Stack Exchange Network

Stack Exchange network consists of 174 Q&A communities including Stack Overflow, the largest, most trusted online community for developers to learn, share their knowledge, and build their careers.

Visit Stack Exchange
Join us in building a kind, collaborative learning community via our updated Code of Conduct.

a multi factor authentication requires at least two sets of credentials. This is typically something you know (e. g. a password) and something you own (e. g. a token generator or mobile phone), but could also be something you are (a biometric).

0
votes
0answers
27 views

OpenVPN use auth-user-pass with a file and authenticator

I have an open vpn configuration with the lines auth-user-pass my-login-creds.conf static-challenge "Enter Google Authenticator Code" 1 in it. When I try to connect with openvpn my-config.ovpn I ...
1
vote
2answers
69 views

Combining a fingerprint scan and password for 2-factor-authentication [closed]

UPDATE: I found the answer to the "How To?" part of my question on superuser: Require Fingerprint AND Password/Pin for Windows Logon Is it possible to require a TOTP on Windows Login using existing ...
0
votes
1answer
38 views

Authy reviewed?

Authy looks like a great solution - especially for laymen, in order to simplify complexities - but I have some nagging concerns re privacy & security, especially when sensitive data is hosted "on ...
0
votes
1answer
55 views

Are Authy's tokens insecure?

I've been trying out Authy, a Google Authenticator alternative with an optional feature of being able to back up your tokens. They have two types of tokens: Authy-generated tokens and the regular OTP ...
3
votes
1answer
137 views

SMS based 2FA intercepts

Reddit just revealed that they experienced a security breach as a result of an intercepted SMS based 2FA. Another post on SMS 2FA refers to flaw in the telecom’s ss7 protocol that was used to perform ...
2
votes
0answers
30 views

Protecting private keys of common chat applications with 2FA

Say a user uses a common chat application like Telegram, Signal, Whatsapp, Ricochet. His device gets hacked and private keys get stolen. For normal PGP usage with email you can use two factor ...
6
votes
1answer
134 views

Why use one-time codes for two-factor authentication backups?

I am building an web application that uses two-factor authentication. While implementing the recovery feature, I see that most companies (eg Apple, Facebook, Github) provide a set of ~15 backup codes,...
0
votes
1answer
42 views

Do account recovery options defeat stronger 2-factor authentication?

2-factor authentication (2FA) is encouraged in order to reduce the risk of an account being compromised since the attacker has to know more than just your password. There are many ways to deploy 2FA, ...
0
votes
0answers
40 views

Leaking information about 2FA status

I was asked to provide a public web interface which is given an email addresses (which belong to our users) for public clients (e.g. a web application or native mobile application) whether or not a ...
1
vote
0answers
64 views

Hardware-based password manager with per-password verification [closed]

I'm looking for a device to perform hardware password management very similarly to the Trezor, shown here, commonly used as a wallet for cryptocurrencies. Unfortunately, the Trezor only stores a ...
1
vote
3answers
166 views

How do websites protect against 2fa replay attacks?

I'm imagining a scenario where an attacker can read traffic between a user and a server. The attacker grabs the user's password and the 2fa code they used. The attacker then logs in with that ...
0
votes
2answers
90 views

How does google know if I am logging in from a new machine(using web browser)? [duplicate]

Every time i sign into my google account on a web browser on a new machine, it warns me of suspicious activity. How does google know its a new machine? I am trying to implement a similar thing for my ...
1
vote
3answers
81 views

Sharing 2FA tokens

A company I work for wants to share a login to a sensitive application. The application unfortunately does not support multiple users, so a username / password combo is shared between several people ...
1
vote
1answer
96 views

SMS OTP as 2FA - should there be sms session id in sms for user's verification?

Several times I saw SMS 2FA implementation when a web site shows "sms session id" (say, 8 digits token) right after sending sms to user together with OTP prompt. Sms comes with OTP (say, 4 digits) and ...
0
votes
2answers
97 views

Help to review 2FA algorithm

First of all, I know, don't reinvent the wheel... But there's a good reason for this. So I have been implementing a generic 2 factor authentication code generation/validation algorithm in order to re-...
3
votes
1answer
65 views

Duo Security forgot password workflow

I'm updating my company's forgot password workflow. Currently we use Duo Security as our second factor on login (but for the purposes of my question this can be any such service). I've been walking ...
22
votes
4answers
542 views

Bank asked for a cross login?

