Questions tagged [multi-factor]

a multi factor authentication requires at least two sets of credentials. This is typically something you know (e. g. a password) and something you own (e. g. a token generator or mobile phone), but could also be something you are (a biometric).

Filter by
Sorted by
Tagged with
4
votes
3answers
911 views

Does Google/Dropbox/Github Two-Step Verification count as Two-Factor?

This considers the route where somebody does not use the SMS option, but rather using TOTP, and the site offers a generated seed to input. Two factors questionably at use: password: something KNOWN ...
4
votes
1answer
360 views

What physical, electronic, and software characteristics are important in a smart card?

I'm evaluating smart card readers to store a number of private keys, but don't know where to start. What criteria is important regarding smart cards and preventing the extraction or unauthorized used ...
4
votes
3answers
333 views

How to evaluate different solutions for security tokens?

According to my own experience, most companies selling security tokens for authentication like RSA, Verisign or Aladdin share little information about the internals of their products like algorithms ...
4
votes
3answers
459 views

Is receiving an OTP via email any more secure than receiving it via SMS?

I understand that getting OTPs via email and SMS are the weakest forms of 2FA, but given a situation where these two are the only options for 2FA, is email any better than SMS? (Assuming the email - ...
4
votes
3answers
146 views

What security does the new option for two factor authentication that Google offers enforce?

Google has announced a new option for two factor authentication - a popup message. How does this improve security?
4
votes
1answer
173 views

Are “Security SMS codes” any safer than plain SMS?

Many banking webapps send this kind of SMS, for their 2FA systems. These messages do not appear in the main "Messages" app, seemingly being destroyed after viewing - at least on iOS. Firstly, are ...
4
votes
2answers
327 views

Options for simple phone verification with pin delivery

My website needs to verify phone numbers in order to ensure that customers claiming a business actually work there. The service calls and gives the customer a pin which they put into the site. Many ...
4
votes
1answer
1k views

How many authentication factors are there?

The three classes that we all know and love: Something you know. Something you have. Something you are. I've also seen references to "somewhere you are". Is this really a fourth factor? How many ...
4
votes
1answer
1k views

OTP vs. U2F for online banking and email (vs. store key on USB)

Which one among OATH HOTP, OATH TOTP on one side (say in the form of a credit card-sized token) and U2F (say in the form of a USB key) on the other side you think is more secure for purposes like ...
4
votes
1answer
112 views

How secure are phones in the context of 2-factor authentication?

My bank started using 2-factor authentication with phone being part 2, so I am wondering is it difficult for someone to impersonate my mobile phone to receive the text message with the code?
4
votes
1answer
2k views

Is Dual Factor possible during boot with whole disk encryption on Mac FileVault 2

Mac FileVault 2 is the default disk encryption for newer Macs that occurs in the EFI pre-boot phase. The challenge here is that most smartcard drivers are loaded after the OS loads. Is anyone aware ...
4
votes
2answers
132 views

Amazon 2FA: Compromising the email leads to compromising 2FA, e.g removing the other factor?

I had some interesting situation: My Amazon account has 2FA enabled where my smartphone with google authenticator is my second factor. Due to issues with this phone my second factor basically broke (...
4
votes
1answer
205 views

Can I use Authenticator instead of phone number for Gmail 2FA? [closed]

I want to enable Two-Factor Authentication for my gmail accunt, but when setting this up it asks for my phone number. I don't have a phone (that I want to connect to Gmail), is there another way to ...
4
votes
1answer
1k views

Blackberry + RIM Bluetooth-based Smart Card Reader

Has anyone used this Bluetooth based smartcard reader? (scroll to bottom) If so, what are your experiences with it? Can you tell me if it's possible to require only the presence of the card + card ...
4
votes
2answers
172 views

Out of band verification using phone; a fallacy?

More and more websites nowadays require new users to verify their 'identity' by requesting the user prove that he/she has access to a device identified by a telephone number (typically a phone). The ...
4
votes
2answers
177 views

Where can 2-factor fail in Google?

