Questions tagged [multi-factor]

a multi factor authentication requires at least two sets of credentials. This is typically something you know (e. g. a password) and something you own (e. g. a token generator or mobile phone), but could also be something you are (a biometric).

Filter by
Sorted by
Tagged with
0
votes
0answers
18 views

Active Directory with multi factor authentication for an existing web application

Customer is asking for LDAP / Active Directory authentication along with OTP (one time password) / multi-factor authentication for an old existing web application written in (asp.net MVC2). Is this ...
0
votes
2answers
52 views

How to authorize user between each step in Multi-Factor-Authentication?

Assume an authentication process that has multiple stages ( eg: username/password then OTP) How you can authorize and identify user between each steps? If JWT tokens are used, is it an option to use ...
1
vote
3answers
362 views

Two factor authentication(Mobile)

Consider such two factor authentication on web site: say when user enters username/password on web site - and receives SMS on mobile phone number. For attacker to access this he must know your ...
55
votes
9answers
50k views

Two-Step vs. Two-Factor Authentication - Is there a difference?

These days, there's pretty much three forms of authentication in general use on the web: Single-factor authentication, e.g.: PIN or password. Two-factor authentication, e.g.: Single-factor plus a ...
4
votes
1answer
1k views

How many authentication factors are there?

The three classes that we all know and love: Something you know. Something you have. Something you are. I've also seen references to "somewhere you are". Is this really a fourth factor? How many ...
4
votes
1answer
1k views

what is a valid challenge for 2 factor authentication?

When designing a password reset process: Is an email address or an assigned username a valid piece of information (identifier) to ask for in two factor authentication? How does two factor ...
3
votes
4answers
843 views

Multi-Single-Factor vs. Multi-Factor Authentication

I was told at university that there exists a difference between the terms Multi Single Factor and Multi-Factor: Multiple single-factor-authenticator are presented to a verifier. Each of them will ...
30
votes
4answers
4k views

How is “something you have” typically defined for “two-factor” authentication?

A wide range of products claim to offer "two-factor authentication" (c.v. Two-factor authentication - Wikipedia). Most are deployed as "something you have" to be used in addition to a normal password ...
1
vote
2answers
170 views

Is it safe to save a screenshot of my QR code?

For MFA I now use Authy (owned by Twilio) instead of Google Authenticator. I find Authy more convenient because it syncs your accounts between several devices and several authy installations which ...
0
votes
1answer
61 views

For two-factor authentication is it a security issue to have phone authentication and Google Titan Security Key?

I am trying to setup my Google account to have some proper security. But I'm finding parts of it confusing. I used to just use my phone as my 2FA device. Where I would get a texted code. Then I ...
9
votes
3answers
790 views

What kind of factor is a physical signature?

I'm familiar with the basics of multi-factor authentication. Now I'm trying to understand how a physical signature, as written on, say, a check or a credit card receipt, would be classified: Is it a ...
3
votes
0answers
42 views

Is it a good idea to store TOTP tokens in a (synchronised) password safe? [duplicate]

Bitwarden (as an example) allows you to store your TOTP tokens in it. That is: you can use the mobile app to scan the QR code that (e.g.) Amazon AWS gives you, and then it'll generate TOTP codes. So ...
2
votes
4answers
93 views

How to secure VPN credentials on end-user devices?

I have a VPN and PKI in place with MFA. My question is: What's the best method/solution for protecting the integrity and identity of end-user certs? I want to make sure that users only able to use VPN ...
35
votes
6answers
4k views

Should 2FA be enabled on service accounts?

See the title. I'm involved in a security audit right now, and am wondering whether 2FA should be enabled on not just human login accounts but also on service accounts (non-human accounts)? If so, how ...
7
votes
1answer
132 views

TOTP brute force prevention

Lets use Google Authenticator as example. A 6 digit code is generated every 30 second. Each random attempt has 1/1,000,000 chance of success. Server will usually accept code of ±30s which increased ...
1
vote
0answers
16 views

Security of Passwords vs Biometrics [duplicate]

Would a password with multi factor authentication be more secure than biometrics? I am asking due to the fact that if biometric data gets compromised, there is no way to change it, and in data ...
1
vote
3answers
167 views

When you enable 2FA, why is your second factor required to reset password?

