Questions tagged [multi-factor]

a multi factor authentication requires at least two sets of credentials. This is typically something you know (e. g. a password) and something you own (e. g. a token generator or mobile phone), but could also be something you are (a biometric).

Filter by
Sorted by
Tagged with
2
votes
1answer
74 views

How does Amazon secure its 6 digit one-time password?

I noticed that Amazon's password reset relies on a 6 digit numeric PIN. Doesn't this reduce every user's account to a 1 in 10^5~ chance of being accessed through brute force guess factoring in a few ...
0
votes
0answers
56 views

Does mobile biometric authentication count as Knowledge, Possession, or Inherence authentication

Apple claims in this year's WWDC that Face ID and Touch ID count for both Possession and Inherence identity factors, because they are using Biometrics (Inherence) to access the secure element on your ...
25
votes
2answers
9k views

What's the point of Microsoft Account 2FA if it still lets me log in using password instead?

I have a Microsoft Account linked to a Microsoft Authenticator app for 2FA purposes. Every time I log in, it first sends me the Authenticator request, but I can always click "Other ways to sign ...
1
vote
1answer
81 views

How often should we force users to re-authenticate when not on the network?

Our company has rolled out MFA to our users. We are a Microsoft shop, so we are using Azure AD to handle MFA and authentication to things like email, Teams, Sharepoint, etc. By default, we've disabled ...
0
votes
3answers
96 views

What is the best practice for resetting multi-factor when a user requests to recover their password?

I am in the process of developing a web-application which requires MFA on every login. (On the first login, before you can do anything, you are forced to setup MFA. Due to monetary restrictions and ...
22
votes
2answers
6k views

What is the risk of having a 2FA key permanently plugged into my device?

Yubico offers the YubiKey Nano, a 2FA key designed to be left inside the device more or less permanently. While it does add comfort to be able to just leave it plugged in, what risks would there be ...
0
votes
0answers
42 views

Dedicated device for online investing and other security measures

I like to invest money online. I invest in both cryptocurrencies as well as regular stocks. As my bankroll grows (let's say 20k+ in the near future), I feel like I need to start taking more serious ...
1
vote
2answers
58 views

two-factor authentication suffix code in the password

In many sites where 2FA is enabled, the login flow is: A form asking for username/password If credentials are valid a new form asks for the verification code. However, there are some implementations ...
1
vote
1answer
113 views

If someone steals my unencrypted, password protected laptop, would they be able to get into my Google account?

I have a laptop with Ubuntu 20.04 operating system. I am logged into my Chrome browser using my Google account. This means, every time I open my browser, I am already logged into all the Google ...
0
votes
1answer
85 views

Why make it difficult to disable MFA tokens?

Some websites make it easy to enrol multiple TOTP apps at the same time but make it difficult to disable these apps. For instance, the user would have to completely reset the MFA settings instead of ...
1
vote
1answer
37 views

Should a service indicate the usage of multi-factor authentication by a user for building trust?

We all know that MFA done right can greatly increase the security of an online identity. There are services around with a fundamental trust problem among the users. For example online market places ...
0
votes
0answers
28 views

If someone stole my symantec VIP credential ID, would they be able to generate the same one-time passcode as the app does?

Let's say I've installed the Symantec VIP app on my device. If someone stole my Symantec VIP credential ID, would they be able to generate the same one-time passcode (OTP) as the app does?
2
votes
2answers
86 views

prevent/prohibit duplication of MFA software-token / ensure user identity

As I was unable to find any thread about this particular question, I'm trying to ask the community for help. We're currently using RSA RADIUS based 2FA to authenticate external VPN users from ...
1
vote
2answers
66 views

What are Security Considerations of Using File Upload/Comparison as Simplified Second Factor?

I am evaluating the idea of simplified second factor authentication by requiring a file to be uploaded, such as an image along with username/password. The file is stored on a user's device. My ...
2
votes
2answers
69 views

How to store MFA secret

I have an online application that I'm adding MFA to, using the Google / Microsoft Authenticator apps for mobile phones. I've tried to adopt a security focussed approach to storing the MFA secret and ...
8
votes
2answers
3k views

How does password reset work if 2FA is enabled?

(There is a highly related question, however I believe mine is not a duplicate, since it deals with resetting a password without access to the account, not changing it while being logged in.) Say ...
0
votes
0answers
41 views

Is using traditional 2FA codes a prerequisite for using U2F FIDO key in Dashlane/1Password?

