Questions tagged [multi-factor]

a multi factor authentication requires at least two sets of credentials. This is typically something you know (e. g. a password) and something you own (e. g. a token generator or mobile phone), but could also be something you are (a biometric).

54
votes
5answers
24k views

What is a YubiKey and how does it work?

How do YubiKeys work? Are there any alternatives? Here is a picture of one:
0
votes
2answers
765 views

2FA using Kerberos and SSO within CDE

I was wondering if anyone is using Kerberos for their 2FA solution into their CDE for PCI DSS compliance. Also, what does PCI DSS say about SSO once 2FA has occurred through a Radius Server?
1
vote
1answer
58 views

What point in Authenticator App 2FA when SMS fallback is enabled

I would like to move away from SMS 2FA (because of Should 2FA over SMS be considered insecure in the wake of recent SS7 attacks? for example). But some services that provide Authenticator apps ...
2
votes
3answers
93 views

How to provide two factor authentication code text messages, so that they are not shown on the lock screen?

It's a commonly discussed problem that when a service sends an authentication to the user's phone, the code is often displayed in the preview on the lock screen, which means it's visible to anyone who ...
2
votes
1answer
101 views

Best practice for multi-factor re-authentication

We just introduced multi-factor authentication (MFA) to access a remote business network. This has a re-authentication option: to prompt the user to re-enter the password and MFA code periodically. ...
0
votes
0answers
25 views

Azure AD — How to only allow MFA configuration from a trusted network?

Hopefully someone as an idea... In Azure AD, how can we allow MFA setup by a user but only allow that configuration to occur on a trusted network? We have trusted networks defined but everything we ...
9
votes
4answers
4k views

Does IMAP/POP3/ASP undermine Two-Factor Auth?

When I log in to hotmail or Google or posteo I can only log in using the 2FA that I have set up. However, each provider seems to have an alternative for apps that do not auth via a web client. ...
2
votes
0answers
41 views

2FA options for single yubikey and many hosts

I'm considering using yubikey (5 NFC model) as second factor for couple of Linux hosts. I'm interested in sticking it somewhere in PAM stack, so things like sudo are protected. Most of those hosts are ...
1
vote
3answers
211 views

What security benefit does 2FA provide a password manager?

It's no secret that many popular password managers (1Password, Dashlane, LastPass, KeePass, and many others) support some form of two-factor authentication. This is often implemented via TOTP or other ...
6
votes
2answers
1k views

Why is FIDO U2F an entirely different standard from FIDO UAF instead of just a subset?

As you may already be aware, the Universal 2nd Factor (U2F) standard is a standard for 2nd-factor authentication which allows users to authenticate to web applications using a USB hardware token. ...
9
votes
4answers
4k views

Do keyfiles actually add any meaningful security in the presence of strong passwords?

In the context of protecting access to local encrypted files or devices against a determined (and competent) adversary, is there any reason to believe that the use of a key file actually presents a ...
2
votes
1answer
1k views

Remote Registry allows bypass of 2FA enforcement with 1FA

Some organizations will configure their Windows systems to require Smart Cards for all account logins, as part of a two-factor authentication implementation. However, this can easily be bypassed ...
0
votes
1answer
49 views

Securing shared key in TOTP Implementations

I'm currently learning about Time-based One-Time Password implementations (see RFC6283). I see that a shared secret is part of the algorithm. This shared secret is exposed to the user (see example ...
2
votes
1answer
69 views

Are there security advantages to adding an OTP to SSH connections?

Are there any tangible improvements to gain from enabling TOTP (google-authenticator PAM plugin) over existing public key based SSH connections? Does it make security sense to enable TOTP based Two-...
3
votes
0answers
124 views

Can SS7 attacks intercept SMS sent to a Google Voice number?

Hackers are able to steal 2FA SMS messages by exploiting SS7. As far as my understanding goes, this means gaining access to the SS7 system and then broadcasting a message akin to "This number is ...
0
votes
0answers
37 views

User access control and management in AWS Environment

wondering what other SMBs are doing to manage dynamic access requirements for AWS platform. Currently we have 3 IAM roles (admin, dev, readonly) which users can choose after authenticating with https:...
31
votes
6answers
14k views

Why can't I share a one use code with anyone else?

