Questions tagged [multi-factor]

a multi factor authentication requires at least two sets of credentials. This is typically something you know (e. g. a password) and something you own (e. g. a token generator or mobile phone), but could also be something you are (a biometric).

Filter by
Sorted by
Tagged with
0
votes
1answer
85 views

2 Factor Authentication -> When to Request it?

I am wanting to implement 2FA in my application. I am a relatively new developer (~1 year Spring Boot / Android). At the moment, my App uses Spring Security AuthenticationProviders to authenticate a ...
0
votes
1answer
85 views

Why make it difficult to disable MFA tokens?

Some websites make it easy to enrol multiple TOTP apps at the same time but make it difficult to disable these apps. For instance, the user would have to completely reset the MFA settings instead of ...
2
votes
1answer
63 views

How does Amazon secure its 6 digit one-time password?

I noticed that Amazon's password reset relies on a 6 digit numeric PIN. Doesn't this reduce every user's account to a 1 in 10^5~ chance of being accessed through brute force guess factoring in a few ...
9
votes
4answers
3k views

How does LastPass' grid multi-factor authentication work behind the scenes?

I understand how to use the Grid multi-factor authentication as a user but how does it work technically? Specifically how can just a few letters from the grid be enough to decrypt any secret defined ...
0
votes
0answers
52 views

Does mobile biometric authentication count as Knowledge, Possession, or Inherence authentication

Apple claims in this year's WWDC that Face ID and Touch ID count for both Possession and Inherence identity factors, because they are using Biometrics (Inherence) to access the secure element on your ...
24
votes
2answers
9k views

What's the point of Microsoft Account 2FA if it still lets me log in using password instead?

I have a Microsoft Account linked to a Microsoft Authenticator app for 2FA purposes. Every time I log in, it first sends me the Authenticator request, but I can always click "Other ways to sign ...
0
votes
3answers
92 views

What is the best practice for resetting multi-factor when a user requests to recover their password?

I am in the process of developing a web-application which requires MFA on every login. (On the first login, before you can do anything, you are forced to setup MFA. Due to monetary restrictions and ...
1
vote
1answer
59 views

How often should we force users to re-authenticate when not on the network?

Our company has rolled out MFA to our users. We are a Microsoft shop, so we are using Azure AD to handle MFA and authentication to things like email, Teams, Sharepoint, etc. By default, we've disabled ...
21
votes
2answers
6k views

What is the risk of having a 2FA key permanently plugged into my device?

Yubico offers the YubiKey Nano, a 2FA key designed to be left inside the device more or less permanently. While it does add comfort to be able to just leave it plugged in, what risks would there be ...
0
votes
0answers
39 views

Dedicated device for online investing and other security measures

I like to invest money online. I invest in both cryptocurrencies as well as regular stocks. As my bankroll grows (let's say 20k+ in the near future), I feel like I need to start taking more serious ...
1
vote
2answers
58 views

two-factor authentication suffix code in the password

In many sites where 2FA is enabled, the login flow is: A form asking for username/password If credentials are valid a new form asks for the verification code. However, there are some implementations ...
1
vote
1answer
105 views

If someone steals my unencrypted, password protected laptop, would they be able to get into my Google account?

I have a laptop with Ubuntu 20.04 operating system. I am logged into my Chrome browser using my Google account. This means, every time I open my browser, I am already logged into all the Google ...
1
vote
1answer
37 views

Should a service indicate the usage of multi-factor authentication by a user for building trust?

We all know that MFA done right can greatly increase the security of an online identity. There are services around with a fundamental trust problem among the users. For example online market places ...
0
votes
0answers
26 views

If someone stole my symantec VIP credential ID, would they be able to generate the same one-time passcode as the app does?

Let's say I've installed the Symantec VIP app on my device. If someone stole my Symantec VIP credential ID, would they be able to generate the same one-time passcode (OTP) as the app does?
2
votes
2answers
85 views

prevent/prohibit duplication of MFA software-token / ensure user identity

As I was unable to find any thread about this particular question, I'm trying to ask the community for help. We're currently using RSA RADIUS based 2FA to authenticate external VPN users from ...
0
votes
1answer
48 views

What are Security Considerations of Using File Upload/Comparison as Simplified Second Factor?