Over the past few weeks, I have spent a lot of time thinking about how to structure my security plan based on a password manager, just two/three strong master passwords and the use of physical U2F ...
1
vote
0answers
30 views

MFA: can unique biometrics collecting device count as another authentication factor (a possession factor)?

I see in this answer (Aren't endpoint devices inherently MFA?) that an endpoint device doesn't qualify as an authentication factor (AF). But if the endpoint biometric collecting device is uniquely ...
0
votes
0answers
52 views

Blockchain 2FA by sms (wallet code) secure (hack)?

To keep a long story short, I got hacked on my PC by downloading and executing a wrong file. Programs as InterVPN, Cryptobot and HVNC (told by the hacker via google chat) were installed. My accounts (...
0
votes
1answer
61 views

Could IMAP authentication be adapted to support 2FA?

Theoretically? (If no, why? And if yes, why hasn't it been done?)
0
votes
0answers
38 views

Can bad software/web app architecture compromise my 2FA key?

So this is a two part question: 1) When I have a compartmentalized system, and then I use the same hardware 2FA key for 2FA across all compartments, can my hardware key be used to trace me through ...
0
votes
1answer
35 views

Risks associated with a compromised external Security token server

Consider the following architecture: An on premise Web API 2 [Written in C# hosted in IIS] which uses OAuth 2 authentication [ Implicit Flow ] to secure itself. This API acts as the data source by ...
1
vote
1answer
109 views

A proposal for effortless two-factor authentication

I have an idea for device-level two-factor authentication that involves no direct input from the user, and I wanted to find out if something like it has been tried before. Let's say I have an account ...
0
votes
0answers
30 views

Doesn't installing a TOTP client on your primary PC undermine the whole point of 2FA? [duplicate]

Authy is a popular cross-platform TOTP application that supports syncing keys across devices. I have been a little confused by the idea of having a desktop client... This way if someone accesses my ...
1
vote
1answer
87 views

2-factor authentication can be misused?

I was trying to access my account on an e-commerce website but I couldn't get my password right. So, the website offered me the option to authenticate using my security code from Google Authenticator ...
-2
votes
1answer
128 views

Attacks that ByPass Multifactor Authentication (Necrobrowser in Office 365) [closed]

I added MFA to Office 365, but a security specialist says it can be defeated with NecroBrowser, which can capture and transmit an already MFA-authenticated cookie. I can't find any specifics about ...
1
vote
2answers
124 views

Is there a way to “lock” a YubiKey after a period of inactivity?

I have a YubiKey 5c nano attached to my laptop used for 2FA, etc. It works great and is unobtrusive, but I feel like the small form factor encourages leaving it plugged into the laptop all the time, ...
1
vote
3answers
133 views

Is it safe and permissive to remember devices to skip two factor authentication when dealing with sensitive information?

We're a small UK startup building a small service that allows certain special people (e.g. journalists) to access non-public court information. This information includes a ton of private and ...
0
votes
1answer
116 views

Yahoo! Mail logging in with 2FA code only

I came across a serious issue with Yahoo! Mail that I hope someone would help to fix or raise awareness for. I wanted to create an account on Yahoo! Mail. I entered my phone number to the Yahoo! ...
5
votes
0answers
86 views

Is there a standard for OTPs tied to transaction details (that has been implemented in apps/devices)?

There are standards for Time-based (TOTP) and Counter-based (HOTP) One Time Password schemes. Generated OTPs are independent of the transactions they are used for, such as authorizing a login or a ...
0
votes
0answers
55 views

USB token for Java Desktop Application

I would like to integrate the use of a USB token in a JavaFX application that my customers use on a computer I send them. This JavaFX application interacts with a Java/Spring back end. (client-id/...
0
votes
0answers
45 views

SAML and Multi-factor auth

I have an application that is a SAML SP, authenticating users via inbound SAML assertions from some other IdP. If I want to require multi-factor auth, is it a common practice to add multi-factor auth ...
0
votes
0answers
31 views

Why does Apple's 2FA require both a prompt and a code?

When logging into iCloud via the web, a prompt is sent to your phone (with a map showing the origin of the web request). The user can then choose to allow or deny this request. After choosing to allow ...
0
votes
2answers
101 views

2FA: Do app passwords render the second factor invalid?

