Questions tagged [multi-factor]

a multi factor authentication requires at least two sets of credentials. This is typically something you know (e. g. a password) and something you own (e. g. a token generator or mobile phone), but could also be something you are (a biometric).

Filter by
Sorted by
Tagged with
13
votes
4answers
2k views

Which verification method should I choose: SMS or call?

I want to enable Two-Factor Authentication for my outlook account, but I'm not sure which method should I choose or in other words which method is more secure? Like I said there are two options: text ...
13
votes
5answers
2k views

Is a biometric eye scan more secure than a multi-factor authentication

I have come across the following question in a Security+ exam guide You are tasked with creating a high-security authentication system for physical access control to a military installation. Which ...
13
votes
2answers
1k views

Does having 2-factor authentication help with HeartBleed?

I was talking with a friend about HeartBleed, and he mentioned that he had 2-factor authentication enabled on all the sites that supported it, so even with his username and passwords, nobody would be ...
13
votes
1answer
981 views

Yubikeys & SSH - which option is best for lockdown?

My company has a few dozen servers hosted on a cloud provider. All but one (OpenVPN host) is closed to the internet. We're using OpenVPN AS which uses certs + Google Authenticator for login. We are ...
12
votes
6answers
2k views

Is it safe to store 2FA tokens together with passwords in 1password?

I'm using 1password and I've seen 1password allows you to store 2FA tokens in the same place where you store the password. I don't like the idea of having everything in the same place as if someone ...
12
votes
3answers
1k views

Steam and two-factor authentication

The Steam platform is designed to encourage users to use two-factor authentication. One of the community tasks (achievement-like objectives) on Steam is "Use the Steam Mobile App for two-factor ...
12
votes
2answers
6k views

LastPass Grid Authentication vs Google Authenticator which one is more secure?

[Being a LastPass user] recently I moved to Google Authenticator instead of using Grid Authentication as a 2-factor security. For me, finding and filling letters from such a dense matrix is a rather ...
12
votes
1answer
3k views

Storing TOTP secret in database, plaintext or encrypted?

I've been reading about 2FA and how it is used, and the thing that struck me most is that everyone seems to be storing the TOTP secret as plaintext in their database. I understand you need the secret ...
11
votes
6answers
2k views

Is there multi-factor authentication for machines?

Most of what I have seen on mutiifactor authentication (eg wikipedia or here on se) seems human centric. Ie it is a human interacting with a machine and the factors are associated with authenticating ...
11
votes
5answers
1k views

Non-OEM Biometric Software?

Most of us with fingerprint readers and such devices probably use the software provided by the vendor, to enable biometric OS login or single sign-on functionality. However, I've recently wondered if ...
11
votes
2answers
2k views

How do I protect my Gmail account when accessing it via an Android smartphone?

I have a Gmail account that I also access via an Android smartphone. The mail account could be used to reset passwords for other online accounts, so I want to tighten up the security around this ...
10
votes
3answers
317 views

2FA: Why not use dictionary phrases instead of numbers?

This question is inspired by this one: How long should 2 factor authentication codes be? Basically, there is a practical lower and upper bound of 2FA code length. It can't be too short such that an ...
10
votes
1answer
8k views

YubiKey or Google authenticator?

I'm using lastpass and I would like to implement a 2FA in my account, but I don't know which one is the most secure, a software authenticator such as google authenticator or an USB device as Yubikey. ...
10
votes
1answer
2k views

How safe is “trust this computer” option for websites?

Many sites have a "trust this computer" option that allows one to bypass some security measures (ex.: with Google's 2-step authentication enabled, one does not need to enter the phone's code if the ...
10
votes
5answers
14k views

What are the ways to implement two factor authentication?

We have devices that can generate tokens. So we can use tokens with passwords to perform two factor authentication. There are many ways to implement such systems to enhance security. One of two I know,...
9
votes
6answers
2k views

Why not ask for a password and 2-factor token at the same time?

I have observed a number of web-based login forms that offer 2-factor authentication do token entry on a second form after validating your username and password. Is there a reason not to ask people ...
9
votes
3answers
790 views

What kind of factor is a physical signature?

