Questions tagged [multi-factor]

a multi factor authentication requires at least two sets of credentials. This is typically something you know (e. g. a password) and something you own (e. g. a token generator or mobile phone), but could also be something you are (a biometric).

Filter by
Sorted by
Tagged with
7
votes
4answers
1k views

Authy: Does multi-device mode imply that all keys are stored on their servers?

My understanding is that if you use Authy, without backups/multi-device options, none of your account keys are stored on their servers. It all resides on your single device. Ie, even if Authy ...
7
votes
2answers
205 views

Why not make the second factor the only factor? [duplicate]

Most websites use a single-factor based authentication mechanism, the password. Some popular websites, however, also implement an (often optional) two-factor mechanism to log in; usually requiring the ...
7
votes
4answers
1k views

Are there consumer-grade VPN services that support two-factor authentication, like SecurID?

I'd like to increase my VPN security, and Google hasn't turned up anything with regard to VPN services and SecurId. Does anyone know of services like this?
6
votes
6answers
384 views

When should I issue more than one multi-factor device to a user? Is it OK to give several active tokens vs none at all?

Most of the conventional IT.Sec thinking I've seen says that a user can only have one multi factor authentication device. I'd like to challenge that defacto-thinking and ask if there is ever an ...
6
votes
5answers
2k views

Do any organizations use Smart Cards other than the military?

The military's Common Access Card (CAC) seems legit. Do other companies/organizations employ their use? If not, why? UPDATE What are the pros/cons of smart cards, compared to other methods?
6
votes
3answers
1k views

Two-Factor Authentication: When is it worth it?

I was reading this article, and it triggered the question: Why not use two factor authentication? In his case, it both possibilities were enabled anyway, so this looks to me like it's two attack ...
6
votes
3answers
737 views

Staged Authentication

Would anyone happen to know the terminology for using "multi-staged authentication", where each stage grants a specific level of authorization? The concept is that you for instance browse a web page, ...
6
votes
3answers
386 views

Why do Google 2-factor authentication SMS codes never start with a 0? [closed]

When you use 2-step authentication to log to your Google Account, you can get an SMS on your mobile-phone with a G-123456 style code. I think that I never got a code with a leading zero. Is there a ...
6
votes
2answers
1k views

Why is FIDO U2F an entirely different standard from FIDO UAF instead of just a subset?

As you may already be aware, the Universal 2nd Factor (U2F) standard is a standard for 2nd-factor authentication which allows users to authenticate to web applications using a USB hardware token. ...
6
votes
3answers
3k views

Is it secure to store a two factor authentication seed in a password manager?

I wonder whether it is really secure to store the Two Factor Authentication seed code (e.g. the secret key for TOTP) within a password manager together with the user and password for the service. If ...
6
votes
4answers
1k views

One time password over SMS - exposing the Authentication Server to the internet

Consider a Internet Based Website which does authentication. The Web Application can do the authentication by calling an Authentication Server which is not connected to the internet. The ...
6
votes
1answer
520 views

How to solve race condition in 2-factor authentication solutions like RSA Security tokens or Google Authenticator?

One of the reasons we opt to use 2-factor authentication is to minimize the impact of keyloggers. The theory is that even if an attacker is able to observe the user type in the token numbers, they ...
6
votes
3answers
1k views

How do Pentesters approach attacking 2FA (two factor authentication)?

I'm looking for practical ways to attack 2FA. What do you need to consider and how would you go about testing the effectiveness of 2FA? My only thoughts are that you would attack the implementation ...
6
votes
1answer
683 views

How long does 2-factor authentication codes have to be?

I've noticed that from a (personal) UX point of view, 4 numbers which my online banking uses seems to be a sweet spot in terms of holding it in my head from looking at my phone to typing it it. But ...
6
votes
4answers
2k views

Best practices for usefully storing two factor authentication backup codes?

For a lot of web services offering two factor authentication, after setting up the system, you are given a short list of backup codes (one-time pads) that are around 7-10 characters long. These are ...
6
votes
1answer
1k views

2FA: Difference between Storing Backup Codes & Secret Key

First of all, the secret key in discuss is defined as when you cannot scan a QR code in a 2FA setup process, there is a code that you can manually enter into your TOTP-generating device/app. Some ...
6
votes
1answer
1k views

Can I re-use another vendor's dual factor token in my own system? (Avoid physical token bloat)

I read the open source multifactor authentication techniques called HOTP RFC 4226 and TOTP RFC 6238 and realized that a single random number is the basis for the token's cryptography... and that this ...
6
votes
3answers
390 views

Why don't most banks in the UK use 2FA?

