Questions tagged [multi-factor]

a multi factor authentication requires at least two sets of credentials. This is typically something you know (e. g. a password) and something you own (e. g. a token generator or mobile phone), but could also be something you are (a biometric).

Filter by
Sorted by
Tagged with
0
votes
0answers
5 views

Azure MFA integration with CheckPoint VPN [migrated]

We have a Azure-AD joined hybrid model. We would like to have a single MFA solution for CheckPoint VPN and classic M365 services. I read that it is possible using a NPS server. What are the ...
2
votes
2answers
66 views

What to make of inconsistent TFA/2FA verification emails from AOL

My parents use AOL (there's no point trying to migrate them at this stage) with two factor authentication. My father let me know that he recently received an identity log in verification email that ...
1
vote
1answer
49 views

Does this official “Enforce MFA” AWS policy make any sense?

At https://aws.amazon.com/premiumsupport/knowledge-center/mfa-iam-user-aws-cli/ the AWS officially recommends to have this policy { "Sid": "...
4
votes
1answer
194 views

Received a call from +1 202-455-8888 but I did not attempt to log in to my Gmail

I have enabled multi-factor authentication for my Gmail. When I need to log in to my mail, I should enter an OTP which is sent to my phone number. I got a call from this number, even though I did not ...
9
votes
5answers
3k views

Does 2FA Help Prevent Unauthorized Access in Phishing Attacks?

Given Attacker is targeting a user of bank.com. bank.com uses SMS or Google Authenticator 2FA, where the user enters the 2FA code into a form. Scenario Attacker registers domain name baank.com ...
2
votes
2answers
166 views

How can I safely print a keyfile on paper?

I use KeePass with two factors, one being a keyfile. I would like to print the keyfile on a paper for disaster recovery. How can I create a file that is printable on paper in such a way that I can use ...
1
vote
0answers
39 views

How should I share a TOTP shared key with my users?

I want to add one-time passwords as gates for certain important actions in the application I am working on. It is not two-factor authentication, although it may be extended to that use case later. ...
0
votes
0answers
67 views

2 person 2-factor authentication?

I'm trying to build a system as follows: User 1 is a low permission user. They will be using their phone and at some point will need to do a secure action. User 2 is an admin user and will be in the ...
27
votes
9answers
7k views

How does “Somewhere you are” authentication add further security?

In addition to the authentication techniques that are based on “something you have”, “something you know” and “something you are”, authentication techniques that consider “somewhere you are” are also ...
0
votes
1answer
38 views

How does the PIN work in the RSA SecurID phone app?

I use the RSA SecurID phone app to connect to the VPN at my work. I run the app and type a 4 to 8 digit PIN. Then the app gives me a 6 digit code to connect to the VPN. Does the PIN change the result? ...
0
votes
0answers
46 views

Integrating 2FA app into main app

We currently have two distinct apps, one for generating a 2FA token and the other one is the main app. Business is now considering to have only one app left and integrating the authenticator app into ...
0
votes
1answer
75 views

Does Two Factor Authentication (2FA) prevent Phishing and/or Man-in-the-Middle (MITM) attacks?

While 2FA is clearly an improvement over only a single factor, is there anything which prevents an adversary presenting a convincing sign-in page which captures both factors? I realise that ...
0
votes
1answer
86 views

Are hardware security keys (e.g ones supporting Fido2) “able to protect authentication” even in case of compromised hosts?

Correct me if I am wrong, please. I understand that 2FA (MFA) increases account security in case an attacker obtains a password which might be possible via various ways, e.g. phishing, database breach,...
0
votes
1answer
95 views

Is it safe to send verification code in the subject of the email?

I am wondering if it's safe to send the signup, reset password, 6 digit verification code in the subject of the email. Example: "Welcome to the Application, Your verification code is XXXXXX" ...
0
votes
0answers
28 views

Security concerns regarding user self-service MFA reset

Let's say I have an IAM system with a typical MFA feature: TOTP with recovery codes. When users don't have access to their TOTP apps, they can use recovery codes to log in. The IAM system has an admin ...
1
vote
2answers
146 views

2FA authentication with QR code

Can someone confirm if the following solution is actually 2FA? User has to install a special mobile app. When the mobile app is opened for the first time, the user is asked to associate the device ...
0
votes
0answers
29 views

Handling parallel login and Max invalid attempts using OTP with same phone number

I am designing a login system that performs login operation using OTP and Email ID of the registered user. The current approach is as below User enters the Registered Email Id If the Email ID is ...
0
votes
2answers
151 views

Why hasn't push notification authentication replaced SMS for 2FA?