I was one of the people who thought that enabling 2-factor in Apple would have prevented the download of images from iCloud; it was recently pointed out to me that, in fact, I was gravely mistaken. ...
4
votes
3answers
339 views

Using MFA to connect to windows shares on domain controller

I have a requirement to force MFA for all non-console administrative access to our Windows AD servers. I've sorted out log ins with RSA, but that does not prevent a domain admin from mapping a drive ...
4
votes
1answer
15k views

How secure is Yahoo Account Key?

I (along with a billion or so other people) was notified about my Yahoo! account being potentially compromised yesterday. While I'm not worried about that (I have changed my password since then, have ...
4
votes
2answers
963 views

Comparing the 2FA Vendors

If we need to choose a vendor for the 2FA in our environment, what are the features that we should look for? Our selection process depends on the functionality and usability they provide. But when I ...
4
votes
1answer
68 views

Generating QR code from seed in browser - possible security issue?

I need to implement 2FA in my web app. I'm doing this the standard way: the newly created user's seed is retrieved from the server(I use speakeasy) and the QR code is generated. The thing is, it's ...
4
votes
4answers
481 views

Phone number setup for security

Several Q&As here highlight the danger of phone hacking. For example, this. In a nutshell, the solution is to NOT give your phone number, except to your bank or government. Unfortunately, that ...
4
votes
1answer
648 views

Spooky behaviour with Authy

So today I got Authy, (because I wanted 2FA on my google account). Anyway, it works grand, and I scanned the google QR code and all works well. One thing is weird though, I have coinbase on my ...
4
votes
0answers
531 views

Is it possible to reuse a OTP Token with another security provider? [closed]

My bank issued a new security device replacing the Go 3 Security Token manufactured by Vasco and I would like to know if it could be used with my Google multifactor security or with LastPass as a ...
3
votes
2answers
10k views

Could “receive SMS online” site be a scam?

There is a site that allows you to see all SMS received by a certain set of phone numbers (owned by the site). This seems to be meant for services that require two-factor authentication using SMS, ...
3
votes
3answers
226 views

Does revealing two factor codes reduce security?

If I were to publicly display the 6 digit code from my google authenticator, would my account security be diminished beyond it's valid life time? What if it were the code and the time it was ...
3
votes
3answers
759 views

Traditional 2FA versus PIN + OTP

I've just migrated to a new email company and they offer a type of 2FA I've never came across before. Traditionally in 2FA you enter username and password then are presented with a screen asking for ...
3
votes
2answers
3k views

Is Paypal's 2FA Security really this bad? [closed]

I'm by now means an expert in this field, or even well versed, but if it's possible to do this, I can't comprehend how Paypal allows it. Say you have 2 factor authentication on, with your phone setup ...
3
votes
2answers
451 views

Two Factor Authentication with PIN - Does where/how you enter a PIN matter?

Say I have two websites with 2FA mechanisms that are otherwise identical. Mechanism 1 You have to enter a PIN into your Token Generator in order to retrieve your One Time Password. On the website, ...
3
votes
3answers
163 views

Additional confirmation for online bank payments

Nowadays, when someone is making an online payment, the associated bank often requires an authentication step. As far as I know, there are mainly two ways to do this: SMS Verification. The Bank ...
3
votes
2answers
475 views

Should the serial number of multi factor devices be removed?

I'm trying to understand the relationship between the serial number of a multi factor device and the cryptographic material behind it. I don't want to blindly assume that the serial number is just ...
3
votes
1answer
1k views

How does the YubiKey Validation Server work from an encryption perspective?

Many YubiKey servers rely on the free cloud hosted authentication that comes with the product, but I'm interested in keeping all cryptographic material in my control. For that reason I am looking at ...
3
votes
2answers
250 views

What is the safest Google account recovery option?

I have a Google account with a strong password and 2-factor authentication set up, and I worry about what would happen if I lost my phone with the 2FA app. I want to set up a recovery option, and I ...
3
votes
1answer
683 views

Is the idea of Single Sign-On (SSO) a flawed concept without Two-Factor Authentication (2FA)?