I was creating a new bank account here in the US at HSBC's popular online bank... You know the step where you have to verify the account you're sending from, by receiving two small test payments? I ...
2
votes
4answers
123 views

Does a two-factor authentication dongle (OTP) which is always inserted in MacBook add a security benefit?

I think to get a Yubikey and read that Keepass with OTP makes no sense No. Security remains the same + extra cognitive overhead. I try to store all data local and use seldom cloud based services. If ...
1
vote
0answers
34 views

Multi-factor asking condition

It is an established fact that the error message of login pages should not specify wether the password or the id is the problem. But for an application with multi factor authentication, should we ask ...
0
votes
1answer
37 views

How much entropy is required for a Grid Card?

We're in the process of implementing multifactor authentification. One good candidate for this was the "Grid Card" - a small table with random letters and digits. Upon login, the user would be queried ...
3
votes
0answers
62 views

U2F FIDO sends identifiable serial numbers

As all of the FIDO Alliance documents state, the FIDO U2F protocols should never be able to abused to identify whether a user has multiple accounts with one service, or for services to collude and ...
1
vote
1answer
163 views

Maximum tries for 2FA code?

I am building a website and I am implementing two factor authentication (2FA). The second factor will be a random 6 digit code like those from Authy. This site will store very confidential information....
2
votes
1answer
56 views

Why not authenticate with the user sending an SMS?

Every time I do 2-factor authentication on a mobile app, it sends me a message with a security code. I understand this is weak because the SMS system can be hacked to redirect your messages to another ...
3
votes
1answer
70 views

Google Authenticator - Showing someone my code [duplicate]

I want to create a video. During the video I need to login in to some website. I will use the one-time code from my google authenticator app. Is it safe to show this one-time code to the people or ...
7
votes
3answers
716 views

How does entering “a” phone number help Google “verify it's me?”

Today I tried to sign into my Google account while at university. Google blocked the attempt, and asked for a phone number. Below is a screenshot of the form Google showed me. It says: Verify it's ...
1
vote
1answer
55 views

Two factor authentication vs. user experience

I'm wondering if there's any reason to implement a username/password with 2FA or, from the user's perspective, just settle with a username/2FA code. I'm trying to seek a healthy balance between the ...
1
vote
4answers
617 views

Hardware-Based Password Manager

Folks, I'm trying to improve my password management, and I have a vision in mind for a solution. However, I'm having a problem putting it all together or finding a product(s) that fits. First I ...
2
votes
1answer
124 views

Does Time-based One Time Password improves security in case of database leak?

From what I understand, Time-based One Time Passwords used a seed and a mathematical algorithm to generate unique passwords. As the seed is known by the user (or the device used by the user), and the ...
1
vote
1answer
163 views

How to share “secure” account credential with my spouse?

Not sure if this is the right place to ask, but here goes: My spouse and I have 20-ish or so accounts (retirement, investment, banks, insurances, tax, etc.) where I would we both would like to have ...
1
vote
1answer
52 views

What kind of attacks are mitigated by 2FA/MFA in Industry sector?

I would like to understand the real role of 2-Factor Authentication in Industry Control Systems like SCADA/SmartGrid with Windows AD infrastructure. In particular I am interested in an operational use ...
0
votes
3answers
49 views

Can one factor be used multiple times in multi factor authentication?

Is it mandatory in MFA that the factors should be (1) something you have + (2) something you know + (3) something you are, or it is okay to use any single of two factors multiple times (e.g. password ...
-1
votes
2answers
95 views

Does multi-factor authentication make tracking/fingerprinting easier?

Is multi-factor authentication a privacy risk? Does it make tracking/fingerprinting easier? It was seem so because whoever is accepting the OTP could track and record every OTP request and metadata ...
0
votes
1answer
34 views

Algorithms for 2FA over HTTPS?

