a multi factor authentication requires at least two sets of credentials. This is typically something you know (e. g. a password) and something you own (e. g. a token generator or mobile phone), but could also be something you are (a biometric).

learn more… | top users | synonyms (2)

-2
votes
3answers
83 views

Jump Servers for security

In my network, I have the clients directly connected to the server; but in the new PCI policies, they required to use jump servers. What is the advantage of using jump servers for security reasons? ...
0
votes
2answers
28 views

Use Public Key or Password and PAM verification code

So I've been reading more and more about how (relatively) easy it is to have your Ubuntu server compromised and suffice to say have become a tad paranoid by this fact. I've setup Multi Factor ...
0
votes
1answer
38 views

How To Stop A Mobile Verification Attack

I am thinking of using mobile phone number verification for the sign up step in my web application but how do I prevent a hacker or a malicious user from sending mobile verification requests to an ...
0
votes
1answer
44 views

Protecting third-party credentials in a web database in light of weak passwords

I need to store third party credentials in a database for a web application. The third party supports OAUTH and I plan on getting a long-lived token to allow my app to access the third party, but I ...
4
votes
0answers
174 views

Generating backup codes for a 2FA implementation

I have implemented the login/verification aspect of a two factor auth system as per RFC 6238. It works fine with Google Authenticator, which is great. Now I am turning my attention to the backup ...
2
votes
0answers
400 views

Remote Registry allows bypass of 2FA enforcement with 1FA

Some organizations will configure their Windows systems to require Smart Cards for all account logins, as part of a two-factor authentication implementation. However, this can easily be bypassed ...
1
vote
0answers
27 views

What's the best way to implement phone-based 2FA

Some websites (for ex. Google) call you and you hear an recorded number, which you have to type in your computer. Some websites (for ex. Amazon) display a number on your computer which you have to ...
1
vote
0answers
2k views

Soft tokens - multiple profiles on same smartphone

Some of our clients have started migrating to soft tokens instead of hardware ones for two-factor authentication to their network. We have apps like RSA SecurID and VIP Access on our smartphones. The ...
0
votes
0answers
34 views

Regarding 2 factor authentication and adding new devices. Which one of these is safer?

Let's say I have a mobile device with google authenticator which uses TOTP, which I use everytime to log in into my personal accounts. If I want to add a second device. I would need to have access to ...
0
votes
0answers
69 views

TOTP: Storing symmetrical secrets

I'm in the process of researching 2fa methods for a cloud connected physical access control system. There is very little margin for error in this space. Is it just me or does TOTP for two factor auth ...
0
votes
0answers
13 views

AWS - CloudFormation - Enable MFA

Is there a way of using cloud formation to enforce MFA on user accounts in AWS: I have the following cloud-formation code: { "AWSTemplateFormatVersion": "2010-09-09" "Description": "...
0
votes
0answers
21 views

Is “full loop” and “half loop” authentication the right word to describe this 2FA sequence?

I'm looking for a term to describe this abstract thought about multifactor devices and how they are implemented. In the examples below, there are different levels of device authentication, but the ...
0
votes
0answers
32 views

From a credential flow perspective, whats the difference between FIDO UAF and FIDO 2.0 Web Services?

The FIDO Standard allows for devices and authentication schemes to be certified as UAF or U2F. This allows for flexible unified authentication, and optional second factor enrollment and registration. ...
0
votes
0answers
27 views

Windows Server 2012 disable MFA for a single user?

I'm having issues with this for whatever reason. I created a new user and MFA is supposedly disabled but it doesn't seem to be true. Is there maybe something I've missed or is there an easier (more ...