a multi factor authentication requires at least two sets of credentials. This is typically something you know (e. g. a password) and something you own (e. g. a token generator or mobile phone)

learn more… | top users | synonyms (1)

5
votes
2answers
323 views

How secure is a password app that stores both the password and two factor secret in one place?

Take for example 1Password, that now can store your password and one time password secret in a single place (your 1Password vault). I know it isn't truly two-factor anymore, but how much better is it ...
0
votes
0answers
8 views

Integrating 2 factor authentication on NAS OS 4 (Lacie 5big) [migrated]

So I am trying to integrate 2 factor authentication through Duo on my Lacie 5big running NAS OS 4 (Seagate). I am not sure if it's really possible to integrate 2fa in a non-destructive way. Instead I ...
6
votes
1answer
49 views

Are Push 2FA methods safe from Android and iOS Malware?

I am doing a survey on various 2FA solutions, and recently I came across “Push” 2FA (e.g Duo Security). In this solution, the site (e.g. a banking site) pushes a notification to the user’s mobile ...
8
votes
5answers
10k views

What are the ways to implement two factor authentication?

We have devices that can generate tokens. So we can use tokens with passwords to perform two factor authentication. There are many ways to implement such systems to enhance security. One of two I ...
0
votes
5answers
664 views

SSH server: What's more secure, pub key auth or Google Authenticator time-based auth?

I'm curious which would be more secure, pub key authentication or 2-factor auth via Google Authenticator. Apparently I can't use both. If I have pub key authentication, the Google Auth PAM module ...
5
votes
2answers
172 views

How to securely store and manage one-time backup codes for 2FA?

I am already using 31 services with 2nd factor authentication and the number is growing. In addition to having multiple authentication devices, I decided for or had to generate a separate set of ...
1
vote
1answer
42 views

2FA: Difference between Storing Backup Codes & Secret Key

First of all, the secret key in discuss is the one when you cannot scan a QR code in a 2FA setup process, there is a code that you can manually entered into your TOTP-generating device/app. Some ...
2
votes
2answers
35 views

Is email OTP improving the security for 2 phase authentication?

There has been similar questions before where people say that using some other means (sms, hardware devices, etc.) is a more secure way to provide 2 factor authentication. Provided we don't have an ...
3
votes
2answers
137 views

Authy: Does multi-device mode imply that all keys are stored on their servers?

My understanding is that if you use Authy, without backups/multi-device options, none of your account keys are stored on their servers. It all resides on your single device. Ie, even if Authy ...
4
votes
6answers
310 views

When should I issue more than one multi-factor device to a user? Is it OK to give several active tokens vs none at all?

Most of the conventional IT.Sec thinking I've seen says that a user can only have one multi factor authentication device. I'd like to challenge that defacto-thinking and ask if there is ever an ...
6
votes
3answers
272 views

Is there any point in using two step authentication if you have strong passwords?

If you are in the habit of using strong passwords (randomly generated by password manager) is there any point in using two step authentication? Assuming that 99% of the time that when you enter a ...
1
vote
1answer
470 views

What regulations *require* multi-factor authentication?

What industries require multi-factor authentication? Please include the following information: Country Industry Regulation name Additional information as you see relevant. Some additional ...
4
votes
0answers
50 views

Can I use a satellite phone for 2 factor auth sms and such?

Would 2 factor authentication SMS messages or other kinds of internet security notifications work with satellite phones? E.g. companies like Google, Paypal, Facebook, banking institutions and others ...
1
vote
2answers
85 views

Does two factor authentication increase the attack surface?

Would adding two factor authentication to an application increase the attack surface of this application? I think it would, since by adding complexity the likelihood of a vulnerability in my ...
27
votes
3answers
26k views

How does HSBC's “Secure Key” actually work?

