Questions tagged [multi-factor]

a multi factor authentication requires at least two sets of credentials. This is typically something you know (e. g. a password) and something you own (e. g. a token generator or mobile phone), but could also be something you are (a biometric).

Filter by
Sorted by
Tagged with
4
votes
2answers
452 views

Sending OTP before authentication / password verification

One of my old, rarely used computers had still an old password for my pyszne.pl / takeaway.com account stored in my browser's password manager. I tried to log into my account from that computer and ...
-1
votes
3answers
83 views

What's stronger: phone/text 2FA or authenticator app? [duplicate]

I noticed some very advanced sites don't offer 2 factor authentication via phone/text. Example Salesforce's Heroku: Is phone/text based 2 Factor Authentication generally weaker than using an ...
1
vote
0answers
55 views

What are the security risks to NFC based YubiKeys?

What are the risks of using NFC on a YubiKey versus just a hard connector? I imagine it would be possible to sniff some data off of these security keys? How real is the risk of sniffing and what could ...
1
vote
1answer
55 views

How do Services recognise 2-Factor Authentication codes as correct?

Something about the flow of setting up 2-factor authentication is not clear to me. This is the flow of setting up a Service* to use a 2-factor auth app**: Choose setup 2-factor auth in the account ...
13
votes
6answers
5k views

2FA: Why do I need to keep my backup codes for each platform on paper?

I'm looking into setting up 2-factor authentication for my registered accounts. However, when setting up 2FA, for example Reddit, you need to write down backup codes in order to regain access to your ...
1
vote
2answers
76 views

Does it make sense to split two factor authentication between identity providers

A common multi factor authentication solution will ask a user for a username+password and a one-time password. In all documents I can find both factors are asked by the same identity provider. This ...
1
vote
0answers
46 views

MFA authentication to O365 - remote workers users without mobile phone. Which secure solution? [closed]

We are deploying O365 in my company (Teams, Sharepoint, Exchange online, Office suite). In order to connect outside our network (remote workers especially during this pandemic), we've implemented MFA ...
1
vote
2answers
100 views

Are offline OTP systems really secure? [duplicate]

I know that OTP (One-time password) system is the most secure method for now if online. Online OTP systems, like sending code to a phone is secure because the attacker cannot know the code if he doesn'...
0
votes
4answers
94 views

2-factor authentication everywhere: is this possible?

I'm wondering if there is a way to require 2-factor authentication on webpages and Android apps that don't have it by default. I am already using a password manager but I feel that this may not be ...
1
vote
0answers
69 views

Why do I receive so many password reset/welcome emails from services I'm not a customer of? [closed]

Over the years I've received the occasional password reset from a service I've never used (or even heard of sometimes). As far as I can tell, the emails are genuinely being generated and sent by the ...
1
vote
1answer
88 views

Generation of OTP in a 2FA email method

I am aware of the fact that authentication via email is discouraged, but in some specific applications and given as secondary method, we all agree that it may be useful. Having said that, what is the ...
0
votes
1answer
62 views

Does syncing local data to the cloud count as MFA?

Bitwarden uses TOTP as the multi-factor authenticator method for their password manager. Bitwarden stores and syncs your data so you need the master password + TOTP to get access to your account ...
0
votes
1answer
72 views

Is it safe to use 2FA within a password manager relative to using a separate app for 2FA? [duplicate]

Nowadays, many Password managers offer options for 2-Factor Authentication such as TOTP. I am really confused regarding this. Isn't the whole point of 2FA is to prove you have a second way of proving ...
1
vote
3answers
191 views

Are security questions considered as 2FA?

Many sites have a step during registration when you have to create security questions and answers for them. Is this type of security layer considered as 2FA? From what I know, 2FA is used for the ...
8
votes
3answers
312 views

Why would password managers provide support for OTP codes? [duplicate]

Can anyone explain me what's this trend of providing passwords and OTP codes on the same service? What benefit or value are they trying to bring to the table? We, as security professionals, have been ...
2
votes
2answers
156 views

How is mailbox.org 2FA method referred to as, correctly?

Their 2FA to log in to their web interface requires two things: something you know (PIN); something you have (OTP, generated by app for example). After that, you need to log in by: input email ...
1
vote
1answer
75 views

2FA on Stack Exchange, Where Is It Or What I am Missing?

