Questions tagged [multi-factor]

a multi factor authentication requires at least two sets of credentials. This is typically something you know (e. g. a password) and something you own (e. g. a token generator or mobile phone), but could also be something you are (a biometric).

Filter by
Sorted by
Tagged with
3
votes
1answer
337 views

SMS based 2FA intercepts

Reddit just revealed that they experienced a security breach as a result of an intercepted SMS based 2FA. Another post on SMS 2FA refers to flaw in the telecom’s ss7 protocol that was used to perform ...
3
votes
1answer
141 views

Duo Security forgot password workflow

I'm updating my company's forgot password workflow. Currently we use Duo Security as our second factor on login (but for the purposes of my question this can be any such service). I've been walking ...
3
votes
1answer
110 views

How can an account be accessed even though two-step authentication?

Facebook uses two-step authentication or "login approval", which means that all unrecognized devices will have to enter a code received through SMS. Suppose my Samsung device is the only device that ...
3
votes
2answers
1k views

App-based 2FA versus Hardware-based 2FA

How do apps like Symantec VIP / Okta Verify and similar implementations compare to using a hardware auth token such as the recent U2F devices? How real is the possibility of an Android system being ...
3
votes
1answer
161 views

what to do if your online banking has low security standards

What can I do if I think that my online banking service is not secure enough? the bank I'm considering is hsbc us (but I believe such issues are common to many) and here's two items that I believe ...
3
votes
1answer
97 views

If I add two accounts to the same 2FA app, are those accounts linked from a privacy point of view?

An important technique in maintaining online privacy is to keep separate accounts unlinked. A person may have one email address for everyday use and a second one for something more sensitive. If this ...
3
votes
4answers
837 views

Multi-Single-Factor vs. Multi-Factor Authentication

I was told at university that there exists a difference between the terms Multi Single Factor and Multi-Factor: Multiple single-factor-authenticator are presented to a verifier. Each of them will ...
3
votes
4answers
602 views

What makes VoIP more vulnerable than a “normal” phone line?

NIST is deprecating VoIP SMS authentication. I don't understand the decision. What makes VoIP any more vulnerable than a traditional phone line? From the consumer side, I don't even know how to tell ...
3
votes
3answers
380 views

Is multi-factor authentication supported by any current bios?

Is multi-factor authentication supported by any current bios'es? Update What I want to do is to make it impossible to go into the bios setup without both a password and another factor. It would ...
3
votes
1answer
158 views

Is Duo MFA vulnerable to a SIM swap exploit?

I'm looking into MFA options for a group of around 1000 people. Duo is intriguing, but I'm not sure I'm comfortable implementing something that incorporates text messaging (in contrast to something ...
3
votes
1answer
141 views

Google Authenticator - Showing someone my code [duplicate]

I want to create a video. During the video I need to login in to some website. I will use the one-time code from my google authenticator app. Is it safe to show this one-time code to the people or ...
3
votes
1answer
126 views

How can I back up my iPhone without compromising my 2FA and master keys?

I've noticed that when I restore my old iPhone's backup to a new iPhone, 1Password's master-key (which is never supposed to leave the device 1Password is installed on, and you transfer manually), my ...
3
votes
1answer
451 views

Algorithm used in grid card authentication

I have seen banks using grid card authentication after primary password based login. However, I am unable to find sufficient detail as to how it is being used. Is the challenge truly random or pseudo ...
3
votes
1answer
501 views

In the context of FIDO U2F, when is a new ephemeral key reused, or cached?

I'm reading this paper from Yubico on Universal Second Factor and OpenID Connect and see the description about ephemeral keys I'm confused on when a ephemeral key is used, and under what conditions ...
3
votes
1answer
2k views

Why does Google Authenticator have different codes on different devices? [duplicate]

I just recovered from a headache after realizing the code given by Google Authenticator on my new phone is different than the one on my old phone. Given how it works I thought they would be the same ...
3
votes
1answer
124 views

What is the recommended procedure for migrating 2-factor authentication to a new device?

