Questions tagged [multi-factor]

a multi factor authentication requires at least two sets of credentials. This is typically something you know (e. g. a password) and something you own (e. g. a token generator or mobile phone), but could also be something you are (a biometric).

Filter by
Sorted by
Tagged with
0
votes
0answers
33 views

USB token for Java Desktop Application

I would like to integrate the use of a USB token in a JavaFX application that my customers use on a computer I send them. This JavaFX application interacts with a Java/Spring back end. (client-id/...
0
votes
0answers
38 views

SAML and Multi-factor auth

I have an application that is a SAML SP, authenticating users via inbound SAML assertions from some other IdP. If I want to require multi-factor auth, is it a common practice to add multi-factor auth ...
0
votes
0answers
29 views

Why does Apple's 2FA require both a prompt and a code?

When logging into iCloud via the web, a prompt is sent to your phone (with a map showing the origin of the web request). The user can then choose to allow or deny this request. After choosing to allow ...
0
votes
1answer
64 views

2FA: Do app passwords render the second factor invalid?

I am currently in the process of employing a 2FA authentication on as many services as I can. If it is relevant for the question: I use a time-based OTP authenticator app. When setting up, I noticed ...
0
votes
0answers
53 views

Why do GoDaddy customer support representatives ask for two-step verification codes?

When contacting GoDaddy customer service, whether over chat or phone, they often ask for both a PIN and a two-step verification code (which they confusingly refer to as "google auth codes"). Then PIN ...
-1
votes
0answers
52 views

Will 2FA trigger if I log in to by copying cookies

If I set up 2FA on my Facebook account and someone steals my cookies and tries to log in, will 2FA trigger or not?
5
votes
1answer
176 views

Functional Google 2FA code (via SMS) received from a random (but in use) mobile phone number

tl;dr for those who are misunderstanding my post: imagine your friend who uses GMail suddenly tells you they have 2FA enabled, and logged in to their account, and that the 2FA code (SMS) they received ...
6
votes
2answers
2k views

Is phishing ineffective against a Gmail account that has 2FA? [closed]

According to my knowledge, phishing basically only steals the email id and password, right?
3
votes
2answers
179 views

One way authentication vs two-way authentication

I'm studying for the Network+ exam and wanted to understand the difference between one-way authentication and two-way authentication. I've tried searching to no avail. It seems when I search for it ...
1
vote
2answers
190 views

Two factor authentication turned on for my Google account (Phone) - but still hacked

I just got a message today that someone changed my password on my Google account. The email seems legit, and Google confirmed there was a login from Ukraine two weeks ago in recent activity. The ...
0
votes
1answer
42 views

Can I use a mobile passcode login exclusively?

I get absolutely no cell coverage in the building I'm working in, nor do I have access to wifi, so any time I need to use 2-factor authentication, I cannot receive the push request. I've been using ...
0
votes
1answer
61 views

Is there a security problem with having two factor auth running on the same machine that's requesting access?

Searched around and couldn't find a similar question. I've gotten tired of waiting for an 2FA SMS to come every time I check my email. So I got to setting up an app similar to say Google ...
3
votes
1answer
47 views

Push notification - can I use any mobile auth application?

When generating a OTP, I know I can use either Authy or Google Auth, either can scan the code & generate the same OTP. What about push notification? Are Duo/Okta verify and other apps ...
1
vote
1answer
121 views

Is there a reason to change OTP code on every resend attempt?

This question is about OTP codes that are used in flows like Email verification SMS 2fa Usually, when you send an OTP, you want to give the user an option to resend the OTP. Assuming the following ...
0
votes
1answer
50 views

Is there a way to generate a Yubikey OTP without touch?

I'm trying to automate an authentication canary in a workflow that includes a mandatory Yubikey OTP (the 44-character unique password). Is there a way to configure a single Yubikey in such a way that ...
0
votes
1answer
47 views

How can I securely generate secret-sharing/multisig keys on a p2p network?

I am trying to create a peer-to-peer escrow system. I need to encrypt the private key of a wallet with a 2-of-3 secret-sharing function - the buyer, seller, and arbitrator will each have have one key. ...
-1
votes
2answers
57 views

Should a 2FA app require authentication to grant access to 2FA tokens?

