Questions tagged [multi-factor]

a multi factor authentication requires at least two sets of credentials. This is typically something you know (e. g. a password) and something you own (e. g. a token generator or mobile phone), but could also be something you are (a biometric).

Filter by
Sorted by
Tagged with
0
votes
1answer
54 views

Preventing account enumeration with 2FA

What are some methods for preventing account enumeration on login when accounts have optional two factor authentication? Without two factor authentication we would just return the same response for ...
0
votes
1answer
53 views

Need help on 2FA QRcode security

In reference to OTP 2FA Auth apps: I'm trying to understand the concept of the QRcode being more secure in-transit than SMS? Is it because the QRcode itself is not of any value to fraudulent ...
0
votes
1answer
105 views

Does FIDO2 token works as two-factor on password-less authentication?

As authentication factors, I know the following You are (e.g. Biometrics) You have (e.g. USB) You know (e.g. Password) If I use a FIDO2 certified fingerprint reader for password-less authentication ...
0
votes
1answer
48 views

Impact on required password entropy when introducing two-factor authentication [duplicate]

Is there a best practice or rule of thumb for the impact of introducting two-factor authentication on the required entropy of a used password? Say we consider 80 bits of entropy to be sufficient for ...
0
votes
1answer
41 views

What are the risks when using QR to authenticate when using offline MFA in cases network is unavailable due to a network outage

if the PingID service is unreachable the user will receive a QR code on an offline authentication screen. in case of Offline MFA when the network is unavailable due to a network outage (i.e. in an ...
0
votes
2answers
59 views

Disable Office 365 2FA before period of leave without phone?

On enablement of 2FA in Office 365 Admin center, the only offered 2FA methods are Text message Call Notification in Authenticator app Passcode in Authenticator app Obviously, all of them require me ...
0
votes
1answer
39 views

Does the number of fingerprints we leave represent a security threat to the banking system?

A number of major banks are allowing users to log in to their bank accounts with only fingerprints. It was occurring to me, though: how many fingerprints does the average person leave per day? How ...
0
votes
1answer
100 views

Does the device you are logging into count as one of the factors for MFA when you are using device biometrics? [duplicate]

Yes it does because I 'have' the physical device I 'am' the owner of the fingerprint But no it doesn't because 1=>2 : If you have my device the fingerprint is now something you can get. Which ...
0
votes
1answer
111 views

Gmail sign-in with 2 step verification secure enough for money-generating YouTube channel [closed]

My goal is to find out if the sign-in process of a personal Gmail account with 2-step verification turned on, is enough from a security point of view, to serve as the sign-in process for a YouTube ...
0
votes
1answer
54 views

What are possible security issue if any of automatically inserting 2FA in 1password? [duplicate]

I've heard that 1password have a feature. We basically stored the QR codes for google 2FA in 1 password. 1 password then tell us the google 2FA keys everytime we logged in. https://support....
0
votes
2answers
117 views

Can a hacker compromise the system if he can steal one of the factors of the 2FA?

I read this article saying that smartcards used as a 2FA are still susceptible to attacks such as MITM attack: They think 2FA is unhackable...undefeatable, when that clearly isn’t true. They think ...
0
votes
2answers
130 views

Help to review 2FA algorithm

First of all, I know, don't reinvent the wheel... But there's a good reason for this. So I have been implementing a generic 2 factor authentication code generation/validation algorithm in order to re-...
0
votes
1answer
39 views

Algorithms for 2FA over HTTPS?

I'm developing an Authenticator App for use towards my own API. I know about the TOTP standard RFC 6238 and the HOTP variant. Though I would prefer to use a public/private key based solution (by only ...
0
votes
1answer
30 views

With uploading to AppStores - what problem do all the certificates fix above Two Step Authorization?

So if you ask around on the internet you see a lot of people frustrated with the whole signing and certificate jungle when trying to upload apps to the App Store. Of course on this channel for a lot ...
0
votes
1answer
100 views

Could a session id be considered as a valid factor in 2FA?