I noticed in some cases when I get a verification code from Google it may say something along the line of: "You should not share this code with anyone else and no one from Google will ever ask for ...
0
votes
1answer
82 views

What should be done if 2FA was turned off in an unexpected manner?

Today when I logged in Facebook, no 2FA was shown. I have been using SMS message as the second authentication factor. When I looked at the security settings, 2FA seemed to be disabled. I immediately ...
0
votes
1answer
93 views

Two Factor Authentication Multiple Devices

Most websites (that I have seen) that implement two factor authentication don't support multiple two factor authentication devices linked to one account. The biggest reasons I can think of for that ...
2
votes
1answer
662 views

TOTP: Storing symmetrical secrets

Is it just me or does TOTP for two factor auth seem like a step back to the days of digest auth where you have to store the symmetrical secret in a reversible manner. Passwords stored in plaintext ...
2
votes
2answers
1k views

How safe is Two Factor Authentication (TOTP)?

If someone gets my phone and saves the values my authenticator generates, will that person be able to find out the shared key (to be used to generate codes themselves)? If so, how many codes will ...
1
vote
1answer
195 views

Is using WebAuthn alone considered as two factor authentication?

Will using WebAuthn for an application make it two factor? I am specifically interested in using Ondevice biometrics and achieve passwordless authentication. For a true two factor authentication you ...
6
votes
4answers
2k views

Best practices for usefully storing two factor authentication backup codes?

For a lot of web services offering two factor authentication, after setting up the system, you are given a short list of backup codes (one-time pads) that are around 7-10 characters long. These are ...
62
votes
2answers
9k views

How are one-time password generators like Google Authenticator different from having two passwords?

Google Authenticator uses the TOTP algorithm to generate your One-Time Password (OTP). TOTP works like this : The server generates a secret key and shares with the client (you) when the client ...
0
votes
1answer
45 views

Preventing account enumeration with 2FA

What are some methods for preventing account enumeration on login when accounts have optional two factor authentication? Without two factor authentication we would just return the same response for ...
5
votes
1answer
285 views

​Multi-factor Out of Band Token authentication options suitable as per NIST recommendations 800-63B (published in June, 2017)

In our web application project we are required to establish MF authentication with combination of memorised secret token (password) and Out of Bound token. Earlier we were planning to implement SMS ...
2
votes
1answer
123 views

Two factor authentication and plausible deniability for disk encryption

Can you prove, for the most common disk encryption programs like Veracrypt or LUKS/dmcrypt, that a second factor like a yubikey or a keyfile on a USB disk is required? If this is not the case is there ...
4
votes
3answers
1k views

AWS S3 and 2-factor (multifactor)

I have a client looking to use AWS S3 buckets for file transfer to other clients. That data may have some sort of protected data in it. I'd like to set up S3 to use 2-factor or MFA for the login/...
0
votes
1answer
48 views

Need help on 2FA QRcode security

In reference to OTP 2FA Auth apps: I'm trying to understand the concept of the QRcode being more secure in-transit than SMS? Is it because the QRcode itself is not of any value to fraudulent ...
2
votes
2answers
208 views

Web Application Using Identity Federation & OTP

We are running a web application using a client's identity federation to authenticate users. A new requirement is to use 2FA, we have decided to use an OTP algorithm using Java, similar to this one ...
5
votes
1answer
528 views

Are Authy's tokens insecure?

I've been trying out Authy, a Google Authenticator alternative with an optional feature of being able to back up your tokens. They have two types of tokens: Authy-generated tokens and the regular OTP ...
8
votes
2answers
255 views

Why use one-time codes for two-factor authentication backups?

I am building an web application that uses two-factor authentication. While implementing the recovery feature, I see that most companies (eg Apple, Facebook, Github) provide a set of ~15 backup codes,...
9
votes
1answer
430 views

PSD2 compliant two factor authentication

According to PSD2 the elements of the multi-factor authentication must be independent so the compromise of one element does not compromise the other. Here is the article from the directive: *...
1
vote
1answer
50 views

Multi Factor and order of authentication [duplicate]

I'm questionning the design and architecture around 2FA/MFA controls while authenticating to services and servers. On major platforms(*), the end-user is: first prompted for credentials (username/...
1
vote
1answer
60 views

MFA for multiple accounts?