In a conversation with a coworker the other day, I had trouble successfully defending why, when you enable 2FA on a service, you're required to enter a second factor before changing your password (in, ...
0
votes
2answers
59 views

Disable Office 365 2FA before period of leave without phone?

On enablement of 2FA in Office 365 Admin center, the only offered 2FA methods are Text message Call Notification in Authenticator app Passcode in Authenticator app Obviously, all of them require me ...
0
votes
1answer
151 views

How I Could Have Hacked Any Instagram Account - The Zero Hack

I am new to the field of security. I thought a lot about the following scenario and could not come up with a good solution 1) Suppose I go to instagram forgot password page. I enter a persons mobile ...
2
votes
2answers
48 views

Separate Auth DB for Increased Security

I'm a dev working on an app that has a monolith DB (PostgreSQL). We are using a third party provider for AUTH and MFA, but want to move MFA back into our control. The plan was to move the encrypted ...
0
votes
1answer
65 views

With 2-factor authentication, is a backup email address or phone a good recovery option?

A lot of sites offer 5 or 10 recovery codes as the backup mechanism if the user loses access to their primary 2FA (usually a phone number). Can we just simply use a backup email address instead, or a ...
0
votes
1answer
85 views

Can 2FA keys be duplicated?

I want to order a 2FA key (like yubikey) online and I want to know if someone could make a duplicate of whatever key I order during shipping. I don't want to discuss if someone could access my package....
1
vote
1answer
90 views

Diagram of personal information security vulnerability?

Is there a standard diagram format or language for illustrating a security model and what information is needed to access specific accounts? Something like UML for passwords and 2FA? I was recently ...
0
votes
0answers
41 views

Gmail's MFA for team?

We have mailboxes on G-Suite from Goole. Currently, we are enabling MFA for all boxes in our team, but what boxes which are used by different people? For now, I found a few solutions, each with its ...
0
votes
0answers
41 views

Sufficient to only require 2FA for su elevation?

I have a small web-facing server on my home network. It is headless, and the only way to log in is to ssh with pubkey authentication from within the local network. I wanted to turn on a 2FA ...
54
votes
5answers
25k views

What is a YubiKey and how does it work?

How do YubiKeys work? Are there any alternatives? Here is a picture of one:
0
votes
2answers
789 views

2FA using Kerberos and SSO within CDE

I was wondering if anyone is using Kerberos for their 2FA solution into their CDE for PCI DSS compliance. Also, what does PCI DSS say about SSO once 2FA has occurred through a Radius Server?
1
vote
1answer
73 views

What point in Authenticator App 2FA when SMS fallback is enabled

I would like to move away from SMS 2FA (because of Should 2FA over SMS be considered insecure in the wake of recent SS7 attacks? for example). But some services that provide Authenticator apps ...
2
votes
3answers
104 views

How to provide two factor authentication code text messages, so that they are not shown on the lock screen?

It's a commonly discussed problem that when a service sends an authentication to the user's phone, the code is often displayed in the preview on the lock screen, which means it's visible to anyone who ...
2
votes
1answer
110 views

Best practice for multi-factor re-authentication

We just introduced multi-factor authentication (MFA) to access a remote business network. This has a re-authentication option: to prompt the user to re-enter the password and MFA code periodically. ...
0
votes
0answers
30 views

Azure AD — How to only allow MFA configuration from a trusted network?

Hopefully someone as an idea... In Azure AD, how can we allow MFA setup by a user but only allow that configuration to occur on a trusted network? We have trusted networks defined but everything we ...
9
votes
4answers
4k views

Does IMAP/POP3/ASP undermine Two-Factor Auth?

When I log in to hotmail or Google or posteo I can only log in using the 2FA that I have set up. However, each provider seems to have an alternative for apps that do not auth via a web client. ...
2
votes
0answers
44 views

2FA options for single yubikey and many hosts

I'm considering using yubikey (5 NFC model) as second factor for couple of Linux hosts. I'm interested in sticking it somewhere in PAM stack, so things like sudo are protected. Most of those hosts are ...
1
vote
3answers
242 views

What security benefit does 2FA provide a password manager?