My bank has recently sent me a Digipass/Secure Key, which looks like a tiny calculator. You press the green button to turn it on, type a PIN to unlock it, then press the green button again to generate ...
25
votes
4answers
7k views
0
votes
1answer
39 views

2 step authentication hybrid

I'm all forward on 2 step authentication. I understand how it is way more secure than a simple password. However I'm always afraid to start using it because I believe that in some cases I could be ...
1
vote
0answers
74 views

Steam two-factor authentication algorithm? [closed]

I'm all on-board that Value is recently pushing for two-factor authentication on Steam accounts. I'm not happy that they force you to use the Steam mobile app because both on iOS and Android, it's a ...
10
votes
3answers
785 views

Steam and two-factor authentication

The Steam platform is designed to encourage users to use two-factor authentication. One of the community tasks (achievement-like objectives) on Steam is "Use the Steam Mobile App for two-factor ...
2
votes
2answers
120 views

What are reasonable alternatives to “Trust this computer” prompts when signing in?

User feedback for a bank authentication website included this comment: It's annoying to get verification codes to my email or phone every time I log in to my Bank account from a new device ...
74
votes
6answers
19k views

How secure are the FIDO U2F tokens

Google and Yubico just announced the availability of cryptographic security tokens following the FIDO U2F specification. Is this just another 2FA option, or is this significantly better than solutions ...
6
votes
1answer
220 views

Using Two-Factor Authentication to Stop Pass-the-Hash

Am looking into mitigations to Pass+the-Hash and Pass-the-Ticket in Active Directory that also improve overall network security, too. Have sorting through some of the many two+factor authentication ...
3
votes
2answers
65 views

Multi-factor authentication - email link

I'm trying to understand possible issues with the approach of sending the MFA one-time-token to the user as a clickable link in the email. Instead of submitting the OTP on the web page, user will ...
4
votes
2answers
96 views

Can Simultaneous Logins Occur When Two Users Have Both Pieces Of Two-Factor Authentication Information?

In a hypothetical situation (say a screen capture program or rootkit, where, incidentally, a password change will not make any difference) where an attacker has both your password, and sees the ...
3
votes
1answer
41 views

Gmail twofactor auth on untrusted computer

Let's say I log in to gmail on untrusted computer using two factor auth in Google Chrome in incognito mode. Hypothetically some virus can read my email after this even without knowing password (.dll ...
1
vote
4answers
71 views

Someone tried to log into my mail - what do I do?

I have a 2-step verification system for both my gmail accounts. Today, I received a message with a code when I wasn't trying to log in. So someone has my password. What's my next step here? What ...
5
votes
3answers
146 views

Does a Smartphone contain all the essential properties of a Smartcard? If not, what is missing?

Can a smartphone, alone, be a valid substitute for a Smartcard? If not, what is missing technically speaking? Does the TPM chipset (which I assume is in the phone) provide enough security to "act ...
5
votes
3answers
248 views

How do Pentesters approach attacking 2FA (two factor authentication)?

I'm looking for practical ways to attack 2FA. What do you need to consider and how would you go about testing the effectiveness of 2FA? My only thoughts are that you would attack the implementation ...
15
votes
1answer
1k views

Do any DNS registrars support multi factor authentication?

I am looking for a DNS registrar that supports strong multi-factor authentication. Does any DNS registrar support multi-factor? Is this a legitimate need?
8
votes
5answers
309 views

Two passwords provide better security than two-factor authentication?

While evaluating 1Password's new Teams service, I noticed rather curious absence of support for multifactor authentication. When asked about the lack of MFA, they replied: We use an Account Key ...
1
vote
2answers
75 views

Importance of Lastpass User Vaults Statement and Two-Factor Authentication

The Lastpass breach statement reassures folks who had two-factor authentication enabled and recommends it for all users. I also note that they explain that there is no evidence that the encrypted user ...
3
votes
1answer
46 views

Can two TOTP clients register at the same time and generate the same tokens?

Note that I'm not talking about systems like Authy, where you can log in to your account on multiple devices and sync your tokens between them -- I'm referring to two completely separate devices that ...
22
votes
13answers
4k views

Why do we even use passwords / passphrases next to biometrics?

In the last couple of days there were a lot of talking about passwords and passphrases, not only here, but on several blogs and forums I follow (especially after XKCD #936 saw the light of this ...
72
votes
2answers
11k views

How did someone log-in to my Gmail account from Kenya?