A common scenario encountered with 2-factor authentication on mobile devices using, for example Google Authenticator, is migrating authentication to a new device. A natural way to accomplish this is ...
3
votes
1answer
261 views

OTP on the same device being used to login

I've seen mobile apps use two factor authentication by sending an SMS to the mobile phone. However, if I've stolen someone's phone, where is the security advantage? I can understand it if it's used in ...
3
votes
1answer
69 views

Securing 2 factor data from apps that are co-located on the same device?

Several apps such as GMail, Coinbase, Yahoo and others require the use of the mobile device to gain access to the data within the app. For example Gmail requires TOTP in Google Authenticator (...
3
votes
2answers
691 views

How can LastPass enforce 2-factor authentication

I've recently started using LastPass and one of the things you can set as a policy for you password vault is Prevent offline access when using Google Authenticator. The local cache can be ...
3
votes
1answer
88 views

Does RADIUS allow for eventual, gradual adoption of 2 Factor auth in an AD Environment?

We have several applications that leverage AD SAML (via Ping Federate) LDAP authentication from 3rd party applications Windows workstation / Exchange auth (Kerberos) IIS and web components (su4user, ...
3
votes
0answers
41 views

Is it a good idea to store TOTP tokens in a (synchronised) password safe? [duplicate]

Bitwarden (as an example) allows you to store your TOTP tokens in it. That is: you can use the mobile app to scan the QR code that (e.g.) Amazon AWS gives you, and then it'll generate TOTP codes. So ...
3
votes
0answers
162 views

Can SS7 attacks intercept SMS sent to a Google Voice number?

Hackers are able to steal 2FA SMS messages by exploiting SS7. As far as my understanding goes, this means gaining access to the SS7 system and then broadcasting a message akin to "This number is ...
3
votes
1answer
536 views

Authy reviewed? [closed]

Authy looks like a great solution - especially for laymen, in order to simplify complexities - but I have some nagging concerns re privacy & security, especially when sensitive data is hosted "on ...
3
votes
0answers
180 views

U2F FIDO sends identifiable serial numbers

As all of the FIDO Alliance documents state, the FIDO U2F protocols should never be able to abused to identify whether a user has multiple accounts with one service, or for services to collude and ...
2
votes
5answers
926 views

How secure is this two factor authentication?

I am working on an App that has a login page with a field for username and password, if the password is entered correctly it then asks for the users pin (4-digit code). My question, does having a pin ...
2
votes
2answers
202 views

Why bother with certain types of 2fa if they can be easily bypassed?

In the wild, there is a method of bypassing 2fa. The gist of it is that the attacker doesn't just phish the password, but they also phish the 2nd factor and use those for a real login on their own ...
2
votes
2answers
1k views

How to implement 2FA without user phone

I have a problem: users share their credentials with other users. I have to create a way to ensure that users are using their own credentials to access the system. I think creating a 2 factor ...
2
votes
4answers
357 views

What's the idea of two factor authentication? A hacker can use password with mobile

2-factor authentication means to enter MOBILE app (using username and password) and there you get code to enter your account from PC browser, right? But if hacker has my password, then he can enter ...
2
votes
1answer
1k views

Maximum tries for 2FA code?

I am building a website and I am implementing two factor authentication (2FA). The second factor will be a random 6 digit code like those from Authy. This site will store very confidential information....
2
votes
4answers
430 views

Does a two-factor authentication dongle (OTP) which is always inserted in MacBook add a security benefit?

I think to get a Yubikey and read that Keepass with OTP makes no sense No. Security remains the same + extra cognitive overhead. I try to store all data local and use seldom cloud based services. If ...
2
votes
2answers
1k views

Is email OTP improving the security for 2 phase authentication?

There has been similar questions before where people say that using some other means (sms, hardware devices, etc.) is a more secure way to provide 2 factor authentication. Provided we don't have an ...
2
votes
1answer
147 views

Does Time-based One Time Password improves security in case of database leak?

From what I understand, Time-based One Time Passwords used a seed and a mathematical algorithm to generate unique passwords. As the seed is known by the user (or the device used by the user), and the ...
2
votes
2answers
283 views

generation of keys for U2F

When I buy an U2F device, say a Yubikey smart-card, does the vendor hardcode on it a private key that will be later used in a challenge-response mechanism by the user, or do they only put in there ...
2
votes
2answers
1k views

Are there Yubikey-like TOTP hardware tokens without additional software? [closed]

I am looking for a way to replace my phone as a 2FA method. U2F is not universally supported. Most services that I use support TOTP (Google Authenticator), and so I thought the Yubikey would support ...
2
votes
3answers
437 views

Is using the 2FA secret on the same machine as using the credentials, removing one factor of 2FA?