I don't know the theoretical background for 2FA so I'm asking here. I've used a few 2FA apps before including Duo Mobile and Steam Mobile (Guard). When Duo is opened, it will display your tokens as ...
3
votes
0answers
48 views

How to add a new webauthn key if the existing one isn't portable

Webauthn supports authentication or multi factor authentication with either hardware keys or authentication features that are built into the device used (Windows Hello, Android with a Fingerprint, ...)...
1
vote
0answers
56 views

How to implement a “Forgot password?” functionality using php-encryption's KeyProtectedByPassword and 2FA?

I'm currently migrating the encryption functionality used in a PHP project from mcrypt (which was deprecated in PHP 7.1.x and no longer works from PHP 7.2 onward) to openssl, using the defuse/php-...
3
votes
1answer
63 views

Password strength when used with 2FA

We have two factor authentication, with passwords and one time code received on SMS. Now normally I know you could restrict users to create passwords with min 8 character length, lower and caps ...
1
vote
1answer
124 views

Can 2FA / MFA be secure & functional in a purely offline state (PWA)?

I'm building a Progressive Web App intended to be used primarily in an offline state. The user can "login" while disconnected, which verifies the password against a locally-stored hash and some other ...
3
votes
1answer
72 views

Is there any reason not to issue 2FA recovery codes?

My ISP give the option of applying 2FA to your account and setting your level of security (from ‘normal’ to ‘paranoid’). However, none of the levels provide 2FA recovery codes. This is the only ...
42
votes
7answers
7k views

Is an SSH key with a passphrase a 2FA?

This is a really theoretical question, but if I use an SSH key with a passphrase to login on a server, could this be considered as a two-factor authentication (2FA)? Indeed, I need the SSH (private) ...
8
votes
2answers
1k views

GMail Hack with 2-Factor Auth enabled

I have my business email on GMail. I use 2-factor authentication for access to said business email. I access my business email from 2 computers and 1 mobile Android device. I do not use Outlook or ...
0
votes
2answers
136 views

How can 2FA be bypassed if I set a number which is unknown to everybody?

I'm asking about the risks one may face for setting 2FA using their own phone number as second step of a 2FA, in scenarios such as, for example, logging in a bank account page with 2FA that provides ...
0
votes
1answer
24 views

Service Provider that requires elevation

Our identities are stored in a separate IdP (Azure AD in this case) and the applications are acting as Service Providers. MFA is triggered based on some rules (based on geoIP etc.). We are now about ...
2
votes
4answers
345 views

Can you set up 2FA with a USB drive?

I want to set up two factor authentication for some of my online accounts. I don't want to install an app, and I don't like using my phone as the physical medium anyway, because it's more likely to ...
63
votes
6answers
9k views

Is 2FA via mobile phone still a good idea when phones are the most exposed device?

Everyone knows that two factors are better than one. My problem is that often the only second factor allowed is text messages sent to your mobile phone. This creates two concerns: I travel frequently ...
0
votes
0answers
13 views

Granting access to mailbox/calendar to another with MFA enabled?

Jane needs access to John's Outlook mailbox and calendar. When Jane attempts to access it (she has his UN & PW) John receives the MFA challenge preventing Jane from accessing it. This works ...
0
votes
1answer
44 views

What protocol is NPS server using to send Secondary Auth to Azure MFA?

We are using PAP to pass data between our on-prem VMware and on-prem NPS server. But our on-prem NPS Server passes data to Azure MFA in the cloud. I want to ensure a stronger protocol than PAP is ...
1
vote
2answers
131 views

What happens when you lose access to the second factor? [duplicate]

Imagine you use your phone number as a second factor to access your e-Mails (e.g. through SMS). What happens if I change phone numbers and then no longer have access to that second factor? Can one ...
0
votes
1answer
50 views

2 Factor Authentication -> When to Request it?

I am wanting to implement 2FA in my application. I am a relatively new developer (~1 year Spring Boot / Android). At the moment, my App uses Spring Security AuthenticationProviders to authenticate a ...
2
votes
0answers
299 views

Can an Android Phone be used as a Windows Hello Security Key?

Microsoft Windows 10 does support physical security keys since some time. Google recently announced that Android phones can be used as security keys as well (primarily for their own services). Is ...
0
votes
0answers
26 views

Is it possible to only receive in-app codes (no text messages) in authy?

