...
22
votes
4answers
562 views

Bank asked for a cross login?

I was creating a new bank account here in the US at HSBC's popular online bank... You know the step where you have to verify the account you're sending from, by receiving two small test payments? I ...
2
votes
4answers
242 views

Does a two-factor authentication dongle (OTP) which is always inserted in MacBook add a security benefit?

I think to get a Yubikey and read that Keepass with OTP makes no sense No. Security remains the same + extra cognitive overhead. I try to store all data local and use seldom cloud based services. If ...
1
vote
0answers
38 views

Multi-factor asking condition

It is an established fact that the error message of login pages should not specify wether the password or the id is the problem. But for an application with multi factor authentication, should we ask ...
0
votes
1answer
40 views

How much entropy is required for a Grid Card?

We're in the process of implementing multifactor authentification. One good candidate for this was the "Grid Card" - a small table with random letters and digits. Upon login, the user would be queried ...
3
votes
0answers
95 views

U2F FIDO sends identifiable serial numbers

As all of the FIDO Alliance documents state, the FIDO U2F protocols should never be able to abused to identify whether a user has multiple accounts with one service, or for services to collude and ...
1
vote
1answer
397 views

Maximum tries for 2FA code?

I am building a website and I am implementing two factor authentication (2FA). The second factor will be a random 6 digit code like those from Authy. This site will store very confidential information....
3
votes
1answer
198 views

Why not authenticate with the user sending an SMS? [duplicate]

Every time I do 2-factor authentication on a mobile app, it sends me a message with a security code. I understand this is weak because the SMS system can be hacked to redirect your messages to another ...