Before this gets flagged as a duplicate, I'm not asking a question about the disadvantages of single sign-on, I'm asking if the initial concept is flawed to begin with without enforcing two-factor ...
3
votes
2answers
176 views

How do I verify a user over the telephone?

We have users -they can call us on the telephone. How do we validate that the users are who they say they are? Here are some possible solutions: Check personal information such as date of birth: DOB ...
3
votes
1answer
529 views

How is github 2FA personal access token more secure than passphrase?

I recently enabled 2-factor authentication (2FA) on my github account. Once you enable 2FA, you can no longer connect to the repo using your normal passphrase using command line tools. You have to ...
3
votes
1answer
536 views

Revoke and regeneration in FIDO U2F / FIDO UAF

One of the benefits of using Software based Strong Authentication apps (e.g. RSA SecurID Software Tokens) is that if the device that is running the Token generation app is compromised or lost, the ID ...
3
votes
1answer
1k views

Do non-browser clients work around Gmail's 2-factor authentication?

If you use a client like mutt to access your mail, you probably know that it doesn't support 2-factor authentication. It still prompts only for a password - either your account password or, in the ...
3
votes
1answer
234 views

What to do if a user loses access to his authenticator code?

I have a web service that I set up which allows users to protect their accounts via two factor authentication via an authenticator app like Google Authenticator and Authy. When enabling it, I mention ...
3
votes
3answers
535 views

How do websites protect against 2fa replay attacks?

I'm imagining a scenario where an attacker can read traffic between a user and a server. The attacker grabs the user's password and the 2fa code they used. The attacker then logs in with that ...
3
votes
1answer
203 views

Why not authenticate with the user sending an SMS? [duplicate]

Every time I do 2-factor authentication on a mobile app, it sends me a message with a security code. I understand this is weak because the SMS system can be hacked to redirect your messages to another ...
3
votes
4answers
4k views

Hardware-Based Password Manager

Folks, I'm trying to improve my password management, and I have a vision in mind for a solution. However, I'm having a problem putting it all together or finding a product(s) that fits. First I ...
3
votes
2answers
488 views

Concatenating files encrypted by same key

Background: I'm planning a setup that involves storing passwords as individual encrypted files (using the password manager pass), and then storing the private key needed to decrypt those passwords on ...
3
votes
2answers
407 views

False acceptance rate in biometric authentication for sensitive information

Every type of biometric authentication will have a false acceptance rate, which is the likelihood that the system will incorrectly accept an access attempt by an unauthorized user. Of course, when ...
3
votes
2answers
1k views

Restrict user login to a specific machine

How do you restrict user access to a corporate web site to a particular machine ? including the following conditions : Each user is meant to use his credentials ONLY from the assigned machine. The ...
3
votes
4answers
280 views

How can I maintain my two factor authentication when my phone is in for repairs?

I recently got a new phone that has various hardware issues with it. As such, before the warranty expires, I need to send it back for repairs. Unfortunately, I already have Google Authenticator ...
3
votes
5answers
390 views

do password managers count as a MFA authentication factor

When users store complicated and unremembered passwords in password manager service such as lastpass, what authentication factor does the lastpass access represent? Does forcing the need for a ...
3
votes
1answer
2k views

Relative merits of Yubico OTP vs. OATH-HOTP?

What are the pros and cons of using Yubico OTP vs. OATH-HOTP? They both seem very similar.
3
votes
1answer
1k views

Can two TOTP clients register at the same time and generate the same tokens?

Note that I'm not talking about systems like Authy, where you can log in to your account on multiple devices and sync your tokens between them -- I'm referring to two completely separate devices that ...
3
votes
2answers
1k views

Is TextKey SMS 2 factor authentication secure against cell phone cloning?

I came across this website today that implements SMS based authentication that works "opposite" most SMS authentication methods. In typical SMS authentication, the provider sends you an access code ...
3
votes
1answer
1k views

What is more secure for voice and SMS OTP: A random number or generated similar to HOTP?

Many providers are creating OTP authentication for their sign in. However I noticed that all the voice and SMS OTPs I've come across are a series of 6 digits... similar to the HOTP RFC Standard ...