I've heard that in-app codes are generally more secure than codes sent over SMS, which can theoretically be intercepted. If this is true, then is there any way to ensure that authy only delivers codes ...
51
votes
5answers
5k views

Should the average user with no special access rights be worried about SMS-based 2FA being theoretically interceptable?

Security experts are constantly discouraging users from using SMS-based 2FA systems, usually because of worries the auth code could be intercepted by an attacker, either through a SIM swap or a MitM ...
3
votes
2answers
245 views

2-step authorization (using SMS) less secure than being without 2FA at all?

I've been thinking about a paradoxical but a theoretically possible event: Even though SMS-based 2-step authorization increases security generally, on the other hand, in some cases, it might become ...
2
votes
1answer
95 views

2FA/MFA and Session management

Background Recently observed researchers reporting bugs related to a situation where a website would not invalidate secondary (separate) active session once 2FA/MFA has been enabled in primary ...
1
vote
3answers
145 views

Are repeated multi-factor authentication codes a problem

The library I am using (ASP.NET Identity) to generate multi-factor authentication (MFA) codes will produce the same code for a given user within a certain period of time. Therefore if the user ...
0
votes
0answers
43 views

Should I offer 'Any n or' or 'n Random' MFA in my webapp, or just 'All MFA'?

I am building a new webapp and I am currently working on the multi factor authentication part. I would like to offer choice when it comes to MFA, and I've been thinking about what choices I can offer. ...
4
votes
1answer
69 views

Generating and securely storing MFA/2FA recovery tokens

I'm trying to implement 2FA on my site, and cannot figure out how to generate and then securely store recovery tokens. From what I've seen, if for whatever reason you cannot MFA (lost your device ...
2
votes
3answers
131 views

Does trusting a device negate the security benefits provided by 2FA?

I have read 2FA adds a beneficial layer of security when logging into accounts. However, many organizations often ask me if I would like to trust the device that I am using permanently so I don't have ...
0
votes
0answers
34 views

Active Directory with multi factor authentication for an existing web application

Customer is asking for LDAP / Active Directory authentication along with OTP (one time password) / multi-factor authentication for an old existing web application written in (asp.net MVC2). Is this ...
0
votes
2answers
68 views

How to authorize user between each step in Multi-Factor-Authentication?

Assume an authentication process that has multiple stages ( eg: username/password then OTP) How you can authorize and identify user between each steps? If JWT tokens are used, is it an option to use ...
1
vote
2answers
231 views

Is it safe to save a screenshot of my QR code?

For MFA I now use Authy (owned by Twilio) instead of Google Authenticator. I find Authy more convenient because it syncs your accounts between several devices and several authy installations which ...
3
votes
0answers
101 views

Is it a good idea to store TOTP tokens in a (synchronised) password safe? [duplicate]

Bitwarden (as an example) allows you to store your TOTP tokens in it. That is: you can use the mobile app to scan the QR code that (e.g.) Amazon AWS gives you, and then it'll generate TOTP codes. So ...
2
votes
4answers
110 views

How to secure VPN credentials on end-user devices?

I have a VPN and PKI in place with MFA. My question is: What's the best method/solution for protecting the integrity and identity of end-user certs? I want to make sure that users only able to use VPN ...
35
votes
6answers
5k views

Should 2FA be enabled on service accounts?

See the title. I'm involved in a security audit right now, and am wondering whether 2FA should be enabled on not just human login accounts but also on service accounts (non-human accounts)? If so, how ...
7
votes
1answer
148 views

TOTP brute force prevention

Lets use Google Authenticator as example. A 6 digit code is generated every 30 second. Each random attempt has 1/1,000,000 chance of success. Server will usually accept code of ±30s which increased ...
1
vote
0answers
19 views

Security of Passwords vs Biometrics [duplicate]

Would a password with multi factor authentication be more secure than biometrics? I am asking due to the fact that if biometric data gets compromised, there is no way to change it, and in data ...
0
votes
1answer
180 views

How I Could Have Hacked Any Instagram Account - The Zero Hack

I am new to the field of security. I thought a lot about the following scenario and could not come up with a good solution 1) Suppose I go to instagram forgot password page. I enter a persons mobile ...

1 2 3 4 5 11