As is stated in this question: Two-factor or multi factor authentication is based on three possible forms of authentication: Something you know which is considered secret (password) ...
0
votes
2answers
3k views

Where can I find Google Backup Codes? [closed]

I am traveling long term and I don't want to put my SIM card in the phone every month to receive the SMS code when signing-in to Google (I always recieve 10+ other text messages which costs me a lot). ...
0
votes
1answer
104 views

Why send multiple codes and ask the user to input only one?

Consider the following (real-world) scenario: When making a credit/debit card purchase online, the bank sends an SMS containing 4 different numbered “passwords” and then prompts the user to enter a ...
0
votes
1answer
63 views

Two-Factor Authentication on downloadable client but not website

A friend of mine plays RuneScape, and mentioned to me that her account was recently compromised. She told me she has two step authentication on her RuneScape account, and on the email address ...
0
votes
3answers
480 views

is sms two factor authentication possible to add to SSHing into an AWS EC2?

I'd like to know if I can further secure an AWS EC2 stack (in addition to the .pem file and the allowed SSH inbound ip address security-group) by requiring that an sms authentication code be entered ...
0
votes
1answer
193 views

Would it be a good idea to develop your own multi-factor authentication?

For a project we working on we need to implement multi-factor authentication. We where planning to do this with an NFC card and an NFC reader which we are going to build with an Arduino. The planned ...
0
votes
2answers
1k views

Is it safe to connect phone to desktop computer on USB?

For example, if my phone is compromised, can it execute code on my desktop computer just by plugging it in USB? Or vice versa. I ask because banks' and other services' 2-factor authentication commonly ...
0
votes
2answers
5k views

Use Public Key or Password and PAM verification code

So I've been reading more and more about how (relatively) easy it is to have your Ubuntu server compromised and suffice to say have become a tad paranoid by this fact. I've setup Multi Factor ...
0
votes
2answers
89 views

Is it less secure to require password and phone on sign in?

I'm concerned about the security of a system that requires its users to enter both their "email & password" and also their registered phone number which has to be verified upon each login. To me ...
0
votes
2answers
612 views

Hacked, is my IOS systems safe?Werid things? [closed]

I hope this finds you well. I wanted to thank you in advance for your time and patience with me, and my questions. I was Hacked by friends of an X-boyfriend from HighSchool. He was a Foriegn ...
0
votes
1answer
891 views

Two factor authentication for web application under PCI DSS

PCI DSS 8.3 is stated as follows 8.3 Incorporate two-factor authentication for remote network access originating from outside the network by personnel (including users and administrators) and all ...
0
votes
1answer
1k views

What are the pros and cons of enabling 2 factor authentication on internal user workstations of an organization?

An organization has all the regular controls you can think of for network and systems protection from the 10 security domains. External login access to the organization's services is protected with 2 ...
0
votes
1answer
263 views

Using Gmail in China triggered lots of Two Factor SMS

A friend of mine lives in Hong Kong and she travelled to China over the weekend. Whilst there, she was able to use Gmail on her Android phone without logging in again, but she had to re-login on her ...
0
votes
1answer
265 views

What are techniques for end users to select keys on a smartcard?

When multiple keys exist on a given smartcard, how can a user choose between them for a given identifier ... ideally without a loss of privacy? For example suppose I have a government issued ID that ...
0
votes
1answer
61 views

For two-factor authentication is it a security issue to have phone authentication and Google Titan Security Key?

I am trying to setup my Google account to have some proper security. But I'm finding parts of it confusing. I used to just use my phone as my 2FA device. Where I would get a texted code. Then I ...
0
votes
0answers
40 views

Gmail's MFA for team?

We have mailboxes on G-Suite from Goole. Currently, we are enabling MFA for all boxes in our team, but what boxes which are used by different people? For now, I found a few solutions, each with its ...
0
votes
0answers
41 views

Sufficient to only require 2FA for su elevation?

I have a small web-facing server on my home network. It is headless, and the only way to log in is to ssh with pubkey authentication from within the local network. I wanted to turn on a 2FA ...
0
votes
0answers
30 views

Azure AD — How to only allow MFA configuration from a trusted network?