It's no secret that many popular password managers (1Password, Dashlane, LastPass, KeePass, and many others) support some form of two-factor authentication. This is often implemented via TOTP or other ...
6
votes
2answers
1k views

Why is FIDO U2F an entirely different standard from FIDO UAF instead of just a subset?

As you may already be aware, the Universal 2nd Factor (U2F) standard is a standard for 2nd-factor authentication which allows users to authenticate to web applications using a USB hardware token. ...
9
votes
4answers
4k views

Do keyfiles actually add any meaningful security in the presence of strong passwords?

In the context of protecting access to local encrypted files or devices against a determined (and competent) adversary, is there any reason to believe that the use of a key file actually presents a ...
2
votes
1answer
1k views

Remote Registry allows bypass of 2FA enforcement with 1FA

Some organizations will configure their Windows systems to require Smart Cards for all account logins, as part of a two-factor authentication implementation. However, this can easily be bypassed ...
0
votes
1answer
54 views

Securing shared key in TOTP Implementations

I'm currently learning about Time-based One-Time Password implementations (see RFC6283). I see that a shared secret is part of the algorithm. This shared secret is exposed to the user (see example ...
2
votes
1answer
70 views

Are there security advantages to adding an OTP to SSH connections?

Are there any tangible improvements to gain from enabling TOTP (google-authenticator PAM plugin) over existing public key based SSH connections? Does it make security sense to enable TOTP based Two-...
3
votes
0answers
166 views

Can SS7 attacks intercept SMS sent to a Google Voice number?

Hackers are able to steal 2FA SMS messages by exploiting SS7. As far as my understanding goes, this means gaining access to the SS7 system and then broadcasting a message akin to "This number is ...
0
votes
0answers
53 views

User access control and management in AWS Environment

wondering what other SMBs are doing to manage dynamic access requirements for AWS platform. Currently we have 3 IAM roles (admin, dev, readonly) which users can choose after authenticating with https:...
31
votes
6answers
14k views

Why can't I share a one use code with anyone else?

I noticed in some cases when I get a verification code from Google it may say something along the line of: "You should not share this code with anyone else and no one from Google will ever ask for ...
0
votes
1answer
83 views

What should be done if 2FA was turned off in an unexpected manner?

Today when I logged in Facebook, no 2FA was shown. I have been using SMS message as the second authentication factor. When I looked at the security settings, 2FA seemed to be disabled. I immediately ...
0
votes
1answer
144 views

Two Factor Authentication Multiple Devices

Most websites (that I have seen) that implement two factor authentication don't support multiple two factor authentication devices linked to one account. The biggest reasons I can think of for that ...
2
votes
1answer
698 views

TOTP: Storing symmetrical secrets

Is it just me or does TOTP for two factor auth seem like a step back to the days of digest auth where you have to store the symmetrical secret in a reversible manner. Passwords stored in plaintext ...
2
votes
2answers
1k views

How safe is Two Factor Authentication (TOTP)?

If someone gets my phone and saves the values my authenticator generates, will that person be able to find out the shared key (to be used to generate codes themselves)? If so, how many codes will ...
2
votes
1answer
208 views

Is using WebAuthn alone considered as two factor authentication?

Will using WebAuthn for an application make it two factor? I am specifically interested in using Ondevice biometrics and achieve passwordless authentication. For a true two factor authentication you ...
6
votes
4answers
3k views

Best practices for usefully storing two factor authentication backup codes?

For a lot of web services offering two factor authentication, after setting up the system, you are given a short list of backup codes (one-time pads) that are around 7-10 characters long. These are ...
62
votes
2answers
9k views

How are one-time password generators like Google Authenticator different from having two passwords?

Google Authenticator uses the TOTP algorithm to generate your One-Time Password (OTP). TOTP works like this : The server generates a secret key and shares with the client (you) when the client ...
0
votes
1answer
56 views

Preventing account enumeration with 2FA

What are some methods for preventing account enumeration on login when accounts have optional two factor authentication? Without two factor authentication we would just return the same response for ...