Questions tagged [multi-factor]

a multi factor authentication requires at least two sets of credentials. This is typically something you know (e. g. a password) and something you own (e. g. a token generator or mobile phone), but could also be something you are (a biometric).

54 questions with no upvoted or accepted answers
Filter by
Sorted by
Tagged with
5
votes
0answers
88 views

Is there a standard for OTPs tied to transaction details (that has been implemented in apps/devices)?

There are standards for Time-based (TOTP) and Counter-based (HOTP) One Time Password schemes. Generated OTPs are independent of the transactions they are used for, such as authorizing a login or a ...
5
votes
1answer
371 views

​Multi-factor Out of Band Token authentication options suitable as per NIST recommendations 800-63B (published in June, 2017)

In our web application project we are required to establish MF authentication with combination of memorised secret token (password) and Out of Bound token. Earlier we were planning to implement SMS ...
4
votes
0answers
258 views

U2F FIDO sends identifiable serial numbers

As all of the FIDO Alliance documents state, the FIDO U2F protocols should never be able to abused to identify whether a user has multiple accounts with one service, or for services to collude and ...
3
votes
0answers
52 views

How to add a new webauthn key if the existing one isn't portable

Webauthn supports authentication or multi factor authentication with either hardware keys or authentication features that are built into the device used (Windows Hello, Android with a Fingerprint, ...)...
3
votes
0answers
354 views

Can SS7 attacks intercept SMS sent to a Google Voice number?

Hackers are able to steal 2FA SMS messages by exploiting SS7. As far as my understanding goes, this means gaining access to the SS7 system and then broadcasting a message akin to "This number is ...
2
votes
0answers
560 views

Can an Android Phone be used as a Windows Hello Security Key?

Microsoft Windows 10 does support physical security keys since some time. Google recently announced that Android phones can be used as security keys as well (primarily for their own services). Is ...
2
votes
0answers
56 views

2FA options for single yubikey and many hosts

I'm considering using yubikey (5 NFC model) as second factor for couple of Linux hosts. I'm interested in sticking it somewhere in PAM stack, so things like sudo are protected. Most of those hosts are ...
2
votes
1answer
282 views

Is using WebAuthn alone considered as two factor authentication?

Will using WebAuthn for an application make it two factor? I am specifically interested in using Ondevice biometrics and achieve passwordless authentication. For a true two factor authentication you ...
2
votes
0answers
40 views

Protecting private keys of common chat applications with 2FA

Say a user uses a common chat application like Telegram, Signal, Whatsapp, Ricochet. His device gets hacked and private keys get stolen. For normal PGP usage with email you can use two factor ...
2
votes
2answers
260 views

Web Application Using Identity Federation & OTP

We are running a web application using a client's identity federation to authenticate users. A new requirement is to use 2FA, we have decided to use an OTP algorithm using Java, similar to this one ...
2
votes
0answers
76 views

How can I go about securing services that require SMS tokens as backups?

I use 2FA on all services that support it. I generate backup codes and store them in a secure encrypted location. Most services unfortunately require a SMS backup, which represents a security issue as ...
2
votes
0answers
128 views

Why does Gmail have separate form for backup codes?

When I log into Gmail with 2 factor authentication, I enter my username and password and get taken to a page asking me to enter a security code sent to a phone. If I enter a backup code into this form ...
2
votes
0answers
426 views

Why bother with security measures when IBAN is all it takes to transfer money from my account?

I have just learned that in Germany you pay online by providing your IBAN. In other words, anyone to whom I have sent money and therefore has my IBAN can extract money from my account. Apparently, the ...
2
votes
0answers
5k views

Soft tokens - multiple profiles on same smartphone

Some of our clients have started migrating to soft tokens instead of hardware ones for two-factor authentication to their network. We have apps like RSA SecurID and VIP Access on our smartphones. The ...
1
vote
0answers
59 views

Is storing an encrypted 2FA backup on Bitwarden (a password manager) a good idea?

I am at the moment using Bitwarden and a separate 2FA app. I am trying to figure out a way to be able to securely recover my access to credentials and 2FA in case my phone/laptop/other electronic ...
1
vote
1answer
90 views

How often should we force users to re-authenticate when not on the network?

Our company has rolled out MFA to our users. We are a Microsoft shop, so we are using Azure AD to handle MFA and authentication to things like email, Teams, Sharepoint, etc. By default, we've disabled ...
1
vote
0answers
30 views

MFA: can unique biometrics collecting device count as another authentication factor (a possession factor)?