I'm familiar with the basics of multi-factor authentication. Now I'm trying to understand how a physical signature, as written on, say, a check or a credit card receipt, would be classified: Is it a ...
9
votes
3answers
1k views

What advantage does the Bloomberg authentication system have over traditional 2 factor?

Bloomberg clients have an interesting way to authenticate to the server. This seems involve some of the following: Logging into a secure website, that displays a flashing square Swiping your finger ...
9
votes
3answers
2k views

How does entering “a” phone number help Google “verify it's me?”

Today I tried to sign into my Google account while at university. Google blocked the attempt, and asked for a phone number. Below is a screenshot of the form Google showed me. It says: Verify it's ...
9
votes
6answers
2k views

Is behavioural analysis (e.g. keystroke dynamics) a reliable security mechanism for MFA?

The typical set of multi-factor categories is as follows: Something you know (e.g. a password) Something you have (e.g. a hardware token, or key file) Something you are (e.g. a fingerprint or retina ...
9
votes
6answers
4k views

POP3/IMAP Stronger Authentication

We recently deployed a two-factor-authentication solution in order to strength logon to our web applications (one of them is web based mail, Microsoft outlook web access) Most of the users who have ...
9
votes
2answers
6k views

How to fix a repeatedly hacked gmail account (where 2FA is enabled and passwords are changed)?

A friend of mine came to me for help with this issues. Her Gmail account has been hacked and keeps sending out spam emails to her contacts. This is happening to her on a monthly basis. Each time it ...
9
votes
4answers
4k views

Does IMAP/POP3/ASP undermine Two-Factor Auth?

When I log in to hotmail or Google or posteo I can only log in using the 2FA that I have set up. However, each provider seems to have an alternative for apps that do not auth via a web client. ...
9
votes
4answers
4k views

Do keyfiles actually add any meaningful security in the presence of strong passwords?

In the context of protecting access to local encrypted files or devices against a determined (and competent) adversary, is there any reason to believe that the use of a key file actually presents a ...
9
votes
1answer
459 views

PSD2 compliant two factor authentication

According to PSD2 the elements of the multi-factor authentication must be independent so the compromise of one element does not compromise the other. Here is the article from the directive: *...
9
votes
3answers
1k views

NFC used in place of contact based smart card two-factor authentication

My organization is trying to move away from contact based smartcards (because our hardware vendor is no longer integrating them into their current systems) to some other form of two-factor ...
8
votes
3answers
1k views

2FA why not to ask the code before password

So in most websites on login page you have to input username and password for e.g. Facebook where you input username and password and then submit form. Other websites ask you each separately e.g. ...
8
votes
2answers
442 views

Is there any point in using two step authentication if you have strong passwords?

If you are in the habit of using strong passwords (randomly generated by password manager) is there any point in using two step authentication? Assuming that 99% of the time that when you enter a ...
8
votes
3answers
7k views

Full disk encryption and multi-factor authentication

All serious full disk encryption schemes I have looked into use a static password for authentication. For example, TrueCrypt supports two-factor authentication with keyfiles, but not for system ...
8
votes
4answers
686 views

How can I protect my credit card on sites where 2FA is not an option?

I'm using Visa Express, and sometimes when I'm shopping, the store doesn't support Verified by Visa - so that means that there is no 2FA option. Normally when there is that option, it will force me ...
8
votes
3answers
385 views

Should I delete SMS messages containing one-time passwords?

I have had one-time passwords sent to my phone via SMS. Those one-time passwords include those for 2FA and the occasional password reset. Should I delete those SMS messages after the one-time ...
8
votes
2answers
265 views

Why use one-time codes for two-factor authentication backups?

I am building an web application that uses two-factor authentication. While implementing the recovery feature, I see that most companies (eg Apple, Facebook, Github) provide a set of ~15 backup codes,...
8
votes
3answers
303 views

Is a second, “old” (dumb) phone dedicated just to receiving bank tokens as safe as “modern” (smart) phone?