Hopefully someone as an idea... In Azure AD, how can we allow MFA setup by a user but only allow that configuration to occur on a trusted network? We have trusted networks defined but everything we ...
0
votes
0answers
53 views

User access control and management in AWS Environment

wondering what other SMBs are doing to manage dynamic access requirements for AWS platform. Currently we have 3 IAM roles (admin, dev, readonly) which users can choose after authenticating with https:...
0
votes
1answer
141 views

Two Factor Authentication Multiple Devices

Most websites (that I have seen) that implement two factor authentication don't support multiple two factor authentication devices linked to one account. The biggest reasons I can think of for that ...
0
votes
0answers
18 views

Is password + laptop a multiple factor authentication? [duplicate]

The definition according to Wikipedia: Multi-factor authentication (MFA) is an authentication method in which a computer user is granted access only after successfully presenting two or more ...
0
votes
1answer
58 views

How does DUO push button method and other methods actually work?

Google authenticator uses HOTP and TOTP algorithm for TFA. What is the basic working principle of DUO push? What brings security to DUO push?
0
votes
0answers
293 views

Two-factor authentication on Galaxy Watch - should secrets be encrypted, and is this SQLite example secure?

I recently got a Galaxy Watch and to get acquainted with developing apps for it I'm writing a simple two factor authenticator to generate TOTP codes from entered secrets using the Google Authenticator ...
0
votes
1answer
83 views

What should be done if 2FA was turned off in an unexpected manner?

Today when I logged in Facebook, no 2FA was shown. I have been using SMS message as the second authentication factor. When I looked at the security settings, 2FA seemed to be disabled. I immediately ...
0
votes
0answers
52 views

Leaking information about 2FA status

I was asked to provide a public web interface which is given an email addresses (which belong to our users) for public clients (e.g. a web application or native mobile application) whether or not a ...
0
votes
2answers
425 views

How does google know if I am logging in from a new machine(using web browser)? [duplicate]

Every time i sign into my google account on a web browser on a new machine, it warns me of suspicious activity. How does google know its a new machine? I am trying to implement a similar thing for my ...
0
votes
0answers
492 views

What are the security consequences of allowing 2FA app (Google Authenticator) to display the seed?

Excuse me if my question is a little bit convoluted. I prefer to share the full story, background information, so that accidentally I'm not asking XY question. Background info I'm using 2FA pretty ...
0
votes
2answers
33 views

Where can I find vendor neutral info and best practices on MFA using mobile? [closed]

I am looking for above information from both developer and architect perspectives.
0
votes
1answer
688 views

2FA with Windows NPS

I would like to set up two-factor authentication for my Wireless users. I have an Windows NPS server that is currently authenticating my wireless users and I want to add certificates or any other ...
0
votes
0answers
313 views

Is there software available for two-factor, biometric authentication to the OS?

Many fingerprint readers and other biometric authentication devices come with software for single-factor authentication to the OS. Is there any third-party software (F/OSS or otherwise) available for ...
0
votes
2answers
2k views

Strange messages from Gmail regarding my recovery email address changing

I have several google/gmail accounts for various purposes. This morning I woke up to the following message from google saying the recovery email address had changed. Here is the email Your ...
0
votes
1answer
75 views

Protecting third-party credentials in a web database in light of weak passwords

I need to store third party credentials in a database for a web application. The third party supports OAUTH and I plan on getting a long-lived token to allow my app to access the third party, but I ...
0
votes
2answers
79 views

Can you use Google's authenticator app when Google “makes sure that you’re really you”?

I've heard that you can configure your Google account to use its (more secure) authenticator app rather than sending you a text message - in my most recent case, this was when Google sent me a text ...
-1
votes
5answers
2k views

Is it possible to bypass two step authentication process?

Is it possible for a hacker to bypass two step authentication process if the hacker has no physical access to my phone?
-1
votes
1answer
405 views

Is there any traditional ways to bypass Gmail two-factor-authentication (2FA)? Please explain if it is possible [closed]

I'm currently using 4 or 5 Gmail and I'm using 2FA in all of my Gmail. So I want to know is it possible to bypass Gmail 2FA system? If it is possible then what it is? And I also use strong password ...
-1
votes
1answer
146 views

Can OTP 2FA be reversibly determined?

Please note: I'm not necessarily talking about what happens when one shoulder surfs someone inputting a OTP. I'm fairly confident that it's nearly impossible (or extremely impractical) to guess the ...