Stack Exchange Network

Stack Exchange network consists of 175 Q&A communities including Stack Overflow, the largest, most trusted online community for developers to learn, share their knowledge, and build their careers.

Visit Stack Exchange

Questions tagged [multi-factor]

a multi factor authentication requires at least two sets of credentials. This is typically something you know (e. g. a password) and something you own (e. g. a token generator or mobile phone), but could also be something you are (a biometric).

-1
votes
0answers
29 views

How can I receive SMS 2FA codes if my phone doesn't have SMS? [on hold]

I live in a community that has chosen to intentionally use "dumb phones"1 (see why). Our phones do not even have SMS on them. That's become more and more of a problem recently. The companies that ...
0
votes
2answers
79 views

Does 2-Factor Authentication protect against malware?

My question has to do with whether 2-Factor Authentication protects against a compromised system (malware). There are a couple of scenarios in which I wonder whether it does: Every time you login to ...
0
votes
0answers
7 views

Passwordless(MFA) login Linux [migrated]

On windows there is Windows Hallo with support for bio-metrics/pin/yubikey/smartphone app. Even if it's not a 1:1 alternative Im looking for something similar. Is there any way to set up multi-factor ...
2
votes
1answer
75 views

Why does Microsoft Authenticator app ask me to choose a number?

I've got the Microsoft Authenticator app installed on my Google Pixel phone. When I sign into a Microsoft site, the site shows me a two-digit number (e.g. 34) and the app on my phone asks me to choose ...
0
votes
1answer
33 views

How does DUO push button method and other methods actually work?

Google authenticator uses HOTP and TOTP algorithm for TFA. What is the basic working principle of DUO push? What brings security to DUO push?
1
vote
2answers
123 views

When you enable 2FA, why is your second factor required to reset password?

In a conversation with a coworker the other day, I had trouble successfully defending why, when you enable 2FA on a service, you're required to enter a second factor before changing your password (in, ...
1
vote
2answers
86 views

Is stand-alone one-time password less secure than OTP + traditional password auth?

I have a client that would like to use one-time passwords (via SMS or Email) for their app, and their requirements spec does not include traditional password-based authentication. I haven't seen this ...
0
votes
0answers
37 views

Two-factor authentication on Galaxy Watch - should secrets be encrypted, and is this SQLite example secure?

I recently got a Galaxy Watch and to get acquainted with developing apps for it I'm writing a simple two factor authenticator to generate TOTP codes from entered secrets using the Google Authenticator ...
-2
votes
3answers
154 views

Why do services that use 2-factor authentication still ask you to provide a password?

The idea of 2 factor authentication is that if you can prove that you have both a password and a device, you are trusted to be who you say you are. My question is, why does the service still ask you ...
2
votes
1answer
76 views

Problems with this 2 factor authentication implementation

I'm implementing my own 2 factor authentication using SMS. We have a gift card service and the users are sent a link to their gift card. Every time they click on their link, we are verifying it's ...
5
votes
2answers
196 views

2 factor authentication, fob management

I love the idea of 2 factor authentication but how can I make sure I'm not caught in the wind without such keys? I thought about switching to a fob for services that support it. Is there a fob that I ...
1
vote
3answers
120 views

Can I get 2FA for my private domain e-mail account? [closed]

Is it possible to somehow get 2FA for my e-mail accounts even if they're hosted on custom / private domains? (e.g mymail@mycooldomain.com and not gmail)
2
votes
1answer
55 views

Does password strength matter when using a YubiKey? [duplicate]

I'm considering buying a YubiKey. I already use a password manager which can generate strong passwords, but I wonder if there's even a point with the YubiKey. I guess it just makes one extra step......
0
votes
1answer
34 views

Does the number of fingerprints we leave represent a security threat to the banking system?

A number of major banks are allowing users to log in to their bank accounts with only fingerprints. It was occurring to me, though: how many fingerprints does the average person leave per day? How ...
0
votes
2answers
53 views

Must the different multi-factor “factors” be correlated if possible?

We are in the process of securing our internal servers and there is a requirement of using two factor authentication (SSL client&server certificates and username-password). One doubt that has ...
0
votes
1answer
62 views

What should be done if 2FA was turned off in an unexpected manner?

Today when I logged in Facebook, no 2FA was shown. I have been using SMS message as the second authentication factor. When I looked at the security settings, 2FA seemed to be disabled. I immediately ...
3
votes
3answers
167 views

Is receiving an OTP via email any more secure than receiving it via SMS?