I am evaluating the idea of simplified second factor authentication by requiring a file to be uploaded, such as an image along with username/password. The file is stored on a user's device. My ...
2
votes
2answers
68 views

How to store MFA secret

I have an online application that I'm adding MFA to, using the Google / Microsoft Authenticator apps for mobile phones. I've tried to adopt a security focussed approach to storing the MFA secret and ...
45
votes
7answers
8k views

Is an SSH key with a passphrase a 2FA?

This is a really theoretical question, but if I use an SSH key with a passphrase to login on a server, could this be considered as a two-factor authentication (2FA)? Indeed, I need the SSH (private) ...
0
votes
1answer
56 views

How can I securely generate secret-sharing/multisig keys on a p2p network?

I am trying to create a peer-to-peer escrow system. I need to encrypt the private key of a wallet with a 2-of-3 secret-sharing function - the buyer, seller, and arbitrator will each have have one key. ...
0
votes
0answers
41 views

Is using traditional 2FA codes a prerequisite for using U2F FIDO key in Dashlane/1Password?

Over the past few weeks, I have spent a lot of time thinking about how to structure my security plan based on a password manager, just two/three strong master passwords and the use of physical U2F ...
8
votes
2answers
3k views

How does password reset work if 2FA is enabled?

(There is a highly related question, however I believe mine is not a duplicate, since it deals with resetting a password without access to the account, not changing it while being logged in.) Say ...
0
votes
1answer
35 views

Risks associated with a compromised external Security token server

Consider the following architecture: An on premise Web API 2 [Written in C# hosted in IIS] which uses OAuth 2 authentication [ Implicit Flow ] to secure itself. This API acts as the data source by ...
2
votes
1answer
274 views

Is using WebAuthn alone considered as two factor authentication?

Will using WebAuthn for an application make it two factor? I am specifically interested in using Ondevice biometrics and achieve passwordless authentication. For a true two factor authentication you ...
5
votes
1answer
367 views

​Multi-factor Out of Band Token authentication options suitable as per NIST recommendations 800-63B (published in June, 2017)

In our web application project we are required to establish MF authentication with combination of memorised secret token (password) and Out of Bound token. Earlier we were planning to implement SMS ...
1
vote
0answers
28 views

MFA: can unique biometrics collecting device count as another authentication factor (a possession factor)?

I see in this answer (Aren't endpoint devices inherently MFA?) that an endpoint device doesn't qualify as an authentication factor (AF). But if the endpoint biometric collecting device is uniquely ...
129
votes
6answers
45k views

How secure are the FIDO U2F tokens

Google and Yubico just announced the availability of cryptographic security tokens following the FIDO U2F specification. Is this just another 2FA option, or is this significantly better than solutions ...
2
votes
2answers
254 views

Web Application Using Identity Federation & OTP

We are running a web application using a client's identity federation to authenticate users. A new requirement is to use 2FA, we have decided to use an OTP algorithm using Java, similar to this one ...
0
votes
0answers
50 views

Blockchain 2FA by sms (wallet code) secure (hack)?

To keep a long story short, I got hacked on my PC by downloading and executing a wrong file. Programs as InterVPN, Cryptobot and HVNC (told by the hacker via google chat) were installed. My accounts (...
0
votes
1answer
50 views

Could IMAP authentication be adapted to support 2FA?

Theoretically? (If no, why? And if yes, why hasn't it been done?)
0
votes
0answers
38 views

Can bad software/web app architecture compromise my 2FA key?

So this is a two part question: 1) When I have a compartmentalized system, and then I use the same hardware 2FA key for 2FA across all compartments, can my hardware key be used to trace me through ...
0
votes
2answers
101 views

2FA: Do app passwords render the second factor invalid?

I am currently in the process of employing a 2FA authentication on as many services as I can. If it is relevant for the question: I use a time-based OTP authenticator app. When setting up, I noticed ...
0
votes
1answer
86 views

For two-factor authentication is it a security issue to have phone authentication and Google Titan Security Key?

I am trying to setup my Google account to have some proper security. But I'm finding parts of it confusing. I used to just use my phone as my 2FA device. Where I would get a texted code. Then I ...
1
vote
1answer
109 views

A proposal for effortless two-factor authentication

I have an idea for device-level two-factor authentication that involves no direct input from the user, and I wanted to find out if something like it has been tried before. Let's say I have an account ...
3
votes
2answers
268 views

2-step authorization (using SMS) is less secure than having 2-factor disabled at all!

