Questions tagged [multi-factor]

a multi factor authentication requires at least two sets of credentials. This is typically something you know (e. g. a password) and something you own (e. g. a token generator or mobile phone), but could also be something you are (a biometric).

Filter by
Sorted by
Tagged with
125
votes
6answers
44k views

How secure are the FIDO U2F tokens

Google and Yubico just announced the availability of cryptographic security tokens following the FIDO U2F specification. Is this just another 2FA option, or is this significantly better than solutions ...
98
votes
7answers
17k views

Attacker circumventing 2FA. How to defend?

Detailed in the latest NSA dump is a method allegedly used by Russian intelligence to circumvent 2FA. (In this instance Google 2FA with the second factor being a code.) It’s a fairly obvious scheme ...
84
votes
2answers
17k views

How did someone log-in to my Gmail account from Kenya?

While on holiday in France in May I received an email from Google "New sign-in". Your Google Account was just used to sign in: Nairobi, Kenya. Tuesday, 26 May 2015 22:10 (East Africa Time). I ...
79
votes
5answers
12k views

Are texted 2FA security codes deliberately easy to remember?

I have 2FA setup on my bank account. When I login, I receive a six-digit code as an IM on my phone that I enter into the website. These codes always seem to have a pattern to them. Either something ...
65
votes
6answers
12k views

Four-factor authentication

I'm sure you've all heard of two-factor/multi-factor authentication. Basically it comes down to these factors: Knowledge - something you know (e.g. password, PIN, pattern) Possession - something you ...
63
votes
5answers
6k views

Do 2FA sites leak info by confirming a correct password guess?

Here's my relatively layman's view of the issue. Many websites tout multifactor authentication (MFA) as an enormous boost to the security of users' accounts, and it can be if implemented properly. ...
62
votes
2answers
9k views

How are one-time password generators like Google Authenticator different from having two passwords?

Google Authenticator uses the TOTP algorithm to generate your One-Time Password (OTP). TOTP works like this : The server generates a secret key and shares with the client (you) when the client ...
55
votes
9answers
50k views

Two-Step vs. Two-Factor Authentication - Is there a difference?

These days, there's pretty much three forms of authentication in general use on the web: Single-factor authentication, e.g.: PIN or password. Two-factor authentication, e.g.: Single-factor plus a ...
54
votes
5answers
25k views

What is a YubiKey and how does it work?

How do YubiKeys work? Are there any alternatives? Here is a picture of one:
46
votes
8answers
10k views

Force user to remove USB token

I'm looking at setting up secure laptops using BitLocker with pre-boot PIN and startup key. I'm wondering if there is a way to force the user, who is remote, to remove the USB with the startup key ...
42
votes
3answers
53k views

How does HSBC's “Secure Key” actually work?

My bank has recently sent me a Digipass/Secure Key, which looks like a tiny calculator. You press the green button to turn it on, type a PIN to unlock it, then press the green button again to generate ...
39
votes
11answers
7k views

Is it safe to use a weak password as long as I have two-factor authentication?

I'm careful to use strong passwords (according to How Big is Your Haystack, my passwords would take a massive cracking array 1.5 million centuries to crack), I don't reuse passwords across sites, and ...
39
votes
2answers
7k views

Why does Google cripple the 2FA Google Authenticator PAM module?

If you enable 2FA for Google Apps the shared secret is 160 bits. The google_authenticator PAM module on the other hand seems to use 80 bits for the shared secret. According to RFC 4226: R6 - The ...
35
votes
6answers
4k views

Should 2FA be enabled on service accounts?

See the title. I'm involved in a security audit right now, and am wondering whether 2FA should be enabled on not just human login accounts but also on service accounts (non-human accounts)? If so, how ...
35
votes
6answers
3k views

Why don't PGP and SSH keys see more widespread use as a second factor when authenticating?

One of the major up-and-coming MFA methods is U2F, which relies on an initial key exchange and challenge-response mechanism. It's a relatively new protocol, and is only starting to see more ...
31
votes
6answers
14k views

Why can't I share a one use code with anyone else?

I noticed in some cases when I get a verification code from Google it may say something along the line of: "You should not share this code with anyone else and no one from Google will ever ask for ...
30
votes
4answers
7k views

How can a website verify that my phone number belongs to me?