Are old phones safer / safe / as safe as modern smartphones when it comes to auth-tokens / confirmations tokens? Is SMS encrypted?
8
votes
2answers
1k views

Authy 2FA best practices

I've used the authy mobile app for a while for OTP tokens, but have the backup/syncing turned off. I noticed that they have a desktop app, which would be a lot more convenient most of the time, but I'...
8
votes
1answer
2k views

Generating backup codes for a 2FA implementation

I have implemented the login/verification aspect of a two factor auth system as per RFC 6238. It works fine with Google Authenticator, which is great. Now I am turning my attention to the backup ...
8
votes
2answers
1k views

Using Two-Factor Authentication to Stop Pass-the-Hash

Am looking into mitigations to Pass+the-Hash and Pass-the-Ticket in Active Directory that also improve overall network security, too. Have sorting through some of the many two+factor authentication ...
8
votes
1answer
802 views

From a credential flow perspective, whats the difference between FIDO UAF and FIDO 2.0 Web Services?

The FIDO Standard allows for devices and authentication schemes to be certified as UAF or U2F. This allows for flexible unified authentication, and optional second factor enrollment and registration. ...
8
votes
3answers
2k views

How does LastPass' grid multi-factor authentication work behind the scenes?

I understand how to use the Grid multi-factor authentication as a user but how does it work technically? Specifically how can just a few letters from the grid be enough to decrypt any secret defined ...
8
votes
3answers
804 views

How To Stop A Mobile Verification Attack

I am thinking of using mobile phone number verification for the sign up step in my web application but how do I prevent a hacker or a malicious user from sending mobile verification requests to an ...
7
votes
5answers
464 views

Can a smartphone strictly be viewed as the 'something you posses' factor for 2FA when it has no hardware token capability like smartcards?

It seems that 2FA purists seem to go for security keys (like ubikey or smart-cards) while others seem to have a more relaxt stance which even seem to include 'possession' of none physical elements ...
7
votes
6answers
1k views

Isn't it less secure to use something you are for authentication?

I have to think of this everyday when I close the doors of the shop I work in: A year ago we used to close the shop and arm the alarm using a key fob. This means the worst case scenario was that I ...
7
votes
2answers
1k views

Is accepting the current and the previous one-time password a bad practice?

I often see two-factor authentication (2FA) methods using one-time passwords (OTP) implementations wherein the current (previous) and sometimes even 2 or 3 previous tokens are still valid. This is ...
7
votes
2answers
2k views

Is OATH TOTP and / or Google Authenticator vulnerable if an attacker has (N) previous codes?

I'm not much of a ipsec initiate, so this is a bit over my head ... but I'm always willing to learn more. Are there any known attacks against OATH TOTP (Google Authenticator's / Authy's algorithm) if ...
7
votes
4answers
5k views

SMS Authentication: random OTP or a cryptographic one

I'm adding two-factor authentication using SMS to enhance an existing login process. Since I'm not working with physical tokens, I was wondering what is considered the safest: Sending random 8 ...
7
votes
3answers
830 views

2-factor authentication - Who am I trusting?

I'm confused about the risks of 2-factor authentication. I'm a developer, who has to do some ops, and considering turning it on for my DigitalOcean and GitHub accounts. Both offer TOTP(?) and ...
7
votes
2answers
2k views

Does having a passphrase and SSH key qualify as two factor authentication for PCI?

I am working on getting our company's servers PCI SAQ-C compliant (credit card data passes through our system but is not stored by our system). We have SSH access to administer the servers and all ...
7
votes
2answers
4k views

Authy - is my backup secured by only my password or 2FA s well

I've read around the Authy site and done a few Google searches, but it is not clear to me whether an attacker that compromised my Authy account backup password could access my keys without any ...
7
votes
3answers
3k views

2-Factor Authentication vs Security Questions

I have an account with a bank that has additional security option. When it does not recognize a device being used to access the account, it will either: Prompt with 1 of 3 security questions Send a ...
7
votes
1answer
817 views

If my phone for two factor authentication is stolen, can the attacker access my account via an email password reset?

Suppose I setup an online account with 2FA on my phone, and an attacker gains access to my phone. My phone is logged into my email account. The attacker knows my online service's account username or ...
7
votes
4answers
3k views

(SoHo) Multi-Factor Authentication for Remote Desktop Gateway

I am looking at implementing some sort of multi-factor authentication for a Remote Desktop Gateway at a small office (less than 20 users). Where would be a good place to start for a quality, ...