Not sure if this is the right spot to post this, but I have not been able to find how to enable 2FA (such as authy, MS/google authenticator, yubikey etc...) on stack exchange using email ...
0
votes
0answers
52 views

Protect breached email accounts

We are a big supermarket chain and have had complaints about fraudulent activities from a few customers who have used a particular email domain. We are in the process of implementing MFA on our site. ...
4
votes
0answers
107 views

Is asking the e-banking username/password from a 3rd party site compliant with 3dsecure and PSD2?

Recently I tried to make an online purchase in one of the biggest e-commerce sites in Greece. During checkout, and after providing debit card details, it asked me to provide the username/password (not ...
0
votes
1answer
58 views

2FA with blower.io SMS

I'm currently planning to deploy a project on Heroku and was wondering if it is safe to send 2FA sms messages with the blower.io heroku addon? Also is it safe/ok to send a short lived authentication ...
1
vote
3answers
148 views

OTP vs two-factor

A vendor implements two-factor authentication that requires us to enter a TOTP code generated, for example by FreeOTP, after user/password. I asked them how it is possible that using two different ...
0
votes
0answers
32 views

OpenVPN certificates vs. SSO with MFA

I am wondering, is using certificates with OpenVPN gives any advantages vs. using SSO with MFA to authenticate to OpenVPN? Are there any disadvantages for combining both?
2
votes
1answer
224 views

Storing 2FA seeds in a password manager [duplicate]

Does it make sense to store the 2FA seeds (i.e: the codes used to generate a time based OTP) in my password manager? If my password manager has a strong password and 2FA using a third-party app, is ...
1
vote
4answers
292 views

Is 2FA a false sense of extra security on a mobile phone?

I understand that 2FA increases security if you are using two different devices, for instance a computer and a mobile phone. I fail to understand how these security measurements help if you are doing ...
0
votes
1answer
57 views

Push button in Security key used for 2FA/MFA

I have come across many security keys from different manufacturers such as solokeys, yubico etc.., for the purposes of 2FA/MFA. Products vary basically w.r.t features such as USB-A, USB-C, Apple ...
1
vote
0answers
34 views

2FA/MFA in a resource-constraint product

I'm working on a resource-constraint product and asked to enable support for MFA/2FA for all maintenance services. Given that MFA/2FA is about using two elements out of three(something you have, know, ...
1
vote
1answer
72 views

Which factor of authentication is an X.509 certificate

Given 3 factors of authentication: Type 1: something you know Type 2: something you have Type 3: something you are Which factor of authentication would be an X.509 certificate, assuming this ...
2
votes
1answer
112 views

How do I add 2FA to my personal computer?

I have a Windows 10 PC that I would like to protect a little better. I've looked for solutions online, but they're all business oriented. What I would like, in an ideal situation, is having to enter ...
0
votes
1answer
41 views

Shared Apple Dev Accounts Two Factor Auth

First off, this may not be the right community. If it's not, I apologize and please close this and point me in the right direction. Apple will start enforcing two-factor authentication for its ...
1
vote
0answers
44 views

How does Authy implement multi-device mode?

This question has been asked previously, here. However, none of the answers there address the question. The accepted answer conflates Authy's multi-device mode with its cloud backup feature. I am ...
0
votes
1answer
88 views

Does fingerprint scanning on Microsoft Authenticator increase security?

tl;dr: I have switched phone and operating system: Android 8.0 --> Android 10.0. Phone restored from backup, so all the remaining is the same except for Microsoft Authenticator that now requires ...
19
votes
7answers
6k views

Don't one-time recovery codes for 2FA introduce a backdoor?

Although using multi-factor authentication is clearly a good move, I'm struggling with the 'one-time recovery codes' concept. It seems to me that if you choose to use them, what you're doing is ...
0
votes
2answers
69 views

It is common for an account to be locked after X amount of failed logins, what are the best practice of selecting x?