So we use DUO for 2FA at work and it uses push notification authentication as the second factor for 2FA. It's so quick and easy! I enter my username and password, get a push notification on my phone, ...
0
votes
0answers
90 views

(Re)Hacked Instagram accout even if Two Factor authentication was enabled

A friend of mine, let's call her Alice, had an Instagram account that was hacked. She uses an iPhone. The scenario looks like this: Alice gets a link from a Business Account via WhatsApp, and clicks ...
1
vote
0answers
80 views

Is storing an encrypted 2FA backup on Bitwarden (a password manager) a good idea?

I am at the moment using Bitwarden and a separate 2FA app. I am trying to figure out a way to be able to securely recover my access to credentials and 2FA in case my phone/laptop/other electronic ...
1
vote
2answers
67 views

What is the name of the crypto system used by ICANN's DNS recovery system?

I once heard about a type of crypto system that behaves in the following way: I have x secret keys that work together to decrypt messages encrypted with a public key d. If I get at least n of the x ...
0
votes
1answer
45 views

synchronization of keyfob token generator

At work, years ago, I used to have a key-fob device that was about the size of a thumb-drive. It had a 4 digit LCD screen that the numbers changed every 60 seconds. When logging onto certain servers,...
2
votes
1answer
102 views

How does Amazon secure its 6 digit one-time password?

I noticed that Amazon's password reset relies on a 6 digit numeric PIN. Doesn't this reduce every user's account to a 1 in 10^5~ chance of being accessed through brute force guess factoring in a few ...
0
votes
0answers
60 views

Does mobile biometric authentication count as Knowledge, Possession, or Inherence authentication

Apple claims in this year's WWDC that Face ID and Touch ID count for both Possession and Inherence identity factors, because they are using Biometrics (Inherence) to access the secure element on your ...
25
votes
2answers
9k views

What's the point of Microsoft Account 2FA if it still lets me log in using password instead?

I have a Microsoft Account linked to a Microsoft Authenticator app for 2FA purposes. Every time I log in, it first sends me the Authenticator request, but I can always click "Other ways to sign ...
0
votes
1answer
131 views

How often should we force users to re-authenticate when not on the network?

Our company has rolled out MFA to our users. We are a Microsoft shop, so we are using Azure AD to handle MFA and authentication to things like email, Teams, Sharepoint, etc. By default, we've disabled ...
0
votes
3answers
113 views

What is the best practice for resetting multi-factor when a user requests to recover their password?

I am in the process of developing a web-application which requires MFA on every login. (On the first login, before you can do anything, you are forced to setup MFA. Due to monetary restrictions and ...
23
votes
2answers
6k views

What is the risk of having a 2FA key permanently plugged into my device?

Yubico offers the YubiKey Nano, a 2FA key designed to be left inside the device more or less permanently. While it does add comfort to be able to just leave it plugged in, what risks would there be ...
0
votes
0answers
43 views

Dedicated device for online investing and other security measures

I like to invest money online. I invest in both cryptocurrencies as well as regular stocks. As my bankroll grows (let's say 20k+ in the near future), I feel like I need to start taking more serious ...
1
vote
2answers
58 views

two-factor authentication suffix code in the password

In many sites where 2FA is enabled, the login flow is: A form asking for username/password If credentials are valid a new form asks for the verification code. However, there are some implementations ...
1
vote
1answer
133 views

If someone steals my unencrypted, password protected laptop, would they be able to get into my Google account?

I have a laptop with Ubuntu 20.04 operating system. I am logged into my Chrome browser using my Google account. This means, every time I open my browser, I am already logged into all the Google ...
0
votes
1answer
101 views

Why make it difficult to disable MFA tokens?

Some websites make it easy to enrol multiple TOTP apps at the same time but make it difficult to disable these apps. For instance, the user would have to completely reset the MFA settings instead of ...
1
vote
1answer
37 views

Should a service indicate the usage of multi-factor authentication by a user for building trust?