I understand that getting OTPs via email and SMS are the weakest forms of 2FA, but given a situation where these two are the only options for 2FA, is email any better than SMS? (Assuming the email - ...
1
vote
0answers
41 views

How to enforce E-mail Account Security with regards to Custom Domains & 2FA?

Lately I've been bothered by the fact that should one of my e-mail accounts be in some way compromised despite its long and randomized password phrase. I'd have hell to pay since it is effectively a ...
1
vote
1answer
62 views

Is using WebAuthn alone considered as two factor authentication?

Will using WebAuthn for an application make it two factor? I am specifically interested in using Ondevice biometrics and achieve passwordless authentication. For a true two factor authentication you ...
2
votes
3answers
195 views

Why 2FA is not considered flawless when used to secure an account?

Often I see it being discussed that if configured and enabled, 2FA will increase the security of an account, it will add an additional security layer, however an attacker could still gain access to ...
8
votes
3answers
238 views

Is a second, “old” (dumb) phone dedicated just to receiving bank tokens as safe as “modern” (smart) phone?

Are old phones safer / safe / as safe as modern smartphones when it comes to auth-tokens / confirmations tokens? Is SMS encrypted?
3
votes
1answer
77 views

Is Duo MFA vulnerable to a SIM swap exploit?

I'm looking into MFA options for a group of around 1000 people. Duo is intriguing, but I'm not sure I'm comfortable implementing something that incorporates text messaging (in contrast to something ...
1
vote
2answers
96 views

What is the point of 2FA if the recovery code (which is only one factor) can be used to access the account anyway?

I think the title says it all, but to elaborate: If, say, someone were to find my recovery code, could they not then gain access to my account? Similarly, could then someone not just hack my recovery ...
4
votes
1answer
63 views

Generating QR code from seed in browser - possible security issue?

I need to implement 2FA in my web app. I'm doing this the standard way: the newly created user's seed is retrieved from the server(I use speakeasy) and the QR code is generated. The thing is, it's ...
1
vote
0answers
63 views

Two factor authentication and plausible deniability for disk encryption

Can you prove, for the most common disk encryption programs like Veracrypt or LUKS/dmcrypt, that a second factor like a yubikey or a keyfile on a USB disk is required? If this is not the case is there ...
2
votes
4answers
183 views

How can I maintain my two factor authentication when my phone is in for repairs?

I recently got a new phone that has various hardware issues with it. As such, before the warranty expires, I need to send it back for repairs. Unfortunately, I already have Google Authenticator ...
2
votes
1answer
58 views

Is it secure to make user able to disable 2FA with 2 security questions if they have lost backup codes?

I am developing an application and users are able to add 2FA to their account. however if a user has lost backup codes of 2FA and logged out of account on all of devices, is it safe making them able ...
0
votes
1answer
96 views

Does the device you are logging into count as one of the factors for MFA when you are using device biometrics? [duplicate]

Yes it does because I 'have' the physical device I 'am' the owner of the fingerprint But no it doesn't because 1=>2 : If you have my device the fingerprint is now something you can get. Which ...
0
votes
1answer
79 views

Gmail sign-in with 2 step verification secure enough for money-generating YouTube channel [closed]

My goal is to find out if the sign-in process of a personal Gmail account with 2-step verification turned on, is enough from a security point of view, to serve as the sign-in process for a YouTube ...
1
vote
1answer
119 views

Can a scanning id system like trusona really be secure?

I became aware of Trusona recently (see their demo on this page https://www.trusona.com/ ). They want to 'end passwords'. I believe in the idea that 'reasonable security' = {something you are + ...
-1
votes
2answers
127 views

Is it a good idea to have a new laptop just to generate 2FA keys?

I am very concerned about people putting keyloggers or trojans on my computer. That can happen because I use my computers for many things. Work. Playing games. Watching movies. Accessing many ...
0
votes
1answer
40 views

What are possible security issue if any of automatically inserting 2FA in 1password? [duplicate]

I've heard that 1password have a feature. We basically stored the QR codes for google 2FA in 1 password. 1 password then tell us the google 2FA keys everytime we logged in. https://support....
6
votes
6answers
541 views

Is it safe to store 2FA tokens together with passwords in 1password?

