Questions tagged [multi-factor]

a multi factor authentication requires at least two sets of credentials. This is typically something you know (e. g. a password) and something you own (e. g. a token generator or mobile phone), but could also be something you are (a biometric).

40 questions with no upvoted or accepted answers
Filter by
Sorted by
Tagged with
13
votes
1answer
811 views

Are Authy's SMS tokens insecure?

I've been trying out Authy, a Google Authenticator alternative with an optional feature of being able to back up your tokens. They have two types of tokens: Authy-generated tokens and the regular OTP ...
5
votes
1answer
334 views

​Multi-factor Out of Band Token authentication options suitable as per NIST recommendations 800-63B (published in June, 2017)

In our web application project we are required to establish MF authentication with combination of memorised secret token (password) and Out of Bound token. Earlier we were planning to implement SMS ...
3
votes
0answers
247 views

Can SS7 attacks intercept SMS sent to a Google Voice number?

Hackers are able to steal 2FA SMS messages by exploiting SS7. As far as my understanding goes, this means gaining access to the SS7 system and then broadcasting a message akin to "This number is ...
3
votes
0answers
201 views

U2F FIDO sends identifiable serial numbers

As all of the FIDO Alliance documents state, the FIDO U2F protocols should never be able to abused to identify whether a user has multiple accounts with one service, or for services to collude and ...
2
votes
0answers
38 views

How to add a new webauthn key if the existing one isn't portable

Webauthn supports authentication or multi factor authentication with either hardware keys or authentication features that are built into the device used (Windows Hello, Android with a Fingerprint, ...)...
2
votes
0answers
177 views

Can an Android Phone be used as a Windows Hello Security Key?

Microsoft Windows 10 does support physical security keys since some time. Google recently announced that Android phones can be used as security keys as well (primarily for their own services). Is ...
2
votes
0answers
50 views

2FA options for single yubikey and many hosts

I'm considering using yubikey (5 NFC model) as second factor for couple of Linux hosts. I'm interested in sticking it somewhere in PAM stack, so things like sudo are protected. Most of those hosts are ...
2
votes
1answer
235 views

Is using WebAuthn alone considered as two factor authentication?

Will using WebAuthn for an application make it two factor? I am specifically interested in using Ondevice biometrics and achieve passwordless authentication. For a true two factor authentication you ...
2
votes
0answers
39 views

Protecting private keys of common chat applications with 2FA

Say a user uses a common chat application like Telegram, Signal, Whatsapp, Ricochet. His device gets hacked and private keys get stolen. For normal PGP usage with email you can use two factor ...
2
votes
2answers
234 views

Web Application Using Identity Federation & OTP

We are running a web application using a client's identity federation to authenticate users. A new requirement is to use 2FA, we have decided to use an OTP algorithm using Java, similar to this one ...
2
votes
0answers
74 views

How can I go about securing services that require SMS tokens as backups?

I use 2FA on all services that support it. I generate backup codes and store them in a secure encrypted location. Most services unfortunately require a SMS backup, which represents a security issue as ...
2
votes
0answers
123 views

Why does Gmail have separate form for backup codes?

When I log into Gmail with 2 factor authentication, I enter my username and password and get taken to a page asking me to enter a security code sent to a phone. If I enter a backup code into this form ...
2
votes
0answers
377 views

Why bother with security measures when IBAN is all it takes to transfer money from my account?

I have just learned that in Germany you pay online by providing your IBAN. In other words, anyone to whom I have sent money and therefore has my IBAN can extract money from my account. Apparently, the ...
1
vote
0answers
37 views

How to implement a “Forgot password?” functionality using php-encryption's KeyProtectedByPassword and 2FA?

I'm currently migrating the encryption functionality used in a PHP project from mcrypt (which was deprecated in PHP 7.1.x and no longer works from PHP 7.2 onward) to openssl, using the defuse/php-...
1
vote
0answers
51 views

How to enforce E-mail Account Security with regards to Custom Domains & 2FA?

Lately I've been bothered by the fact that should one of my e-mail accounts be in some way compromised despite its long and randomized password phrase. I'd have hell to pay since it is effectively a ...
1
vote
0answers
729 views

OpenVPN use auth-user-pass with a file and authenticator

I have an open vpn configuration with the lines auth-user-pass my-login-creds.conf static-challenge "Enter Google Authenticator Code" 1 in it. When I try to connect with openvpn my-config.ovpn I ...
1
vote
0answers
43 views

Multi-factor asking condition

It is an established fact that the error message of login pages should not specify wether the password or the id is the problem. But for an application with multi factor authentication, should we ask ...
1
vote
0answers
57 views

Regarding 2 factor authentication and adding new devices. Which one of these is safer?

Let's say I have a mobile device with google authenticator which uses TOTP, which I use everytime to log in into my personal accounts. If I want to add a second device. I would need to have access to ...
1
vote
0answers
4k views

Soft tokens - multiple profiles on same smartphone

Some of our clients have started migrating to soft tokens instead of hardware ones for two-factor authentication to their network. We have apps like RSA SecurID and VIP Access on our smartphones. The ...
0
votes
0answers
14 views

Service Provider that requires elevation

Our identities are stored in a separate IdP (Azure AD in this case) and the applications are acting as Service Providers. MFA is triggered based on some rules (based on geoIP etc.). We are now about ...
0
votes
0answers
12 views

Granting access to mailbox/calendar to another with MFA enabled?

