Questions tagged [multi-factor]

a multi factor authentication requires at least two sets of credentials. This is typically something you know (e. g. a password) and something you own (e. g. a token generator or mobile phone), but could also be something you are (a biometric).

Filter by
Sorted by
Tagged with
6
votes
3answers
227 views

Why would password managers provide support for OTP codes? [duplicate]

Can anyone explain me what's this trend of providing passwords and OTP codes on the same service? What benefit or value are they trying to bring to the table? We, as security professionals, have been ...
0
votes
0answers
60 views

Google 2-step authentication using SMS prefixes verification codes with a “G-”. Is that patented? [closed]

Google's 2-step authentication process using SMS sends the one-time verification codes prefixed with a "G-" and Google has the field where the user must then enter the code already prefixed ...
2
votes
2answers
121 views

How is mailbox.org 2FA method referred to as, correctly?

Their 2FA to log in to their web interface requires two things: something you know (PIN); something you have (OTP, generated by app for example). After that, you need to log in by: input email ...
1
vote
1answer
64 views

2FA on Stack Exchange, Where Is It Or What I am Missing?

Not sure if this is the right spot to post this, but I have not been able to find how to enable 2FA (such as authy, MS/google authenticator, yubikey etc...) on stack exchange using email ...
0
votes
0answers
50 views

Protect breached email accounts

We are a big supermarket chain and have had complaints about fraudulent activities from a few customers who have used a particular email domain. We are in the process of implementing MFA on our site. ...
4
votes
0answers
104 views

Is asking the e-banking username/password from a 3rd party site compliant with 3dsecure and PSD2?

Recently I tried to make an online purchase in one of the biggest e-commerce sites in Greece. During checkout, and after providing debit card details, it asked me to provide the username/password (not ...
0
votes
1answer
42 views

2FA with blower.io SMS

I'm currently planning to deploy a project on Heroku and was wondering if it is safe to send 2FA sms messages with the blower.io heroku addon? Also is it safe/ok to send a short lived authentication ...
1
vote
2answers
108 views

OTP vs two-factor

A vendor implements two-factor authentication which requires us to enter a TOTP code generated for example by FreeOTP after user/password. I asked them how it is possible that using two different ...
0
votes
0answers
29 views

OpenVPN certificates vs. SSO with MFA

I am wondering, is using certificates with OpenVPN gives any advantages vs. using SSO with MFA to authenticate to OpenVPN? Are there any disadvantages for combining both?
2
votes
1answer
170 views

Storing 2FA seeds in a password manager [duplicate]

Does it make sense to store the 2FA seeds (i.e: the codes used to generate a time based OTP) in my password manager? If my password manager has a strong password and 2FA using a third-party app, is ...
1
vote
4answers
270 views

Is 2FA a false sense of extra security on a mobile phone?

I understand that 2FA increases security if you are using two different devices, for instance a computer and a mobile phone. I fail to understand how these security measurements help if you are doing ...
0
votes
0answers
101 views

Which 2FA combinations are the most secure going forward (for website authentication)?

I would like to determine which combination of 2FA methods are the most secure, in the context of websites authentication. This also takes into account the usability and convenience of the methods: if ...
0
votes
1answer
52 views

Push button in Security key used for 2FA/MFA

I have come across many security keys from different manufacturers such as solokeys, yubico etc.., for the purposes of 2FA/MFA. Products vary basically w.r.t features such as USB-A, USB-C, Apple ...
1
vote
0answers
34 views

2FA/MFA in a resource-constraint product

I'm working on a resource-constraint product and asked to enable support for MFA/2FA for all maintenance services. Given that MFA/2FA is about using two elements out of three(something you have, know, ...
1
vote
1answer
66 views

Which factor of authentication is an X.509 certificate

Given 3 factors of authentication: Type 1: something you know Type 2: something you have Type 3: something you are Which factor of authentication would be an X.509 certificate, assuming this ...
2
votes
1answer
98 views

How do I add 2FA to my personal computer?

I have a Windows 10 PC that I would like to protect a little better. I've looked for solutions online, but they're all business oriented. What I would like, in an ideal situation, is having to enter ...
0
votes
1answer
40 views

Shared Apple Dev Accounts Two Factor Auth

First off, this may not be the right community. If it's not, I apologize and please close this and point me in the right direction. Apple will start enforcing two-factor authentication for its ...
1
vote
0answers
38 views

How does Authy implement multi-device mode?