I'm using 1password and I've seen 1password allows you to store 2FA tokens in the same place where you store the password. I don't like the idea of having everything in the same place as if someone ...
25
votes
6answers
5k views

Why do apps with phone verification send the user a message, rather than have the user send one to them?

Many apps allow the user to authenticate with their phone number, by having the user enter it, and then sending an SMS with a code to be entered into the app. Very few (if any that I can find still ...
8
votes
3answers
367 views

Should I delete SMS messages containing one-time passwords?

I have had one-time passwords sent to my phone via SMS. Those one-time passwords include those for 2FA and the occasional password reset. Should I delete those SMS messages after the one-time ...
3
votes
3answers
1k views

Aren't endpoint devices inherently MFA?

I was recently asked if MFA was leveraged for authentication on endpoint devices. My gut reaction is that given MFA is something you have, know, are, and you need to have the laptop to log into it and ...
1
vote
2answers
177 views

Why bother with certain types of 2fa if they can be easily bypassed?

In the wild, there is a method of bypassing 2fa. The gist of it is that the attacker doesn't just phish the password, but they also phish the 2nd factor and use those for a real login on their own ...
2
votes
4answers
97 views

What are some existing or ideas where the use of a password can be replaced to login to a service? [closed]

The password has been a method of authentication for a long time now and we always hear of breaches happening where users passwords get stolen and sometimes are not even hashed at all or correctly. ...
3
votes
1answer
114 views

What to do if a user loses access to his authenticator code?

I have a web service that I set up which allows users to protect their accounts via two factor authentication via an authenticator app like Google Authenticator and Authy. When enabling it, I mention ...
0
votes
2answers
112 views

Can a hacker compromise the system if he can steal one of the factors of the 2FA?

I read this article saying that smartcards used as a 2FA are still susceptible to attacks such as MITM attack: They think 2FA is unhackable...undefeatable, when that clearly isn’t true. They think ...
1
vote
0answers
556 views

OpenVPN use auth-user-pass with a file and authenticator

I have an open vpn configuration with the lines auth-user-pass my-login-creds.conf static-challenge "Enter Google Authenticator Code" 1 in it. When I try to connect with openvpn my-config.ovpn I ...
1
vote
2answers
872 views

Combining a fingerprint scan and password for 2-factor-authentication [closed]

UPDATE: I found the answer to the "How To?" part of my question on superuser: Require Fingerprint AND Password/Pin for Windows Logon Is it possible to require a TOTP on Windows Login using existing ...
1
vote
1answer
238 views

Authy reviewed? [closed]

Authy looks like a great solution - especially for laymen, in order to simplify complexities - but I have some nagging concerns re privacy & security, especially when sensitive data is hosted "on ...
2
votes
1answer
288 views

Are Authy's tokens insecure?

I've been trying out Authy, a Google Authenticator alternative with an optional feature of being able to back up your tokens. They have two types of tokens: Authy-generated tokens and the regular OTP ...
3
votes
1answer
256 views

SMS based 2FA intercepts

Reddit just revealed that they experienced a security breach as a result of an intercepted SMS based 2FA. Another post on SMS 2FA refers to flaw in the telecom’s ss7 protocol that was used to perform ...
2
votes
0answers
36 views

Protecting private keys of common chat applications with 2FA

Say a user uses a common chat application like Telegram, Signal, Whatsapp, Ricochet. His device gets hacked and private keys get stolen. For normal PGP usage with email you can use two factor ...
7
votes
1answer
177 views

Why use one-time codes for two-factor authentication backups?

I am building an web application that uses two-factor authentication. While implementing the recovery feature, I see that most companies (eg Apple, Facebook, Github) provide a set of ~15 backup codes,...
1
vote
1answer
52 views

Do account recovery options defeat stronger 2-factor authentication?

2-factor authentication (2FA) is encouraged in order to reduce the risk of an account being compromised since the attacker has to know more than just your password. There are many ways to deploy 2FA, ...
0
votes
0answers
45 views

Leaking information about 2FA status

I was asked to provide a public web interface which is given an email addresses (which belong to our users) for public clients (e.g. a web application or native mobile application) whether or not a ...
1
vote
0answers
174 views

Hardware-based password manager with per-password verification [closed]

I'm looking for a device to perform hardware password management very similarly to the Trezor, shown here, commonly used as a wallet for cryptocurrencies. Unfortunately, the Trezor only stores a ...