Common UK banks such as Halifax rely on internet banking which consists of a username, password and then picking several characters from a drop down list? Why is this more secure than using a ...
6
votes
1answer
1k views

How does “Unlock your Mac with Apple Watch” work? What should I consider in the Enterprise?

MacOS on 2013 and newer Macs have the following setting at the bottom in system preferences: Question How does "Allow your Apple Watch to unlock your Mac work? From what I've seen, it has a ...
6
votes
2answers
894 views

Should a 2FA recovery key be stored along with a password?

Many websites give you a recovery key or a list of recovery codes that can be used in place of 2FA tokens if you lose your phone or can't access your token generator. What are the recommended ...
6
votes
2answers
2k views

How do I block LinkedIn from extracting data from Microsoft Exchange Server?

LinkedIn now offers the ability to take a real user and password from the end user and connect to Exchange Server for the purpose of importing contacts into their system. (To do this yourself, click ...
5
votes
3answers
1k views

Aren't endpoint devices inherently MFA?

I was recently asked if MFA was leveraged for authentication on endpoint devices. My gut reaction is that given MFA is something you have, know, are, and you need to have the laptop to log into it and ...
5
votes
3answers
7k views

Jump Servers for security

In my network, I have the clients directly connected to the server; but in the new PCI policies, they required to use jump servers. What is the advantage of using jump servers for security reasons? ...
5
votes
2answers
201 views

2 factor authentication, fob management

I love the idea of 2 factor authentication but how can I make sure I'm not caught in the wind without such keys? I thought about switching to a fob for services that support it. Is there a fob that I ...
5
votes
3answers
739 views

Is login limiting still needed if we employ multi-factor authentication?

The status quo is that most online websites limit login attempts per IP address, or even per account since some attackers possess huge amounts of IP addresses. Removing login limits would have the ...
5
votes
1answer
272 views

Yubikey Desktop Authenticator

Would you say it is more secure to use Yubikey Desktop Authenticator than Google Authenticator? Instead of using Google Authenticator every time I want to login to some site I am wondering if it ...
5
votes
1answer
198 views

Is using desktop 2FA clients like Authy Desktop a good practice?

Basically 2FA relies on the idea that instead of just something you know, using a service also requires something you own. I am quite confident, especially when used on iOS (which has a better system ...
5
votes
2answers
1k views

How secure is a password app that stores both the password and two factor secret in one place?

Take for example 1Password, that now can store your password and one time password secret in a single place (your 1Password vault). I know it isn't truly two-factor anymore, but how much better is it ...
5
votes
2answers
3k views

How does multi factor authentication modify the AD authentication process?

I'm trying to understand what would have to be updated to make Windows-based systems support multifactor authentication. Possible things that might have to be modified: Active Directory / Domain ...
5
votes
2answers
421 views

Best Practice for MFA on Root AWS Accounts

I would like to enable multi-factor authentication on my organization's AWS root account, however I'm unsure of the best practices on how to do so. We already have separate IAM accounts for each ...
5
votes
1answer
271 views

Can WhatsApp recover Google Drive backups if the phone is not connected to the original Google account?

Last week Brazilian news outlets reported a scam involving WhatsApp where an attacker could get access to an WhatsApp account by activating the target phone number on a different device in control of ...
5
votes
2answers
386 views

Best practices for handling wrong TOTP tokens

Assume a 2FA system with user-supplied passwords and 6 digit TOTP tokens. It is not possible to test a TOTP token without authenticating with a password first, so whoever submits a token is presumed ...
5
votes
3answers
439 views

Does a Smartphone contain all the essential properties of a Smartcard? If not, what is missing?