Jane needs access to John's Outlook mailbox and calendar. When Jane attempts to access it (she has his UN & PW) John receives the MFA challenge preventing Jane from accessing it. This works ...
0
votes
1answer
33 views

What protocol is NPS server using to send Secondary Auth to Azure MFA?

We are using PAP to pass data between our on-prem VMware and on-prem NPS server. But our on-prem NPS Server passes data to Azure MFA in the cloud. I want to ensure a stronger protocol than PAP is ...
0
votes
0answers
34 views

2 Factor Authentication -> When to Request it?

I am wanting to implement 2FA in my application. I am a relatively new developer (~1 year Spring Boot / Android). At the moment, my App uses Spring Security AuthenticationProviders to authenticate a ...
0
votes
0answers
25 views

Is it possible to only receive in-app codes (no text messages) in authy?

I've heard that in-app codes are generally more secure than codes sent over SMS, which can theoretically be intercepted. If this is true, then is there any way to ensure that authy only delivers codes ...
0
votes
0answers
42 views

Should I offer 'Any n or' or 'n Random' MFA in my webapp, or just 'All MFA'?

I am building a new webapp and I am currently working on the multi factor authentication part. I would like to offer choice when it comes to MFA, and I've been thinking about what choices I can offer. ...
0
votes
0answers
31 views

Active Directory with multi factor authentication for an existing web application

Customer is asking for LDAP / Active Directory authentication along with OTP (one time password) / multi-factor authentication for an old existing web application written in (asp.net MVC2). Is this ...
0
votes
1answer
63 views

For two-factor authentication is it a security issue to have phone authentication and Google Titan Security Key?

I am trying to setup my Google account to have some proper security. But I'm finding parts of it confusing. I used to just use my phone as my 2FA device. Where I would get a texted code. Then I ...
0
votes
0answers
44 views

Gmail's MFA for team?

We have mailboxes on G-Suite from Goole. Currently, we are enabling MFA for all boxes in our team, but what boxes which are used by different people? For now, I found a few solutions, each with its ...
0
votes
0answers
48 views

Sufficient to only require 2FA for su elevation?

I have a small web-facing server on my home network. It is headless, and the only way to log in is to ssh with pubkey authentication from within the local network. I wanted to turn on a 2FA ...
0
votes
0answers
34 views

Azure AD — How to only allow MFA configuration from a trusted network?

Hopefully someone as an idea... In Azure AD, how can we allow MFA setup by a user but only allow that configuration to occur on a trusted network? We have trusted networks defined but everything we ...
0
votes
0answers
53 views

User access control and management in AWS Environment

wondering what other SMBs are doing to manage dynamic access requirements for AWS platform. Currently we have 3 IAM roles (admin, dev, readonly) which users can choose after authenticating with https:...
0
votes
1answer
272 views

Two Factor Authentication Multiple Devices

Most websites (that I have seen) that implement two factor authentication don't support multiple two factor authentication devices linked to one account. The biggest reasons I can think of for that ...
0
votes
0answers
528 views

Two-factor authentication on Galaxy Watch - should secrets be encrypted, and is this SQLite example secure?

I recently got a Galaxy Watch and to get acquainted with developing apps for it I'm writing a simple two factor authenticator to generate TOTP codes from entered secrets using the Google Authenticator ...
0
votes
1answer
108 views

What should be done if 2FA was turned off in an unexpected manner?

Today when I logged in Facebook, no 2FA was shown. I have been using SMS message as the second authentication factor. When I looked at the security settings, 2FA seemed to be disabled. I immediately ...
0
votes
0answers
55 views

Leaking information about 2FA status

I was asked to provide a public web interface which is given an email addresses (which belong to our users) for public clients (e.g. a web application or native mobile application) whether or not a ...
0
votes
0answers
518 views

What are the security consequences of allowing 2FA app (Google Authenticator) to display the seed?

Excuse me if my question is a little bit convoluted. I prefer to share the full story, background information, so that accidentally I'm not asking XY question. Background info I'm using 2FA pretty ...
0
votes
1answer
78 views

Protecting third-party credentials in a web database in light of weak passwords

I need to store third party credentials in a database for a web application. The third party supports OAUTH and I plan on getting a long-lived token to allow my app to access the third party, but I ...
0
votes
2answers
81 views

Can you use Google's authenticator app when Google “makes sure that you’re really you”?

I've heard that you can configure your Google account to use its (more secure) authenticator app rather than sending you a text message - in my most recent case, this was when Google sent me a text ...
-1
votes
2answers
144 views

Is it a good idea to have a new laptop just to generate 2FA keys?

I am very concerned about people putting keyloggers or trojans on my computer. That can happen because I use my computers for many things. Work. Playing games. Watching movies. Accessing many ...
-1
votes
1answer
135 views

What is optimal way to connect accounts to 2FA on phone?

I have Google Acc 0 (GAO) mostly for bank porpoises and some "official" services. This email basically "surname.name@google.com" and I put in my old C.V. and some other contact information. When I got ...