While on holiday in France in May I received an email from Google "New sign-in". Your Google Account was just used to sign in: Nairobi, Kenya. Tuesday, 26 May 2015 22:10 (East Africa Time). ...
4
votes
1answer
161 views

YubiKey or Google authenticator?

I'm using lastpass and I would like to implement a 2FA in my account, but I don't know which one is the most secure, a software authenticator such as google authenticator or an USB device as Yubikey. ...
2
votes
1answer
74 views

OTP on the same device being used to login

I've seen mobile apps use two factor authentication by sending an SMS to the mobile phone. However, if I've stolen someone's phone, where is the security advantage? I can understand it if it's used in ...
2
votes
1answer
93 views

Why is the 2nd step in two-step authentication not a single click? [closed]

The case I'm using Google 2-Step Verification. The question Why does Google use a code as second step? Why not just an android app where you can click "It's me"?
8
votes
3answers
242 views

What advantage does the Bloomberg authentication system have over traditional 2 factor?

Bloomberg clients have an interesting way to authenticate to the server. This seems involve some of the following: Logging into a secure website, that displays a flashing square Swiping your finger ...
3
votes
1answer
91 views

Storing base passwords in Lastpass

After watching Mr Robot I finally motivated myself to setup two factor authenitication for Lastpass with Yubikey. Fastmail is the second service I've set up with my Yubikey. I changed my main ...
2
votes
4answers
117 views

Justifying strong 1st factor in the context of multi factor authentication — beyond passwords

I am wondering if you need strong 1st factor (for theoretical correctness, please note it is the knowledge factor -- not necessarily a password, but definitely also includes strong passwords)? What ...
2
votes
1answer
84 views

What happens when authenticating through a phishing attack with FIDO U2F tokens

So I have looked around and haven't found this anywhere. What happens when the response server is a phishing site with FIDO U2F tokens? Basically, if login just fails, I would assume that the user ...
1
vote
1answer
73 views

Google account 2FA only with HW security key?

Is it possible to configure 2FA access to a Google account using only HW security key (e.g. Yubikey) without verification SMS code option ? It seems that SMS confirmation code is still primary 2FA ...
6
votes
6answers
985 views

Isn't it less secure to use something you are for authentication?

I have to think of this everyday when I close the doors of the shop I work in: A year ago we used to close the shop and arm the alarm using a key fob. This means the worst case scenario was that I ...
11
votes
6answers
5k views

Is tokenless (specifically SMS) 2FA a security compromise over OTP tokens?

I've been looking into the various pros/cons of tokenless (particularly SMS based) and traditional token based two-factor authentication (think RSA SecurID). After doing some research, I think I have ...
0
votes
1answer
384 views

Two factor authentication for web application under PCI DSS

PCI DSS 8.3 is stated as follows 8.3 Incorporate two-factor authentication for remote network access originating from outside the network by personnel (including users and administrators) and ...
3
votes
2answers
125 views

Is Google 2-factor “Remember this Computer” secure against adversaries with root access?

This question concerns the type of 2-factor authentication implemented by Google Accounts. The response to this question describes securing transfer of the secret key via a secure cookie. But what ...
5
votes
3answers
179 views

2-Factor Authentication vs Security Questions

I have an account with a bank that has additional security option. When it does not recognize a device being used to access the account, it will either: Prompt with 1 of 3 security questions Send a ...
2
votes
2answers
182 views

Why do popular sites like Google, Dropbox, etc. have a “trust this computer” checkbox when it weakens security?

Let's say someone is logging onto Dropbox in the library, but the computer has a keylogger on it that steals their password. Fortunately, they are using two factor authentication, which could have ...
3
votes
1answer
117 views

Are “Security SMS codes” any safer than plain SMS?

Many banking webapps send this kind of SMS, for their 2FA systems. These messages do not appear in the main "Messages" app, seemingly being destroyed after viewing - at least on iOS. Firstly, are ...
5
votes
1answer
129 views

How long does 2-factor authentication codes have to be?

I've noticed that from a (personal) UX point of view, 4 numbers which my online banking uses seems to be a sweet spot in terms of holding it in my head from looking at my phone to typing it it. But ...