Can a smartphone, alone, be a valid substitute for a Smartcard? If not, what is missing technically speaking? Does the TPM chipset (which I assume is in the phone) provide enough security to "act ...
5
votes
1answer
231 views

Storing base passwords in Lastpass

After watching Mr Robot I finally motivated myself to setup two factor authenitication for Lastpass with Yubikey. Fastmail is the second service I've set up with my Yubikey. I changed my main ...
5
votes
1answer
506 views

How secure is CertiVox M-PIN?

CertiVox have designed a system with the aim of "getting rid of passwords". Essentially the system authenticates users with two factors of authentication: A 4 digit PIN and a token stored within the ...
5
votes
2answers
194 views

AWS declined to give me details on Multi-Factor Authentication reset procedure

I asked AWS: How do I recover access to AWS Account in case I lost device with Google Authenticator installed? In case my email was hacked, what will prevent hacker from removing MFA? Their answer ...
5
votes
2answers
275 views

How safe is this “Multidimensional-Encryption method” (includes xAES, familiar from Unseen.is)?

I would like to ask about this encryption method that I found: USPTO patent and it is related to this question here: A service that claims beyond army level encryption and Unseen.is encryption claims ...
5
votes
1answer
128 views

Can I use a satellite phone for 2 factor auth sms and such?

Would 2 factor authentication SMS messages or other kinds of internet security notifications work with satellite phones? E.g. companies like Google, Paypal, Facebook, banking institutions and others ...
5
votes
1answer
3k views

Which cross-platform password managers support encryption using a hardware token?

I am looking for a really secure password manager and I really like the fact that Password Safe supports encryption/decryption using a Yubikey programmed in challenge-response mode. Read more here: ...
5
votes
1answer
556 views

Are Authy's tokens insecure?

I've been trying out Authy, a Google Authenticator alternative with an optional feature of being able to back up your tokens. They have two types of tokens: Authy-generated tokens and the regular OTP ...
5
votes
1answer
292 views

​Multi-factor Out of Band Token authentication options suitable as per NIST recommendations 800-63B (published in June, 2017)

In our web application project we are required to establish MF authentication with combination of memorised secret token (password) and Out of Bound token. Earlier we were planning to implement SMS ...
4
votes
4answers
731 views

Whatsapp is adding passwords: what is the threat model that they want to protect their users from?

Whatsapp has announced that they are introducing 2FA to their service. Normally, services rely on a password (what you know), and adding 2FA means that they require an additional code sent via SMS to ...
4
votes
2answers
151 views

Can Simultaneous Logins Occur When Two Users Have Both Pieces Of Two-Factor Authentication Information?

In a hypothetical situation (say a screen capture program or rootkit, where, incidentally, a password change will not make any difference) where an attacker has both your password, and sees the two-...
4
votes
3answers
1k views

AWS S3 and 2-factor (multifactor)

I have a client looking to use AWS S3 buckets for file transfer to other clients. That data may have some sort of protected data in it. I'd like to set up S3 to use 2-factor or MFA for the login/...
4
votes
1answer
1k views

what is a valid challenge for 2 factor authentication?

When designing password reset process: 1- Is a an email address or an assigned username a valid piece of information ( identifier) to ask for in two factor authentication? 2- How does two factor ...
4
votes
4answers
3k views

Best practices for storing 2FA recovery codes

I’ve recently started using 2FA on a bunch of services and I’m not sure how to best store the recovery codes. I can think of 3 options: In a secure note on LastPass In a Dropbox folder On a usb stick ...
4
votes
3answers
152 views

Can “something you are” be implemented without effectively turning into “something you know”?

According to what I've read and heard, multi-factor authentication is supposed to use multiple different types of authentication factors, rather than just different instances of the same kind (e.g. ...
4
votes
3answers
910 views

Does Google/Dropbox/Github Two-Step Verification count as Two-Factor?

This considers the route where somebody does not use the SMS option, but rather using TOTP, and the site offers a generated seed to input. Two factors questionably at use: password: something KNOWN ...
4
votes
1answer
355 views

What physical, electronic, and software characteristics are important in a smart card?

I'm evaluating smart card readers to store a number of private keys, but don't know where to start. What criteria is important regarding smart cards and preventing the extraction or unauthorized used ...
4
votes
3answers
332 views

How to evaluate different solutions for security tokens?

According to my own experience, most companies selling security tokens for authentication like RSA, Verisign or Aladdin share little information about the internals of their products like algorithms ...