a multi factor authentication requires at least two sets of credentials. This is typically something you know (e. g. a password) and something you own (e. g. a token generator or mobile phone)

learn more… | top users | synonyms

1
vote
1answer
66 views

LastPass authentication grid hacked on June 15?

I wonder how safe LastPass's grid authentication is. I take it that they have a copy of the authentication grid on their server. You are supposed to print the grid and carry it with you to any device ...
0
votes
1answer
40 views

Importance of Lastpass User Vaults Statement and Two-Factor Authentication

The Lastpass breach statement reassures folks who had two-factor authentication enabled and recommends it for all users. I also note that they explain that there is no evidence that the encrypted user ...
1
vote
1answer
37 views

Justifying strong 1st factor in the context of multi factor authentication — beyond passwords

I am wondering if you need strong 1st factor (for theoretical correctness, please note it is the knowledge factor -- not necessarily a password, but definitely also includes strong passwords)? What ...
0
votes
2answers
41 views

Does using a token and a pin for logging into a corporate internal system removes the need for using regular user names and passwords?

I am evaluating an internal 2 factor authentication implementation in an organization. The system designer wants to remove regular user names and passwords from all user workstations such that each ...
1
vote
0answers
35 views

What happens when authenticating through a phishing attack with FIDO U2F tokens

So I have looked around and haven't found this anywhere. What happens when the response server is a phishing site with FIDO U2F tokens? Basically, if login just fails, I would assume that the user ...
5
votes
1answer
143 views

How secure is CertiVox M-PIN?

CertiVox have designed a system with the aim of "getting rid of passwords". Essentially the system authenticates users with two factors of authentication: A 4 digit PIN and a token stored within the ...
6
votes
1answer
209 views

How to fix a repeatedly hacked gmail account (where 2FA is enabled and passwords are changed)?

A friend of mine came to me for help with this issues. Her Gmail account has been hacked and keeps sending out spam emails to her contacts. This is happening to her on a monthly basis. Each time it ...
2
votes
1answer
103 views

How safe is Two Factor Authentication (TOTP)?

If someone gets my phone and saves the values my authenticator generates, will that person be able to find out the shared key, which he/she will be able to generate codes himself/herself? If so, how ...
1
vote
3answers
85 views

Securing a secondary login page for inputting a multi-factor auth token

I would like to implement the following use case: User lands on the login page User submits login credentials Credentials are validated and they are redirected to another page for inputting the ...
1
vote
3answers
55 views

Will having 2FA protect me on a potentially insecure network?

Whenever I browse to a Google site on my Library's network, I get this screen: Presumably this is so they can "protect" children (anyone with a library card who is under 13) from unsafe videos as ...
3
votes
2answers
124 views

Is there any point in using two step authentication if you have strong passwords?

If you are in the habit of using strong passwords (randomly generated by password manager) is there any point in using two step authentication? Assuming that 99% of the time that when you enter a ...
3
votes
1answer
41 views

Securing 2 factor data from apps that are co-located on the same device?

Several apps such as GMail, Coinbase, Yahoo and others require the use of the mobile device to gain access to the data within the app. For example Gmail requires TOTP in Google Authenticator ...
0
votes
0answers
40 views

Additional security for services hosted on a 2FA or Multi-Factor Authenticated Network

I am aiming to lock down a web service that accesses other services and has a publicly facing UI. I have a hosted service on a network that requires 2-factor authentication to access. This service's ...
0
votes
1answer
70 views

How Google Authenticator in Android mobile identifies this is the right SSH server?

I am new to Google Authenticator mechanism. I gone the basics of mechanism but I couldn't understood what logic behind that to make a connection to the Linux machine. I have a Linux which have no ...
0
votes
3answers
117 views

Two factor authentication(Mobile)

Consider such two factor authentication on web site: say when user enters username/password on web site - and receives SMS on mobile phone number. For attacker to access this he must know your ...
0
votes
3answers
145 views

What is a good way to authenticate a user to websites and applications with a smart phone?

What would be a good way to authenticate a user to authenticate to websites and applications over a smart phone? By good, I mean that it is both secure, and user-friendly. Passwords don't seem to be ...
2
votes
1answer
216 views

How secure is a password app that stores both the password and two factor secret in one place?

