Stack Exchange Network

Stack Exchange network consists of 174 Q&A communities including Stack Overflow, the largest, most trusted online community for developers to learn, share their knowledge, and build their careers.

Visit Stack Exchange

Questions tagged [multi-factor]

a multi factor authentication requires at least two sets of credentials. This is typically something you know (e. g. a password) and something you own (e. g. a token generator or mobile phone), but could also be something you are (a biometric).

-2
votes
0answers
47 views

How to tell Authy that I am using crypto? [on hold]

If I am using crypto, Authy will not allow SMS verification. That is reasonable. How does Authy "know" that I am using crypto? How do I tell Authy that I am using crypto and to not SMS verify.
2
votes
1answer
53 views

Is it secure to make user able to disable 2FA with 2 security questions if they have lost backup codes?

I am developing an application and users are able to add 2FA to their account. however if a user has lost backup codes of 2FA and logged out of account on all of devices, is it safe making them able ...
-1
votes
1answer
82 views

Does the device you are logging into count as one of the factors for MFA when you are using device biometrics? [duplicate]

Yes it does because I 'have' the physical device I 'am' the owner of the fingerprint But no it doesn't because 1=>2 : If you have my device the fingerprint is now something you can get. Which ...
0
votes
1answer
70 views

Gmail sign-in with 2 step verification secure enough for money-generating YouTube channel [on hold]

My goal is to find out if the sign-in process of a personal Gmail account with 2-step verification turned on, is enough from a security point of view, to serve as the sign-in process for a YouTube ...
1
vote
1answer
45 views

Can a scanning id system like trusona really be secure?

I became aware of Trusona recently (see their demo on this page https://www.trusona.com/ ). They want to 'end passwords'. I believe in the idea that 'reasonable security' = {something you are + ...
-1
votes
1answer
96 views

Is it a good idea to have a new laptop just to generate 2FA keys?

I am very concerned about people putting keyloggers or trojans on my computer. That can happen because I use my computers for many things. Work. Playing games. Watching movies. Accessing many ...
0
votes
1answer
27 views

What are possible security issue if any of automatically inserting 2FA in 1password? [duplicate]

I've heard that 1password have a feature. We basically stored the QR codes for google 2FA in 1 password. 1 password then tell us the google 2FA keys everytime we logged in. https://support....
3
votes
6answers
171 views

Is it safe to store 2FA tokens together with passwords in 1password?

I'm using 1password and I've seen 1password allows you to store 2FA tokens in the same place where you store the password. I don't like the idea of having everything in the same place as if someone ...
0
votes
0answers
20 views

Setup own infrastructure for a ChipTAN generator

Smartcard readers can not just read bank cards, but also RSA smartcards. I wonder if it is possible to use a ChipTAN generator for other cards too. What is needed to set up a personal infrastructure ...
24
votes
6answers
5k views

Why do apps with phone verification send the user a message, rather than have the user send one to them? [duplicate]

Many apps allow the user to authenticate with their phone number, by having the user enter it, and then sending an SMS with a code to be entered into the app. Very few (if any that I can find still ...
8
votes
3answers
359 views

Should I delete SMS messages containing one-time passwords?

I have had one-time passwords sent to my phone via SMS. Those one-time passwords include those for 2FA and the occasional password reset. Should I delete those SMS messages after the one-time ...
3
votes
3answers
1k views

Aren't endpoint devices inherently MFA?

I was recently asked if MFA was leveraged for authentication on endpoint devices. My gut reaction is that given MFA is something you have, know, are, and you need to have the laptop to log into it and ...
1
vote
2answers
154 views

Why bother with certain types of 2fa if they can be easily bypassed?

In the wild, there is a method of bypassing 2fa. The gist of it is that the attacker doesn't just phish the password, but they also phish the 2nd factor and use those for a real login on their own ...
2
votes
4answers
91 views

What are some existing or ideas where the use of a password can be replaced to login to a service? [closed]

The password has been a method of authentication for a long time now and we always hear of breaches happening where users passwords get stolen and sometimes are not even hashed at all or correctly. ...
3
votes
1answer
88 views

What to do if a user loses access to his authenticator code?