I see in this answer (Aren't endpoint devices inherently MFA?) that an endpoint device doesn't qualify as an authentication factor (AF). But if the endpoint biometric collecting device is uniquely ...
1
vote
0answers
82 views

How to implement a “Forgot password?” functionality using php-encryption's KeyProtectedByPassword and 2FA?

I'm currently migrating the encryption functionality used in a PHP project from mcrypt (which was deprecated in PHP 7.1.x and no longer works from PHP 7.2 onward) to openssl, using the defuse/php-...
1
vote
0answers
55 views

How to enforce E-mail Account Security with regards to Custom Domains & 2FA?

Lately I've been bothered by the fact that should one of my e-mail accounts be in some way compromised despite its long and randomized password phrase. I'd have hell to pay since it is effectively a ...
1
vote
0answers
820 views

OpenVPN use auth-user-pass with a file and authenticator

I have an open vpn configuration with the lines auth-user-pass my-login-creds.conf static-challenge "Enter Google Authenticator Code" 1 in it. When I try to connect with openvpn my-config.ovpn I ...
1
vote
0answers
44 views

Multi-factor asking condition

It is an established fact that the error message of login pages should not specify wether the password or the id is the problem. But for an application with multi factor authentication, should we ask ...
1
vote
0answers
58 views

Regarding 2 factor authentication and adding new devices. Which one of these is safer?

Let's say I have a mobile device with google authenticator which uses TOTP, which I use everytime to log in into my personal accounts. If I want to add a second device. I would need to have access to ...
0
votes
1answer
32 views

How does the PIN work in the RSA SecurID phone app?

I use the RSA SecurID phone app to connect to the VPN at my work. I run the app and type a 4 to 8 digit PIN. Then the app gives me a 6 digit code to connect to the VPN. Does the PIN change the result? ...
0
votes
0answers
40 views

Integrating 2FA app into main app

We currently have two distinct apps, one for generating a 2FA token and the other one is the main app. Business is now considering to have only one app left and integrating the authenticator app into ...
0
votes
0answers
24 views

Security concerns regarding user self-service MFA reset

Let's say I have an IAM system with a typical MFA feature: TOTP with recovery codes. When users don't have access to their TOTP apps, they can use recovery codes to log in. The IAM system has an admin ...
0
votes
0answers
25 views

Handling parallel login and Max invalid attempts using OTP with same phone number

I am designing a login system that performs login operation using OTP and Email ID of the registered user. The current approach is as below User enters the Registered Email Id If the Email ID is ...
0
votes
0answers
71 views

(Re)Hacked Instagram accout even if Two Factor authentication was enabled

A friend of mine, let's call her Alice, had an Instagram account that was hacked. She uses an iPhone. The scenario looks like this: Alice gets a link from a Business Account via WhatsApp, and clicks ...
0
votes
0answers
57 views

Does mobile biometric authentication count as Knowledge, Possession, or Inherence authentication

Apple claims in this year's WWDC that Face ID and Touch ID count for both Possession and Inherence identity factors, because they are using Biometrics (Inherence) to access the secure element on your ...
0
votes
0answers
43 views

Dedicated device for online investing and other security measures

I like to invest money online. I invest in both cryptocurrencies as well as regular stocks. As my bankroll grows (let's say 20k+ in the near future), I feel like I need to start taking more serious ...
0
votes
1answer
87 views

Why make it difficult to disable MFA tokens?

Some websites make it easy to enrol multiple TOTP apps at the same time but make it difficult to disable these apps. For instance, the user would have to completely reset the MFA settings instead of ...
0
votes
0answers
28 views

If someone stole my symantec VIP credential ID, would they be able to generate the same one-time passcode as the app does?

Let's say I've installed the Symantec VIP app on my device. If someone stole my Symantec VIP credential ID, would they be able to generate the same one-time passcode (OTP) as the app does?
0
votes
0answers
42 views

Is using traditional 2FA codes a prerequisite for using U2F FIDO key in Dashlane/1Password?

Over the past few weeks, I have spent a lot of time thinking about how to structure my security plan based on a password manager, just two/three strong master passwords and the use of physical U2F ...
0
votes
0answers
52 views

Blockchain 2FA by sms (wallet code) secure (hack)?