To my understanding, it is common security practice to lock the account after X failed login attempts in N minute. Usually, the account will be locked for M minutes. I noticed that most of the time X ...
2
votes
0answers
137 views

Received Google 2FA Code via SMS from two unknown phone numbers [duplicate]

I recently encountered a strange incident regarding the 2FA of my Google Account. The user Dunois has described a very similar occurrence in this post: Functional Google 2FA code (via SMS) received ...
2
votes
2answers
82 views

What to make of inconsistent TFA/2FA verification emails from AOL

My parents use AOL (there's no point trying to migrate them at this stage) with two factor authentication. My father let me know that he recently received an identity log in verification email that ...
1
vote
1answer
68 views

Does this official “Enforce MFA” AWS policy make any sense?

At https://aws.amazon.com/premiumsupport/knowledge-center/mfa-iam-user-aws-cli/ the AWS officially recommends to have this policy { "Sid": "...
5
votes
1answer
10k views

Received a call from +1 202-455-8888 but I did not attempt to log in to my Gmail

I have enabled multi-factor authentication for my Gmail. When I need to log in to my mail, I should enter an OTP which is sent to my phone number. I got a call from this number, even though I did not ...
9
votes
5answers
3k views

Does 2FA Help Prevent Unauthorized Access in Phishing Attacks?

Given Attacker is targeting a user of bank.com. bank.com uses SMS or Google Authenticator 2FA, where the user enters the 2FA code into a form. Scenario Attacker registers domain name baank.com ...
3
votes
2answers
246 views

How can I safely print a keyfile on paper?

I use KeePass with two factors, one being a keyfile. I would like to print the keyfile on a paper for disaster recovery. How can I create a file that is printable on paper in such a way that I can use ...
3
votes
1answer
149 views

How should I share a TOTP shared key with my users?

I want to add one-time passwords as gates for certain important actions in the application I am working on. It is not two-factor authentication, although it may be extended to that use case later. ...
0
votes
0answers
75 views

2 person 2-factor authentication?

I'm trying to build a system as follows: User 1 is a low permission user. They will be using their phone and at some point will need to do a secure action. User 2 is an admin user and will be in the ...
27
votes
9answers
7k views

How does “Somewhere you are” authentication add further security?

In addition to the authentication techniques that are based on “something you have”, “something you know” and “something you are”, authentication techniques that consider “somewhere you are” are also ...
0
votes
1answer
55 views

How does the PIN work in the RSA SecurID phone app?

I use the RSA SecurID phone app to connect to the VPN at my work. I run the app and type a 4 to 8 digit PIN. Then the app gives me a 6 digit code to connect to the VPN. Does the PIN change the result? ...
0
votes
0answers
51 views

Integrating 2FA app into main app

We currently have two distinct apps, one for generating a 2FA token and the other one is the main app. Business is now considering to have only one app left and integrating the authenticator app into ...
0
votes
1answer
151 views

Does Two Factor Authentication (2FA) prevent Phishing and/or Man-in-the-Middle (MITM) attacks?

While 2FA is clearly an improvement over only a single factor, is there anything which prevents an adversary presenting a convincing sign-in page which captures both factors? I realise that ...
0
votes
1answer
103 views

Are hardware security keys (e.g ones supporting Fido2) “able to protect authentication” even in case of compromised hosts?

Correct me if I am wrong, please. I understand that 2FA (MFA) increases account security in case an attacker obtains a password which might be possible via various ways, e.g. phishing, database breach,...
0
votes
1answer
165 views

Is it safe to send verification code in the subject of the email?

I am wondering if it's safe to send the signup, reset password, 6 digit verification code in the subject of the email. Example: "Welcome to the Application, Your verification code is XXXXXX" ...
0
votes
0answers
30 views

Security concerns regarding user self-service MFA reset

Let's say I have an IAM system with a typical MFA feature: TOTP with recovery codes. When users don't have access to their TOTP apps, they can use recovery codes to log in. The IAM system has an admin ...
1
vote
2answers
182 views

2FA authentication with QR code

Can someone confirm if the following solution is actually 2FA? User has to install a special mobile app. When the mobile app is opened for the first time, the user is asked to associate the device ...
0
votes
0answers
34 views

Handling parallel login and Max invalid attempts using OTP with same phone number

I am designing a login system that performs login operation using OTP and Email ID of the registered user. The current approach is as below User enters the Registered Email Id If the Email ID is ...

1
2 3 4 5
12