I've been thinking about this subject, and found paradoxical truth. Having a service that has 2-step authorization using SMS might become more harmful and open vulnerability hole (read SMS can be ...
0
votes
0answers
30 views

Doesn't installing a TOTP client on your primary PC undermine the whole point of 2FA? [duplicate]

Authy is a popular cross-platform TOTP application that supports syncing keys across devices. I have been a little confused by the idea of having a desktop client... This way if someone accesses my ...
0
votes
1answer
60 views

What protocol is NPS server using to send Secondary Auth to Azure MFA?

We are using PAP to pass data between our on-prem VMware and on-prem NPS server. But our on-prem NPS Server passes data to Azure MFA in the cloud. I want to ensure a stronger protocol than PAP is ...
1
vote
1answer
109 views

What attack vector is prevented by using the 'coupling code'?

In The Netherlands, one can access government services using a login platform called DigID. Some services require a two factor authentication, for which one can use a mobile app. This requires the ...
8
votes
1answer
234 views

Functional Google 2FA code (via SMS) received from a random (but in use) mobile phone number

tl;dr for those who are misunderstanding my post: imagine your friend who uses GMail suddenly tells you they have 2FA enabled, and logged in to their account, and that the 2FA code (SMS) they received ...
1
vote
2answers
2k views

MFA for Windows 7 [closed]

My organisation is hoping to implement MFA for Windows. Our end users are generally not permitted to have their cellphones on them which means that many of these MFA apps cannot be used. We've tried ...
-2
votes
1answer
120 views

Attacks that ByPass Multifactor Authentication (Necrobrowser in Office 365) [closed]

I added MFA to Office 365, but a security specialist says it can be defeated with NecroBrowser, which can capture and transmit an already MFA-authenticated cookie. I can't find any specifics about ...
1
vote
1answer
86 views

2-factor authentication can be misused?

I was trying to access my account on an e-commerce website but I couldn't get my password right. So, the website offered me the option to authenticate using my security code from Google Authenticator ...
1
vote
2answers
120 views

Is there a way to “lock” a YubiKey after a period of inactivity?

I have a YubiKey 5c nano attached to my laptop used for 2FA, etc. It works great and is unobtrusive, but I feel like the small form factor encourages leaving it plugged into the laptop all the time, ...
1
vote
3answers
125 views

Is it safe and permissive to remember devices to skip two factor authentication when dealing with sensitive information?

We're a small UK startup building a small service that allows certain special people (e.g. journalists) to access non-public court information. This information includes a ton of private and ...
0
votes
1answer
112 views

Yahoo! Mail logging in with 2FA code only

I came across a serious issue with Yahoo! Mail that I hope someone would help to fix or raise awareness for. I wanted to create an account on Yahoo! Mail. I entered my phone number to the Yahoo! ...
5
votes
0answers
86 views

Is there a standard for OTPs tied to transaction details (that has been implemented in apps/devices)?

There are standards for Time-based (TOTP) and Counter-based (HOTP) One Time Password schemes. Generated OTPs are independent of the transactions they are used for, such as authorizing a login or a ...
0
votes
0answers
50 views

USB token for Java Desktop Application

I would like to integrate the use of a USB token in a JavaFX application that my customers use on a computer I send them. This JavaFX application interacts with a Java/Spring back end. (client-id/...
7
votes
3answers
1k views

How secure is a password app that stores both the password and two factor secret in one place?

Take for example 1Password, that now can store your password and one time password secret in a single place (your 1Password vault). I know it isn't truly two-factor anymore, but how much better is it ...
0
votes
0answers
45 views

SAML and Multi-factor auth

I have an application that is a SAML SP, authenticating users via inbound SAML assertions from some other IdP. If I want to require multi-factor auth, is it a common practice to add multi-factor auth ...
0
votes
0answers
31 views

Why does Apple's 2FA require both a prompt and a code?

When logging into iCloud via the web, a prompt is sent to your phone (with a map showing the origin of the web request). The user can then choose to allow or deny this request. After choosing to allow ...
0
votes
0answers
63 views

Why do GoDaddy customer support representatives ask for two-step verification codes?

When contacting GoDaddy customer service, whether over chat or phone, they often ask for both a PIN and a two-step verification code (which they confusingly refer to as "google auth codes"). Then PIN ...

1
2 3 4 5
11