I am currently in the process of employing a 2FA authentication on as many services as I can. If it is relevant for the question: I use a time-based OTP authenticator app. When setting up, I noticed ...
0
votes
0answers
70 views

Why do GoDaddy customer support representatives ask for two-step verification codes?

When contacting GoDaddy customer service, whether over chat or phone, they often ask for both a PIN and a two-step verification code (which they confusingly refer to as "google auth codes"). Then PIN ...
8
votes
1answer
236 views

Functional Google 2FA code (via SMS) received from a random (but in use) mobile phone number

tl;dr for those who are misunderstanding my post: imagine your friend who uses GMail suddenly tells you they have 2FA enabled, and logged in to their account, and that the 2FA code (SMS) they received ...
6
votes
2answers
2k views

Is phishing ineffective against a Gmail account that has 2FA? [closed]

According to my knowledge, phishing basically only steals the email id and password, right?
3
votes
2answers
1k views

One way authentication vs two-way authentication

I'm studying for the Network+ exam and wanted to understand the difference between one-way authentication and two-way authentication. I've tried searching to no avail. It seems when I search for it ...
1
vote
2answers
208 views

Two factor authentication turned on for my Google account (Phone) - but still hacked

I just got a message today that someone changed my password on my Google account. The email seems legit, and Google confirmed there was a login from Ukraine two weeks ago in recent activity. The ...
0
votes
1answer
43 views

Can I use a mobile passcode login exclusively?

I get absolutely no cell coverage in the building I'm working in, nor do I have access to wifi, so any time I need to use 2-factor authentication, I cannot receive the push request. I've been using ...
0
votes
1answer
61 views

Is there a security problem with having two factor auth running on the same machine that's requesting access?

Searched around and couldn't find a similar question. I've gotten tired of waiting for an 2FA SMS to come every time I check my email. So I got to setting up an app similar to say Google ...
3
votes
1answer
52 views

Push notification - can I use any mobile auth application?

When generating a OTP, I know I can use either Authy or Google Auth, either can scan the code & generate the same OTP. What about push notification? Are Duo/Okta verify and other apps ...
1
vote
1answer
401 views

Is there a reason to change OTP code on every resend attempt?

This question is about OTP codes that are used in flows like Email verification SMS 2fa Usually, when you send an OTP, you want to give the user an option to resend the OTP. Assuming the following ...
0
votes
1answer
148 views

Is there a way to generate a Yubikey OTP without touch?

I'm trying to automate an authentication canary in a workflow that includes a mandatory Yubikey OTP (the 44-character unique password). Is there a way to configure a single Yubikey in such a way that ...
0
votes
1answer
57 views

How can I securely generate secret-sharing/multisig keys on a p2p network?

I am trying to create a peer-to-peer escrow system. I need to encrypt the private key of a wallet with a 2-of-3 secret-sharing function - the buyer, seller, and arbitrator will each have have one key. ...
-1
votes
2answers
65 views

Should a 2FA app require authentication to grant access to 2FA tokens?

I don't know the theoretical background for 2FA so I'm asking here. I've used a few 2FA apps before including Duo Mobile and Steam Mobile (Guard). When Duo is opened, it will display your tokens as ...
3
votes
0answers
51 views

How to add a new webauthn key if the existing one isn't portable

Webauthn supports authentication or multi factor authentication with either hardware keys or authentication features that are built into the device used (Windows Hello, Android with a Fingerprint, ...)...
1
vote
0answers
80 views

How to implement a “Forgot password?” functionality using php-encryption's KeyProtectedByPassword and 2FA?

I'm currently migrating the encryption functionality used in a PHP project from mcrypt (which was deprecated in PHP 7.1.x and no longer works from PHP 7.2 onward) to openssl, using the defuse/php-...
3
votes
1answer
67 views

Password strength when used with 2FA

We have two factor authentication, with passwords and one time code received on SMS. Now normally I know you could restrict users to create passwords with min 8 character length, lower and caps ...
2
votes
1answer
226 views

Can 2FA / MFA be secure & functional in a purely offline state (PWA)?

I'm building a Progressive Web App intended to be used primarily in an offline state. The user can "login" while disconnected, which verifies the password against a locally-stored hash and some other ...

1
2 3 4 5
11