I was signing into a Capital One credit card website that I hadn't used in a long time, and once I entered my user name and password, it requested my mobile phone number for additional verification. ...
30
votes
4answers
4k views

How is “something you have” typically defined for “two-factor” authentication?

A wide range of products claim to offer "two-factor authentication" (c.v. Two-factor authentication - Wikipedia). Most are deployed as "something you have" to be used in addition to a normal password ...
28
votes
3answers
2k views

How should disabling 2FA be handled by a service?

Due to personal reasons I recently had to disable and re-enable 2FA on quite a few of services. Now during this action I noticed quite a few different practices when it comes to "what should a user do ...
26
votes
14answers
6k views

Why do we even use passwords / passphrases next to biometrics?

In the last couple of days there were a lot of talking about passwords and passphrases, not only here, but on several blogs and forums I follow (especially after XKCD #936 saw the light of this world)....
25
votes
6answers
5k views

Why do apps with phone verification send the user a message, rather than have the user send one to them?

Many apps allow the user to authenticate with their phone number, by having the user enter it, and then sending an SMS with a code to be entered into the app. Very few (if any that I can find still ...
24
votes
3answers
6k views

Which SSH security is stronger? 2 Factor or Public key

For SSH authentication, which is more secure? 2 Factor Authentication using a USB token/Google Authenticator(time based) OR Public/private key with password Or could they be both used at the same ...
23
votes
2answers
25k views

How does Authy's 2FA work, if it doesn't connect to the server?

I thought I knew how two-factor authentication works: I enter the password. Server generates a random number (token) and sends it to me via SMS. I enter this token. Server checks that the token I ...
23
votes
1answer
12k views

What are the differences between the U2F and UAF FIDO authentication standards?

Google recently announced support for Universal 2nd Factor (U2F) authentication in Chrome and started allowing that authentication mechanism to be used for 2-factor authentication across their various ...
22
votes
4answers
642 views

Bank asked for a cross login?

I was creating a new bank account here in the US at HSBC's popular online bank... You know the step where you have to verify the account you're sending from, by receiving two small test payments? I ...
22
votes
3answers
3k views

How to securely store and manage one-time backup codes for 2FA?

I am already using 31 services with 2nd factor authentication and the number is growing. In addition to having multiple authentication devices, I decided for or had to generate a separate set of one-...
21
votes
4answers
7k views

Why use a Smartcard for (Two Factor) Auth instead of another medium?

I recently installed Bitlocker on my Windows 8.1 machine, using only a password. I was thinking of getting something other than just a password for my storage drive, something physical, like a USB, SD ...
21
votes
6answers
8k views

Is tokenless (specifically SMS) 2FA a security compromise over OTP tokens?

I've been looking into the various pros/cons of tokenless (particularly SMS based) and traditional token based two-factor authentication (think RSA SecurID). After doing some research, I think I have ...
21
votes
4answers
3k views

What is the risk and mitigation of accidentally typing a YubiKey password in an open forum?

I have a YubiKey in my laptop (for testing) and accidentally broadcast my YubiKey password out to the Internet. Since this is only a test key, and has no access to anything of value, here are some ...
20
votes
6answers
4k views

What extra security does a 2-step website login process with a PIN provide?

I am currently working on a web application with a significant security risk attached to its function. We're using Microsoft Identity Framework to handle user logins, with the system forcing strong ...
20
votes
4answers
3k views

Biometric versus other Two Factor Authentication Mechanisms

Over the years biometrics is the go-to movie authentication mechanism, but in the real world I'm getting conflicting opinions about it. Everything I've learned shows that biometrics are flawed ...
19
votes
11answers
5k views

2 factor authentication - cost effective solution for a web startup [closed]

My local bank uses a 2 factor authentication where customers key in password AND a One Time PIN delivered via SMS to mobile phone OR from a security token device. I am doing a web startup in the ...
19
votes
4answers
4k views

In a “card not present” transaction, is the credit card number, expiry date & CVV considered as a “What you have” or a “What you know”?