I'm developing an Authenticator App for use towards my own API. I know about the TOTP standard RFC 6238 and the HOTP variant. Though I would prefer to use a public/private key based solution (by only ...
0
votes
1answer
101 views

Is just PIN and password without any hardware token considered to be 2FA?

When using online internet banking, I have to use my 6 digit pin and a password to authenticate into the system. There is no hardware token used in this example. Is this considered as 2 Factor ...
0
votes
2answers
502 views

Is Paypal's 2FA Security really this bad? [closed]

I'm by now means an expert in this field, or even well versed, but if it's possible to do this, I can't comprehend how Paypal allows it. Say you have 2 factor authentication on, with your phone setup ...
1
vote
2answers
94 views

Web Application Using Identity Federation & OTP

We are running a web application using a client's identity federation to authenticate users. A new requirement is to use 2FA, we have decided to use an OTP algorithm using Java, similar to this one ...
0
votes
1answer
30 views

With uploading to AppStores - what problem do all the certificates fix above Two Step Authorization?

So if you ask around on the internet you see a lot of people frustrated with the whole signing and certificate jungle when trying to upload apps to the App Store. Of course on this channel for a lot ...
17
votes
2answers
4k views

Is there a way to prevent hackers from using cookies to bypass two step verification?

Let's take Steam/Google/FB/Microsoft/Twitter logins as examples. All of them offer two step verification through SMS message. Let's say the hacker does not have access to my phone. But he has access ...
0
votes
1answer
51 views

Could a session id be considered as a valid factor in 2FA?

As is stated in this question: Two-factor or multi factor authentication is based on three possible forms of authentication: Something you know which is considered secret (password) ...
-2
votes
1answer
72 views

What is the most private option for 2FA with OpenSSH?

When I watch the logs on my server there are always many hundred IP addresses with failed ssh logins. Because fail2ban only slows the attack process down, I decided that I need another solution. ...
4
votes
1answer
526 views

Storing TOTP secret in database, plaintext or encrypted?

I've been reading about 2FA and how it's used, and the thing that struck me most is that everyone seems to be storing the TOTP secret as plaintext in their database. I understand you need the secret ...
0
votes
2answers
69 views

Why is Multifactor Authentation Presented in Two Steps Instead of One [duplicate]

When I use Google Authenticator two-factor authentication, Google will tell me if I get my password wrong before prompting me for an authentication code. This goes against at least one intuitive line ...
4
votes
4answers
447 views

Phone number setup for security

Several Q&As here highlight the danger of phone hacking. For example, this. In a nutshell, the solution is to NOT give your phone number, except to your bank or government. Unfortunately, that ...
2
votes
5answers
660 views

How secure is this two factor authentication?

I am working on an App that has a login page with a field for username and password, if the password is entered correctly it then asks for the users pin (4-digit code). My question, does having a pin ...
5
votes
3answers
144 views

Why don't most banks in the UK use 2FA?

Common UK banks such as Halifax rely on internet banking which consists of a username, password and then picking several characters from a drop down list? Why is this more secure than using a ...
5
votes
1answer
175 views

Yubikey Desktop Authenticator

Would you say it is more secure to use Yubikey Desktop Authenticator than Google Authenticator? Instead of using Google Authenticator every time I want to login to some site I am wondering if it ...
0
votes
0answers
37 views

Multi-factor authentication for web requests that preserves identity

I'm trying to determine how multi-factor authentication (e.g., fingerprints, iris scans, voice recognition, etc.) can be used to authenticate users to web servers within an organization while ...
0
votes
2answers
70 views

Can you use Google's authenticator app when Google “makes sure that you’re really you”?

I've heard that you can configure your Google account to use its (more secure) authenticator app rather than sending you a text message - in my most recent case, this was when Google sent me a text ...
2
votes
2answers
740 views

How to implement 2FA without user phone

I have a problem: users share their credentials with other users. I have to create a way to ensure that users are using their own credentials to access the system. I think creating a 2 factor ...
30
votes
4answers
6k views

How can a website verify that my phone number belongs to me?

I was signing into a Capital One credit card website that I hadn't used in a long time, and once I entered my user name and password, it requested my mobile phone number for additional verification. ...