We are thinking about enabling 2FA with Google Authenficator for all our services. But the only concern for me now is that users will have to have a dedicated Authenticator's account for every ...
3
votes
1answer
483 views

In the context of FIDO U2F, when is a new ephemeral key reused, or cached?

I'm reading this paper from Yubico on Universal Second Factor and OpenID Connect and see the description about ephemeral keys I'm confused on when a ephemeral key is used, and under what conditions ...
5
votes
2answers
381 views

Best practices for handling wrong TOTP tokens

Assume a 2FA system with user-supplied passwords and 6 digit TOTP tokens. It is not possible to test a TOTP token without authenticating with a password first, so whoever submits a token is presumed ...
0
votes
1answer
82 views

Does FIDO2 token works as two-factor on password-less authentication?

As authentication factors, I know the following You are (e.g. Biometrics) You have (e.g. USB) You know (e.g. Password) If I use a FIDO2 certified fingerprint reader for password-less authentication ...
0
votes
1answer
36 views

Disable Office 365 2FA before period of leave without phone?

On enablement of 2FA in Office 365 Admin center, the only offered 2FA methods are Text message Call Notification in Authenticator app Passcode in Authenticator app Obviously, all of them require me ...
0
votes
1answer
81 views

Two Factor Authentication Secret Storage

I found this NPM package that looks like can be used to verify two factor authentication for websites, and also generating tokens for signing into other websites. In the README there is a section ...
2
votes
2answers
150 views

Does 2-Factor Authentication protect against malware?

My question has to do with whether 2-Factor Authentication protects against a compromised system (malware). There are a couple of scenarios in which I wonder whether it does: Every time you login to ...
1
vote
1answer
94 views

What attack vector is prevented by using the 'coupling code'?

In The Netherlands, one can access government services using a login platform called DigID. Some services require a two factor authentication, for which one can use a mobile app. This requires the ...
0
votes
0answers
18 views

Is password + laptop a multiple factor authentication? [duplicate]

The definition according to Wikipedia: Multi-factor authentication (MFA) is an authentication method in which a computer user is granted access only after successfully presenting two or more ...
46
votes
8answers
10k views

Force user to remove USB token

I'm looking at setting up secure laptops using BitLocker with pre-boot PIN and startup key. I'm wondering if there is a way to force the user, who is remote, to remove the USB with the startup key ...
0
votes
1answer
43 views

Impact on required password entropy when introducing two-factor authentication [duplicate]

Is there a best practice or rule of thumb for the impact of introducting two-factor authentication on the required entropy of a used password? Say we consider 80 bits of entropy to be sufficient for ...
6
votes
1answer
1k views

2FA: Difference between Storing Backup Codes & Secret Key

First of all, the secret key in discuss is defined as when you cannot scan a QR code in a 2FA setup process, there is a code that you can manually enter into your TOTP-generating device/app. Some ...
-1
votes
1answer
46 views

Security issues with 2-Step Verification Using SMS - Am I missing any vulnerabilities?

In order to increase security on sensitive data, I want to add 2-Step Authentication, using SMS. Note, this would be used on a website that should never have more than perhaps 30 users. I'm ...
2
votes
1answer
168 views

Why does Microsoft Authenticator app ask me to choose a number?

I've got the Microsoft Authenticator app installed on my Google Pixel phone. When I sign into a Microsoft site, the site shows me a two-digit number (e.g. 34) and the app on my phone asks me to choose ...
0
votes
1answer
38 views

What are the risks when using QR to authenticate when using offline MFA in cases network is unavailable due to a network outage

if the PingID service is unreachable the user will receive a QR code on an offline authentication screen. in case of Offline MFA when the network is unavailable due to a network outage (i.e. in an ...
55
votes
9answers
49k views

Two-Step vs. Two-Factor Authentication - Is there a difference?

These days, there's pretty much three forms of authentication in general use on the web: Single-factor authentication, e.g.: PIN or password. Two-factor authentication, e.g.: Single-factor plus a ...