Is the credit card number, CVV & expiry date considered to be a secret? If so, then the physical credit card is incidental & the info about the card is something "you know". OTOH, if you don't ...
19
votes
4answers
19k views

Does adding two-factor authentication by OTP really make KeePass more secure

KeePass is an application that keeps all your passwords for you in a database. It is primarily protected by a master password and/or keyfile. If the database is properly encrypted with that password ...
17
votes
3answers
2k views

Multi factor authentication on Ubuntu workstations, where to start?

Is it possible to have Ubuntu users log in with multi-factor authentication? I was thinking of a combination of pass(word|code) and smartcard (with screen locks when for example smart-card is removed) ...
16
votes
2answers
4k views

Is there a way to prevent hackers from using cookies to bypass two step verification?

Let's take Steam/Google/FB/Microsoft/Twitter logins as examples. All of them offer two step verification through SMS message. Let's say the hacker does not have access to my phone. But he has access ...
16
votes
5answers
2k views

Does two factor authentication prevent social engineering attacks

After reading this article from symantec I got to think how much all these social engineering techniques rely on the authentication system of users, a password. Considering three different additional ...
16
votes
4answers
6k views

What is the use of the “secret” displayed when setting up 2 Factor Authentication?

What is the purpose of the "secret" that is displayed when you take the picture of the QR code to set up 2 Factor Authentication on a non-Google site? Why would you need it? If you save it, doesn't ...
16
votes
6answers
13k views

How to implement multi factor authentication using a token generator?

I'd like to implement multi factor authentication on a few projects. Now the first factor would be username and password, for the second factor I would like to use a token generator. These tokens ...
16
votes
4answers
6k views

Three-Factor Authentication for Windows

This HowToGeek article... http://www.howtogeek.com/67556/how-to-unlock-your-pc-by-being-nearby-with-a-bluetooth-phone/ ...got me thinking. Is there any software (or combination of software) that ...
16
votes
2answers
717 views

Mitigating the loss of a mobile phone used for second-factor login

Take the following scenario: John is using GMail for his primary email account and LastPass as his password management system. Both of these accounts are using the Google Authenticator mobile ...
16
votes
1answer
1k views

Do any DNS registrars support multi factor authentication?

I am looking for a DNS registrar that supports strong multi-factor authentication. Does any DNS registrar support multi-factor? Is this a legitimate need?
15
votes
2answers
9k views

How does Google detect new devices for two factor authentication

When you enable two step verification for google accounts, you get sent a code by SMS to enter in addition to your username and password the first time you log in with a new device. How do they ...
14
votes
9answers
1k views

Anybody have additional information on the EMC RSA SecurID compromise?

The Security Advisory Press Release here doesn't have much information, the email that alerted me to this didn't help much more, and unfortunately I heard about the two Thursday evening conference ...
14
votes
6answers
3k views

Additional security benefits from Multi-Factor Authentication?

Does multi-factor authentication provide any additional security benefits on top of doing a better job at correctly identifying and authenticating users compared to single factor authentication? In ...
14
votes
5answers
2k views

Two passwords provide better security than two-factor authentication?

While evaluating 1Password's new Teams service, I noticed rather curious absence of support for multifactor authentication. When asked about the lack of MFA, they replied: We use an Account Key ...
14
votes
5answers
1k views

Safe way to authenticate (multi-factor authentication?) while being monitored?

(I'm trying for a bit more precise answer, particularly with regard to multi-factor authentication, than I received for "Safe way to use a computer that has spyware/keylogger installed?" on SU.) Let'...
14
votes
3answers
2k views

If multi factor authentication is enabled, how should that affect self-service password reset?

Given that security is only as secure as its weakest link, suppose I have website with additional authentication enabled in any of these ways: (example, multiple conditions may be required) SMS/Voice ...
14
votes
2answers
10k views

Is Google prompt safer then authenticator app for 2-step verification?

I guess authenticator app is safer then SMS because in app there is no data in transit once you setup your phone. Now, Google is pushing phone prompts as a replacement for authenticator app. Is it ...
14
votes
1answer
1k views

Could the Stack Overflow Dance Dance Authentication April Fool's joke actually work in a real environment?

Today, Stack Overflow released their April Fool's joke (a day early, but hey) involving Dance Dance Authentication. Essentially, it's logging you in by dancing in front of your PC, and it can ...