We all know that MFA done right can greatly increase the security of an online identity. There are services around with a fundamental trust problem among the users. For example online market places ...
0
votes
0answers
28 views

If someone stole my symantec VIP credential ID, would they be able to generate the same one-time passcode as the app does?

Let's say I've installed the Symantec VIP app on my device. If someone stole my Symantec VIP credential ID, would they be able to generate the same one-time passcode (OTP) as the app does?
1
vote
3answers
139 views

prevent/prohibit duplication of MFA software-token / ensure user identity

As I was unable to find any thread about this particular question, I'm trying to ask the community for help. We're currently using RSA RADIUS based 2FA to authenticate external VPN users from ...
1
vote
2answers
69 views

What are Security Considerations of Using File Upload/Comparison as Simplified Second Factor?

I am evaluating the idea of simplified second factor authentication by requiring a file to be uploaded, such as an image along with username/password. The file is stored on a user's device. My ...
2
votes
2answers
80 views

How to store MFA secret

I have an online application that I'm adding MFA to, using the Google / Microsoft Authenticator apps for mobile phones. I've tried to adopt a security focussed approach to storing the MFA secret and ...
8
votes
2answers
3k views

How does password reset work if 2FA is enabled?

(There is a highly related question, however I believe mine is not a duplicate, since it deals with resetting a password without access to the account, not changing it while being logged in.) Say ...
0
votes
0answers
42 views

Is using traditional 2FA codes a prerequisite for using U2F FIDO key in Dashlane/1Password?

Over the past few weeks, I have spent a lot of time thinking about how to structure my security plan based on a password manager, just two/three strong master passwords and the use of physical U2F ...
1
vote
0answers
30 views

MFA: can unique biometrics collecting device count as another authentication factor (a possession factor)?

I see in this answer (Aren't endpoint devices inherently MFA?) that an endpoint device doesn't qualify as an authentication factor (AF). But if the endpoint biometric collecting device is uniquely ...
0
votes
0answers
53 views

Blockchain 2FA by sms (wallet code) secure (hack)?

To keep a long story short, I got hacked on my PC by downloading and executing a wrong file. Programs as InterVPN, Cryptobot and HVNC (told by the hacker via google chat) were installed. My accounts (...
0
votes
1answer
89 views

Could IMAP authentication be adapted to support 2FA?

Theoretically? (If no, why? And if yes, why hasn't it been done?)
0
votes
0answers
39 views

Can bad software/web app architecture compromise my 2FA key?

So this is a two part question: 1) When I have a compartmentalized system, and then I use the same hardware 2FA key for 2FA across all compartments, can my hardware key be used to trace me through ...
0
votes
1answer
43 views

Risks associated with a compromised external Security token server

Consider the following architecture: An on premise Web API 2 [Written in C# hosted in IIS] which uses OAuth 2 authentication [ Implicit Flow ] to secure itself. This API acts as the data source by ...
1
vote
1answer
110 views

A proposal for effortless two-factor authentication

I have an idea for device-level two-factor authentication that involves no direct input from the user, and I wanted to find out if something like it has been tried before. Let's say I have an account ...
0
votes
0answers
30 views

Doesn't installing a TOTP client on your primary PC undermine the whole point of 2FA? [duplicate]

Authy is a popular cross-platform TOTP application that supports syncing keys across devices. I have been a little confused by the idea of having a desktop client... This way if someone accesses my ...
1
vote
1answer
89 views

2-factor authentication can be misused?

I was trying to access my account on an e-commerce website but I couldn't get my password right. So, the website offered me the option to authenticate using my security code from Google Authenticator ...
-2
votes
1answer
154 views

Attacks that ByPass Multifactor Authentication (Necrobrowser in Office 365) [closed]

I added MFA to Office 365, but a security specialist says it can be defeated with NecroBrowser, which can capture and transmit an already MFA-authenticated cookie. I can't find any specifics about ...
1
vote
2answers
141 views

Is there a way to “lock” a YubiKey after a period of inactivity?

I have a YubiKey 5c nano attached to my laptop used for 2FA, etc. It works great and is unobtrusive, but I feel like the small form factor encourages leaving it plugged into the laptop all the time, ...
1
vote
3answers
195 views

Is it safe and permissive to remember devices to skip two factor authentication when dealing with sensitive information?

We're a small UK startup building a small service that allows certain special people (e.g. journalists) to access non-public court information. This information includes a ton of private and ...

1
2 3 4 5
12