In other words: Is saving or using the two-factor authentication (2FA) secret on the same machine to generate one-time passwords (OTP), breaking the two-factor authentication (2FA) concept since it's ...
2
votes
2answers
714 views

For 2FA, is one method better (more secure) than another?

There are a variety of options available for 2FA - LastPass, for example, offers all of the following options: LastPass Authenticator Duo Security Authentication Google Authenticator Yubikey ...
2
votes
1answer
96 views

Accounts being accessed from X country

So recently I've been getting emails that X account has been accessed from Y country with an IP address that I obviously don't own. An example would be my Steam account which recently got accessed ...
2
votes
3answers
104 views

How to provide two factor authentication code text messages, so that they are not shown on the lock screen?

It's a commonly discussed problem that when a service sends an authentication to the user's phone, the code is often displayed in the preview on the lock screen, which means it's visible to anyone who ...
2
votes
1answer
67 views

Does password strength matter when using a YubiKey? [duplicate]

I'm considering buying a YubiKey. I already use a password manager which can generate strong passwords, but I wonder if there's even a point with the YubiKey. I guess it just makes one extra step......
2
votes
3answers
771 views

Does the existence of two-factor recovery codes mean that my 2-factor code isn't completely random?

With some services that use standard 6-digit TOTP codes, they also offer the ability to have a set of backup codes, in case you lose your two factor device. With Google, for example, you can print ...
2
votes
1answer
142 views

Two factor authentication: Why ask for password first? [duplicate]

Every website that I came across that uses two-factor authentication asks the user for their password first. Then, after a correct password was entered, an SMS or an e-mail is sent that contains ...
2
votes
3answers
1k views

Storing password in sqlite vs asking user to type it in every time

I am making an Android app that needs to be very secure. For authentication to the server, it will use 2-factor authentication that includes: username/password sms verification I can't use client ...
2
votes
1answer
93 views

Digital time capsule system

I want to create a system for sensitive information that is only accessible if you have a specific tablet and a specific USB thumb drive. I want to setup such a system for my daughter when she is a ...
2
votes
2answers
157 views

Periodic password change needed when using 2-step verification?

I know that it's considered good online security hygiene to change one's login passwords every 6 months or so. Is that needed on sites with 2-step verification? Isn't the 2nd step what will keep my ...
2
votes
3answers
128 views

Will having 2FA protect me on a potentially insecure network?

Whenever I browse to a Google site on my Library's network, I get this screen: Presumably this is so they can "protect" children (anyone with a library card who is under 13) from unsafe videos as ...
2
votes
2answers
150 views

Is stand-alone one-time password less secure than OTP + traditional password auth?

I have a client that would like to use one-time passwords (via SMS or Email) for their app, and their requirements spec does not include traditional password-based authentication. I haven't seen this ...
2
votes
4answers
98 views

What are some existing or ideas where the use of a password can be replaced to login to a service? [closed]

The password has been a method of authentication for a long time now and we always hear of breaches happening where users passwords get stolen and sometimes are not even hashed at all or correctly. ...
2
votes
1answer
82 views

What kind of attacks are mitigated by 2FA/MFA in Industry sector?

I would like to understand the real role of 2-Factor Authentication in Industry Control Systems like SCADA/SmartGrid with Windows AD infrastructure. In particular I am interested in an operational use ...
2
votes
2answers
226 views

How does concatenating a user password and a YubiKey OTP work?

I use a Yubikey to log in to a VPN. When logging in, I supply a username, and then type a password, and without hitting return, touch the Yubikey. As far as I understand, and from experimenting, the ...
2
votes
2answers
1k views

Received an unsolicited two-factor security code on my phone: bad?

As above, I received a code (twice!) on my phone for a security code for PayPal with no further text than the number. Should I be worried someone has successfully obtained my password and accidentally ...