I have a web service that I set up which allows users to protect their accounts via two factor authentication via an authenticator app like Google Authenticator and Authy. When enabling it, I mention ...
0
votes
2answers
97 views

Can a hacker compromise the system if he can steal one of the factors of the 2FA?

I read this article saying that smartcards used as a 2FA are still susceptible to attacks such as MITM attack: They think 2FA is unhackable...undefeatable, when that clearly isn’t true. They think ...
0
votes
0answers
232 views

OpenVPN use auth-user-pass with a file and authenticator

I have an open vpn configuration with the lines auth-user-pass my-login-creds.conf static-challenge "Enter Google Authenticator Code" 1 in it. When I try to connect with openvpn my-config.ovpn I ...
1
vote
2answers
145 views

Combining a fingerprint scan and password for 2-factor-authentication [closed]

UPDATE: I found the answer to the "How To?" part of my question on superuser: Require Fingerprint AND Password/Pin for Windows Logon Is it possible to require a TOTP on Windows Login using existing ...
1
vote
1answer
78 views

Authy reviewed? [closed]

Authy looks like a great solution - especially for laymen, in order to simplify complexities - but I have some nagging concerns re privacy & security, especially when sensitive data is hosted "on ...
1
vote
1answer
113 views

Are Authy's tokens insecure?

I've been trying out Authy, a Google Authenticator alternative with an optional feature of being able to back up your tokens. They have two types of tokens: Authy-generated tokens and the regular OTP ...
3
votes
1answer
187 views

SMS based 2FA intercepts

Reddit just revealed that they experienced a security breach as a result of an intercepted SMS based 2FA. Another post on SMS 2FA refers to flaw in the telecom’s ss7 protocol that was used to perform ...
2
votes
0answers
34 views

Protecting private keys of common chat applications with 2FA

Say a user uses a common chat application like Telegram, Signal, Whatsapp, Ricochet. His device gets hacked and private keys get stolen. For normal PGP usage with email you can use two factor ...
7
votes
1answer
154 views

Why use one-time codes for two-factor authentication backups?

I am building an web application that uses two-factor authentication. While implementing the recovery feature, I see that most companies (eg Apple, Facebook, Github) provide a set of ~15 backup codes,...
0
votes
1answer
45 views

Do account recovery options defeat stronger 2-factor authentication?

2-factor authentication (2FA) is encouraged in order to reduce the risk of an account being compromised since the attacker has to know more than just your password. There are many ways to deploy 2FA, ...
0
votes
0answers
42 views

Leaking information about 2FA status

I was asked to provide a public web interface which is given an email addresses (which belong to our users) for public clients (e.g. a web application or native mobile application) whether or not a ...
1
vote
0answers
95 views

Hardware-based password manager with per-password verification [closed]

I'm looking for a device to perform hardware password management very similarly to the Trezor, shown here, commonly used as a wallet for cryptocurrencies. Unfortunately, the Trezor only stores a ...
1
vote
3answers
199 views

How do websites protect against 2fa replay attacks?

I'm imagining a scenario where an attacker can read traffic between a user and a server. The attacker grabs the user's password and the 2fa code they used. The attacker then logs in with that ...
0
votes
2answers
105 views

How does google know if I am logging in from a new machine(using web browser)? [duplicate]

Every time i sign into my google account on a web browser on a new machine, it warns me of suspicious activity. How does google know its a new machine? I am trying to implement a similar thing for my ...
1
vote
3answers
98 views

Sharing 2FA tokens

A company I work for wants to share a login to a sensitive application. The application unfortunately does not support multiple users, so a username / password combo is shared between several people ...
1
vote
1answer
105 views

SMS OTP as 2FA - should there be sms session id in sms for user's verification?

Several times I saw SMS 2FA implementation when a web site shows "sms session id" (say, 8 digits token) right after sending sms to user together with OTP prompt. Sms comes with OTP (say, 4 digits) and ...
0
votes
2answers
103 views

Help to review 2FA algorithm

First of all, I know, don't reinvent the wheel... But there's a good reason for this. So I have been implementing a generic 2 factor authentication code generation/validation algorithm in order to re-...
3
votes
1answer
77 views

Duo Security forgot password workflow

I'm updating my company's forgot password workflow. Currently we use Duo Security as our second factor on login (but for the purposes of my question this can be any such service). I've been walking ...
22
votes
4answers
557 views

Bank asked for a cross login?