Take for example 1Password, that now can store your password and one time password secret in a single place (your 1Password vault). I know it isn't truly two-factor anymore, but how much better is it ...
1
vote
0answers
182 views

Soft tokens - multiple profiles on same smartphone

Some of our clients have started migrating to soft tokens instead of hardware ones for two-factor authentication to their network. We have apps like RSA SecurID and VIP Access on our smartphones. The ...
0
votes
1answer
168 views

IP whitelisting as two factor authentication method for server access under PCI DSS

In the answer to my question: Two factor authentication for web application under PCI DSS gowenfawr stated: I have seen other methods used for 2FA than those you mention; IP whitelisting and ...
0
votes
1answer
115 views

Two factor authentication for web application under PCI DSS

PCI DSS 8.2 is stated as follows 8.2 In addition to assigning a unique ID, ensure proper user-authentication management for non-consumer users and administrators on all system components by ...
2
votes
1answer
64 views

Is it sensible to use application password bypassing two factor authentication? [duplicate]

I discovered that some applications (like Sylpheed) seems unable to support two factor authentication. Google has a feature called application passwords - a separate password that "grants complete ...
0
votes
1answer
183 views

Revoke and regeneration in FIDO U2F / FIDO UAF

One of the benefits of using Software based Strong Authentication apps (e.g. RSA SecurID Software Tokens) is that if the device that is running the Token generation app is compromised or lost, the ID ...
1
vote
1answer
212 views

Best practices for usefully storing two factor authentication backup codes?

For a lot of web services offering two factor authentication, after setting up the system, you are given a short list of backup codes (one-time pads) that are around 7-10 characters long. These are ...
4
votes
3answers
152 views

2-factor authentication - Who am I trusting?

I'm confused about the risks of 2-factor authentication. I'm a developer, who has to do some ops, and considering turning it on for my DigitalOcean and GitHub accounts. Both offer TOTP(?) and ...
2
votes
0answers
141 views

Remote Registry allows bypass of 2FA enforcement with 1FA

Some organizations will configure their Windows systems to require Smart Cards for all account logins, as part of a two-factor authentication implementation. However, this can easily be bypassed ...
3
votes
1answer
756 views

what is a valid challenge for 2 factor authentication?

When designing password reset process: 1- Is a an email address or an assigned username a valid piece of information ( identifier) to ask for in two factor authentication? 2- How does two factor ...
0
votes
1answer
266 views

What are the pros and cons of enabling 2 factor authentication on internal user workstations of an organization?

An organization has all the regular controls you can think of for network and systems protection from the 10 security domains. External login access to the organization's services is protected with 2 ...
3
votes
2answers
100 views

Should a 2FA recovery key be stored along with a password?

Many websites give you a recovery key or a list of recovery codes that can be used in place of 2FA tokens if you lose your phone or can't access your token generator. What are the recommended ...
0
votes
1answer
77 views

Are 2FA soft-tokens flawed if the user can log into the website from the same mobile device?

If I'm using something like Authy for soft tokens for my users, and they log into the web application on the mobile device itself, haven't they just lost the benefit of 2FA (ie loss of the mobile ...
19
votes
4answers
2k views

Why use a Smartcard for (Two Factor) Auth instead of another medium?

I recently installed Bitlocker on my Windows 8.1 machine, using only a password. I was thinking of getting something other than just a password for my storage drive, something physical, like a USB, SD ...
1
vote
1answer
67 views

Is selecting trusted computer in 2-step verification less secure?

In using 2-step verification, does selecting 'Trusted Computer' a less secure options? https://support.google.com/accounts/answer/2544838?hl=en If so, is it still a reasonably secure option?
6
votes
1answer
1k views

What are the differences between the U2F and UAF FIDO authentication standards?

Google recently announced support for Universal 2nd Factor (U2F) authentication in Chrome and started allowing that authentication mechanism to be used for 2-factor authentication across their various ...
0
votes
5answers
399 views

SSH server: What's more secure, pub key auth or Google Authenticator time-based auth?