This question has been asked previously, here. However, none of the answers there address the question. The accepted answer conflates Authy's multi-device mode with its cloud backup feature. I am ...
0
votes
1answer
75 views

Does fingerprint scanning on Microsoft Authenticator increase security?

tl;dr: I have switched phone and operating system: Android 8.0 --> Android 10.0. Phone restored from backup, so all the remaining is the same except for Microsoft Authenticator that now requires ...
19
votes
7answers
6k views

Don't one-time recovery codes for 2FA introduce a backdoor?

Although using multi-factor authentication is clearly a good move, I'm struggling with the 'one-time recovery codes' concept. It seems to me that if you choose to use them, what you're doing is ...
0
votes
2answers
63 views

It is common for an account to be locked after X amount of failed logins, what are the best practice of selecting x?

To my understanding, it is common security practice to lock the account after X failed login attempts in N minute. Usually, the account will be locked for M minutes. I noticed that most of the time X ...
2
votes
0answers
135 views

Received Google 2FA Code via SMS from two unknown phone numbers [duplicate]

I recently encountered a strange incident regarding the 2FA of my Google Account. The user Dunois has described a very similar occurrence in this post: Functional Google 2FA code (via SMS) received ...
2
votes
2answers
80 views

What to make of inconsistent TFA/2FA verification emails from AOL

My parents use AOL (there's no point trying to migrate them at this stage) with two factor authentication. My father let me know that he recently received an identity log in verification email that ...
1
vote
1answer
62 views

Does this official “Enforce MFA” AWS policy make any sense?

At https://aws.amazon.com/premiumsupport/knowledge-center/mfa-iam-user-aws-cli/ the AWS officially recommends to have this policy { "Sid": "...
4
votes
1answer
5k views

Received a call from +1 202-455-8888 but I did not attempt to log in to my Gmail

I have enabled multi-factor authentication for my Gmail. When I need to log in to my mail, I should enter an OTP which is sent to my phone number. I got a call from this number, even though I did not ...
9
votes
5answers
3k views

Does 2FA Help Prevent Unauthorized Access in Phishing Attacks?

Given Attacker is targeting a user of bank.com. bank.com uses SMS or Google Authenticator 2FA, where the user enters the 2FA code into a form. Scenario Attacker registers domain name baank.com ...
2
votes
2answers
217 views

How can I safely print a keyfile on paper?

I use KeePass with two factors, one being a keyfile. I would like to print the keyfile on a paper for disaster recovery. How can I create a file that is printable on paper in such a way that I can use ...
3
votes
1answer
97 views

How should I share a TOTP shared key with my users?

I want to add one-time passwords as gates for certain important actions in the application I am working on. It is not two-factor authentication, although it may be extended to that use case later. ...
0
votes
0answers
74 views

2 person 2-factor authentication?

I'm trying to build a system as follows: User 1 is a low permission user. They will be using their phone and at some point will need to do a secure action. User 2 is an admin user and will be in the ...
27
votes
9answers
7k views

How does “Somewhere you are” authentication add further security?

In addition to the authentication techniques that are based on “something you have”, “something you know” and “something you are”, authentication techniques that consider “somewhere you are” are also ...
0
votes
1answer
54 views

How does the PIN work in the RSA SecurID phone app?

I use the RSA SecurID phone app to connect to the VPN at my work. I run the app and type a 4 to 8 digit PIN. Then the app gives me a 6 digit code to connect to the VPN. Does the PIN change the result? ...
0
votes
0answers
50 views

Integrating 2FA app into main app

We currently have two distinct apps, one for generating a 2FA token and the other one is the main app. Business is now considering to have only one app left and integrating the authenticator app into ...
0
votes
1answer
106 views

Does Two Factor Authentication (2FA) prevent Phishing and/or Man-in-the-Middle (MITM) attacks?

While 2FA is clearly an improvement over only a single factor, is there anything which prevents an adversary presenting a convincing sign-in page which captures both factors? I realise that ...
0
votes
1answer
98 views

Are hardware security keys (e.g ones supporting Fido2) “able to protect authentication” even in case of compromised hosts?