To keep a long story short, I got hacked on my PC by downloading and executing a wrong file. Programs as InterVPN, Cryptobot and HVNC (told by the hacker via google chat) were installed. My accounts (...
0
votes
0answers
39 views

Can bad software/web app architecture compromise my 2FA key?

So this is a two part question: 1) When I have a compartmentalized system, and then I use the same hardware 2FA key for 2FA across all compartments, can my hardware key be used to trace me through ...
0
votes
1answer
42 views

Risks associated with a compromised external Security token server

Consider the following architecture: An on premise Web API 2 [Written in C# hosted in IIS] which uses OAuth 2 authentication [ Implicit Flow ] to secure itself. This API acts as the data source by ...
0
votes
0answers
61 views

USB token for Java Desktop Application

I would like to integrate the use of a USB token in a JavaFX application that my customers use on a computer I send them. This JavaFX application interacts with a Java/Spring back end. (client-id/...
0
votes
0answers
47 views

SAML and Multi-factor auth

I have an application that is a SAML SP, authenticating users via inbound SAML assertions from some other IdP. If I want to require multi-factor auth, is it a common practice to add multi-factor auth ...
0
votes
0answers
32 views

Why does Apple's 2FA require both a prompt and a code?

When logging into iCloud via the web, a prompt is sent to your phone (with a map showing the origin of the web request). The user can then choose to allow or deny this request. After choosing to allow ...
0
votes
2answers
113 views

2FA: Do app passwords render the second factor invalid?

I am currently in the process of employing a 2FA authentication on as many services as I can. If it is relevant for the question: I use a time-based OTP authenticator app. When setting up, I noticed ...
0
votes
0answers
76 views

Why do GoDaddy customer support representatives ask for two-step verification codes?

When contacting GoDaddy customer service, whether over chat or phone, they often ask for both a PIN and a two-step verification code (which they confusingly refer to as "google auth codes"). Then PIN ...
0
votes
1answer
66 views

How can I securely generate secret-sharing/multisig keys on a p2p network?

I am trying to create a peer-to-peer escrow system. I need to encrypt the private key of a wallet with a 2-of-3 secret-sharing function - the buyer, seller, and arbitrator will each have have one key. ...
0
votes
0answers
14 views

Granting access to mailbox/calendar to another with MFA enabled?

Jane needs access to John's Outlook mailbox and calendar. When Jane attempts to access it (she has his UN & PW) John receives the MFA challenge preventing Jane from accessing it. This works ...
0
votes
1answer
66 views

What protocol is NPS server using to send Secondary Auth to Azure MFA?

We are using PAP to pass data between our on-prem VMware and on-prem NPS server. But our on-prem NPS Server passes data to Azure MFA in the cloud. I want to ensure a stronger protocol than PAP is ...
0
votes
1answer
86 views

2 Factor Authentication -> When to Request it?

I am wanting to implement 2FA in my application. I am a relatively new developer (~1 year Spring Boot / Android). At the moment, my App uses Spring Security AuthenticationProviders to authenticate a ...
0
votes
0answers
26 views

Is it possible to only receive in-app codes (no text messages) in authy?

I've heard that in-app codes are generally more secure than codes sent over SMS, which can theoretically be intercepted. If this is true, then is there any way to ensure that authy only delivers codes ...
0
votes
0answers
55 views

Sufficient to only require 2FA for su elevation?

I have a small web-facing server on my home network. It is headless, and the only way to log in is to ssh with pubkey authentication from within the local network. I wanted to turn on a 2FA ...
0
votes
0answers
48 views

Azure AD — How to only allow MFA configuration from a trusted network?

Hopefully someone as an idea... In Azure AD, how can we allow MFA setup by a user but only allow that configuration to occur on a trusted network? We have trusted networks defined but everything we ...
0
votes
0answers
850 views

Two-factor authentication on Galaxy Watch - should secrets be encrypted, and is this SQLite example secure?

I recently got a Galaxy Watch and to get acquainted with developing apps for it I'm writing a simple two factor authenticator to generate TOTP codes from entered secrets using the Google Authenticator ...
0
votes
0answers
63 views

Leaking information about 2FA status

I was asked to provide a public web interface which is given an email addresses (which belong to our users) for public clients (e.g. a web application or native mobile application) whether or not a ...
0
votes
0answers
551 views

What are the security consequences of allowing 2FA app (Google Authenticator) to display the seed?

Excuse me if my question is a little bit convoluted. I prefer to share the full story, background information, so that accidentally I'm not asking XY question. Background info I'm using 2FA pretty ...