I'm curious which would be more secure, pub key authentication or 2-factor auth via Google Authenticator. Apparently I can't use both. If I have pub key authentication, the Google Auth PAM module ...
37
votes
4answers
11k views

How secure are the FIDO U2F tokens

Google and Yubico just announced the availability of cryptographic security tokens following the FIDO U2F specification. Is this just another 2FA option, or is this significantly better than solutions ...
-1
votes
1answer
52 views

Can OTP 2FA be reversibly determined?

Please note: I'm not necessarily talking about what happens when one shoulder surfs someone inputting a OTP. I'm fairly confident that it's nearly impossible (or extremely impractical) to guess the ...
10
votes
1answer
492 views

Yubikeys & SSH - which option is best for lockdown?

My company has a few dozen servers hosted on a cloud provider. All but one (OpenVPN host) is closed to the internet. We're using OpenVPN AS which uses certs + Google Authenticator for login. We are ...
57
votes
6answers
7k views

Four-factor authentication

I'm sure you've all heard of two-factor/multi-factor authentication. Basically it comes down to these factors: Knowledge - something you know (e.g. password, PIN, pattern) Possession - something you ...
9
votes
4answers
292 views

What kind of factor is a physical signature?

I'm familiar with the basics of multi-factor authentication. Now I'm trying to understand how a physical signature, as written on, say, a check or a credit card receipt, would be classified: Is it ...
2
votes
2answers
113 views

Where can 2-factor fail in Google?

I was one of the people who thought that enabling 2-factor in Apple would have prevented the download of images from iCloud; it was recently pointed out to me that, in fact, I was gravely mistaken. ...
14
votes
6answers
1k views

Additional security benefits from Multi-Factor Authentication?

Does multi-factor authentication provide any additional security benefits on top of doing a better job at correctly identifying and authenticating users compared to single factor authentication? In ...
9
votes
5answers
812 views

Is a biometric eye scan more secure than a multi-factor authentication

I have come across the following question in a Security+ exam guide You are tasked with creating a high-security authentication system for physical access control to a military installation. Which ...
0
votes
2answers
119 views

Are there any flaws in my design for a paper-based OTP grid?

I'm trying to implement two-factor authentication on the cheap for a website of mine. My bank uses this sort of grid-based OTP system, so I wanted to emulate it in my application: Cards are ...
2
votes
2answers
301 views

How can LastPass enforce 2-factor authentication

I've recently started using LastPass and one of the things you can set as a policy for you password vault is Prevent offline access when using Google Authenticator. The local cache can be ...
3
votes
1answer
414 views

Do non-browser clients work around Gmail's 2-factor authentication?

If you use a client like mutt to access your mail, you probably know that it doesn't support 2-factor authentication. It still prompts only for a password - either your account password or, in the ...
1
vote
0answers
84 views

Generating backup codes for a 2FA implementation

I have implemented the login/verification aspect of a two factor auth system as per RFC 6238. It works fine with Google Authenticator, which is great. Now I am turning my attention to the backup ...
0
votes
1answer
37 views

How VIP card helps in verification? [duplicate]

How does the 6 digit randomly generated security code from (disconnected) Verisign Identity Protection card help in verification/validation of any user? Why one cannot enter any random 6 digit ...
3
votes
3answers
246 views

Is login limiting still needed if we employ multi-factor authentication?

The status quo is that most online websites limit login attempts per IP address, or even per account since some attackers possess huge amounts of IP addresses. OWASP declares: When multi-factor ...
2
votes
1answer
50 views

Does RADIUS allow for eventual, gradual adoption of 2 Factor auth in an AD Environment?

We have several applications that leverage AD SAML (via Ping Federate) LDAP authentication from 3rd party applications Windows workstation / Exchange auth (Kerberos) IIS and web components ...
2
votes
3answers
178 views

Multi-factor auth: implementing a “don't ask again for this computer” function

Many sites that support multi-factor authentication provide a "do not ask me again for this computer" option. I'm hoping to gain some insight into how this feature could best be implemented. My ...
0
votes
2answers
261 views

Creating port-specific SSH authentication for the same user

I have a Linux server running SSHD and would like to know if its possible to configure it, such that from within the LAN you only need a RSA key to authenticate (on port X), but from outside the LAN ...