Correct me if I am wrong, please. I understand that 2FA (MFA) increases account security in case an attacker obtains a password which might be possible via various ways, e.g. phishing, database breach,...
0
votes
1answer
129 views

Is it safe to send verification code in the subject of the email?

I am wondering if it's safe to send the signup, reset password, 6 digit verification code in the subject of the email. Example: "Welcome to the Application, Your verification code is XXXXXX" ...
0
votes
0answers
28 views

Security concerns regarding user self-service MFA reset

Let's say I have an IAM system with a typical MFA feature: TOTP with recovery codes. When users don't have access to their TOTP apps, they can use recovery codes to log in. The IAM system has an admin ...
1
vote
2answers
162 views

2FA authentication with QR code

Can someone confirm if the following solution is actually 2FA? User has to install a special mobile app. When the mobile app is opened for the first time, the user is asked to associate the device ...
0
votes
0answers
32 views

Handling parallel login and Max invalid attempts using OTP with same phone number

I am designing a login system that performs login operation using OTP and Email ID of the registered user. The current approach is as below User enters the Registered Email Id If the Email ID is ...
0
votes
2answers
288 views

Why hasn't push notification authentication replaced SMS for 2FA?

So we use DUO for 2FA at work and it uses push notification authentication as the second factor for 2FA. It's so quick and easy! I enter my username and password, get a push notification on my phone, ...
0
votes
0answers
521 views

(Re)Hacked Instagram accout even if Two Factor authentication was enabled

A friend of mine, let's call her Alice, had an Instagram account that was hacked. She uses an iPhone. The scenario looks like this: Alice gets a link from a Business Account via WhatsApp, and clicks ...
1
vote
0answers
139 views

Is storing an encrypted 2FA backup on Bitwarden (a password manager) a good idea?

I am at the moment using Bitwarden and a separate 2FA app. I am trying to figure out a way to be able to securely recover my access to credentials and 2FA in case my phone/laptop/other electronic ...
1
vote
2answers
71 views

What is the name of the crypto system used by ICANN's DNS recovery system?

I once heard about a type of crypto system that behaves in the following way: I have x secret keys that work together to decrypt messages encrypted with a public key d. If I get at least n of the x ...
0
votes
1answer
60 views

synchronization of keyfob token generator

At work, years ago, I used to have a key-fob device that was about the size of a thumb-drive. It had a 4 digit LCD screen that the numbers changed every 60 seconds. When logging onto certain servers,...
2
votes
1answer
224 views

How does Amazon secure its 6 digit one-time password?

I noticed that Amazon's password reset relies on a 6 digit numeric PIN. Doesn't this reduce every user's account to a 1 in 10^5~ chance of being accessed through brute force guess factoring in a few ...
0
votes
0answers
72 views

Does mobile biometric authentication count as Knowledge, Possession, or Inherence authentication

Apple claims in this year's WWDC that Face ID and Touch ID count for both Possession and Inherence identity factors, because they are using Biometrics (Inherence) to access the secure element on your ...
26
votes
2answers
9k views

What's the point of Microsoft Account 2FA if it still lets me log in using password instead?

I have a Microsoft Account linked to a Microsoft Authenticator app for 2FA purposes. Every time I log in, it first sends me the Authenticator request, but I can always click "Other ways to sign ...
0
votes
1answer
173 views

How often should we force users to re-authenticate when not on the network?

Our company has rolled out MFA to our users. We are a Microsoft shop, so we are using Azure AD to handle MFA and authentication to things like email, Teams, Sharepoint, etc. By default, we've disabled ...
0
votes
3answers
164 views

What is the best practice for resetting multi-factor when a user requests to recover their password?

I am in the process of developing a web-application which requires MFA on every login. (On the first login, before you can do anything, you are forced to setup MFA. Due to monetary restrictions and ...
23
votes
2answers
6k views

What is the risk of having a 2FA key permanently plugged into my device?

Yubico offers the YubiKey Nano, a 2FA key designed to be left inside the device more or less permanently. While it does add comfort to be able to just leave it plugged in, what risks would there be ...
0
votes
0answers
46 views

Dedicated device for online investing and other security measures

I like to invest money online. I invest in both cryptocurrencies as well as regular stocks. As my bankroll grows (let's say 20k+ in the near future), I feel like I need to start taking more serious ...

1
2 3 4 5
12