I was creating a new bank account here in the US at HSBC's popular online bank... You know the step where you have to verify the account you're sending from, by receiving two small test payments? I ...
2
votes
4answers
175 views

Does a two-factor authentication dongle (OTP) which is always inserted in MacBook add a security benefit?

I think to get a Yubikey and read that Keepass with OTP makes no sense No. Security remains the same + extra cognitive overhead. I try to store all data local and use seldom cloud based services. If ...
1
vote
0answers
36 views

Multi-factor asking condition

It is an established fact that the error message of login pages should not specify wether the password or the id is the problem. But for an application with multi factor authentication, should we ask ...
0
votes
1answer
37 views

How much entropy is required for a Grid Card?

We're in the process of implementing multifactor authentification. One good candidate for this was the "Grid Card" - a small table with random letters and digits. Upon login, the user would be queried ...
3
votes
0answers
73 views

U2F FIDO sends identifiable serial numbers

As all of the FIDO Alliance documents state, the FIDO U2F protocols should never be able to abused to identify whether a user has multiple accounts with one service, or for services to collude and ...
1
vote
1answer
268 views

Maximum tries for 2FA code?

I am building a website and I am implementing two factor authentication (2FA). The second factor will be a random 6 digit code like those from Authy. This site will store very confidential information....
3
votes
1answer
188 views

Why not authenticate with the user sending an SMS?

Every time I do 2-factor authentication on a mobile app, it sends me a message with a security code. I understand this is weak because the SMS system can be hacked to redirect your messages to another ...
3
votes
1answer
76 views

Google Authenticator - Showing someone my code [duplicate]

I want to create a video. During the video I need to login in to some website. I will use the one-time code from my google authenticator app. Is it safe to show this one-time code to the people or ...
7
votes
3answers
990 views

How does entering “a” phone number help Google “verify it's me?”

Today I tried to sign into my Google account while at university. Google blocked the attempt, and asked for a phone number. Below is a screenshot of the form Google showed me. It says: Verify it's ...
1
vote
1answer
58 views

Two factor authentication vs. user experience

I'm wondering if there's any reason to implement a username/password with 2FA or, from the user's perspective, just settle with a username/2FA code. I'm trying to seek a healthy balance between the ...
1
vote
4answers
1k views

Hardware-Based Password Manager

Folks, I'm trying to improve my password management, and I have a vision in mind for a solution. However, I'm having a problem putting it all together or finding a product(s) that fits. First I ...
2
votes
1answer
130 views

Does Time-based One Time Password improves security in case of database leak?

From what I understand, Time-based One Time Passwords used a seed and a mathematical algorithm to generate unique passwords. As the seed is known by the user (or the device used by the user), and the ...
1
vote
1answer
168 views

How to share “secure” account credential with my spouse?

Not sure if this is the right place to ask, but here goes: My spouse and I have 20-ish or so accounts (retirement, investment, banks, insurances, tax, etc.) where I would we both would like to have ...
1
vote
1answer
53 views

What kind of attacks are mitigated by 2FA/MFA in Industry sector?

I would like to understand the real role of 2-Factor Authentication in Industry Control Systems like SCADA/SmartGrid with Windows AD infrastructure. In particular I am interested in an operational use ...
0
votes
3answers
54 views

Can one factor be used multiple times in multi factor authentication?

Is it mandatory in MFA that the factors should be (1) something you have + (2) something you know + (3) something you are, or it is okay to use any single of two factors multiple times (e.g. password ...
-1
votes
2answers
134 views

Does multi-factor authentication make tracking/fingerprinting easier?

Is multi-factor authentication a privacy risk? Does it make tracking/fingerprinting easier? It was seem so because whoever is accepting the OTP could track and record every OTP request and metadata ...
0
votes
1answer
34 views

Algorithms for 2FA over HTTPS?

I'm developing an Authenticator App for use towards my own API. I know about the TOTP standard RFC 6238 and the HOTP variant. Though I would prefer to use a public/private key based solution (by only ...
0
votes
1answer
103 views

Is just PIN and password without any hardware token considered to be 2FA?

When using online internet banking, I have to use my 6 digit pin and a password to authenticate into the system. There is no hardware token used in this example. Is this considered as 2 Factor ...