Questions tagged [multi-factor]
a multi factor authentication requires at least two sets of credentials. This is typically something you know (e. g. a password) and something you own (e. g. a token generator or mobile phone), but could also be something you are (a biometric).
706
questions
0
votes
0
answers
35
views
Is Using an Authenticator App on the Same Device as the Passwordless Application a True 2FA?
I am building an application that a user can receive an access to by an internal worker. This works using a magic link, where the user will receive a one time link to authenticate in the app. Now I ...
0
votes
0
answers
51
views
Are 2FA browser plugins sufficiently secure?
Regarding 2FA browser plugins, I follow the uneducated opinion that they usually provide sufficient security. Since a desktop computer is a unique device (even a virtual machine) and provides that ...
- 101
0
votes
0
answers
75
views
If only 'two' insecure MFA options are available (email and sms) which is 'most secure'? [duplicate]
Although I disagree with the term MFA entirely if it refers to 'login code send to email', it's a one-time password at best, and likely badly implemented with its associated risks. I do see quite some ...
- 6,651
0
votes
0
answers
67
views
Are banks significantly reducing security by migrating everyone to mobile banking?
I have noticed a disturbing trend across banks (in the EU). Previously, many banks used 2FA by combining a login/password for an online banking website with a mobile authenticator app. However, many ...
- 841
2
votes
1
answer
110
views
Is TOTP "more secure" and harder to crack than HOTP and why?
In addition to my question: How many known time/result combinations does it take to guess a HOTP/TOTP secret?.
I've read often that TOTP is more secure than HOTP. One example:
TOTP provides higher ...
- 6,651
2
votes
0
answers
89
views
Why are Yubico Yubikeys limited to 32 OATH accounts? [closed]
Is the 32 OATH QR code account limit on Yubikeys due to a storage constraint?
Because the Yubikey 5 series has been out for a few years now it'd be amazing if there is a new version released soon with ...
- 123
0
votes
1
answer
128
views
What is the point of required user verification in WebAuthn?
User verification in WebAuthn can either be required, preferred, or discouraged. The last two are a hint to the authenticator that may be ignored. I see how they could be used to prevent client-side ...
- 153
0
votes
0
answers
49
views
Difference between PassKeys and using touch-id to login in Apps
PassKeys is a new way to sign-in to web-apps and mobile apps by FIDO alliance.
I looked at it and could understand how it works; However, I'm unable to understand difference from using touch-id to ...
0
votes
1
answer
89
views
Is using the computer for MFA safe?
Recently, I discovered that MFA apps just calculate that codes based on a private key and the time clock, so it's easy to use tools like gnu pass to replace those apps with your computer.
But what are ...
0
votes
0
answers
56
views
Two-Factor authentication bypass
I use two-factor authentication where possible, I was always under the impression that not only it prevents brute-force attacks, but makes it safer to use my accounts in untrusted environments.
I ...
- 101
0
votes
0
answers
184
views
Every time I log into Facebook, the SMS based 2FA code appears to get intercepted (UK)
Historically, whenever I logged in I got a standard looking text from "Facebook" stating my login code.
As of this morning, when I attempt to log in, I get a fake looking text from a random ...
0
votes
1
answer
69
views
Query on best practice - using 2FA to self-authorise IP addresses in an allow-list
I want to know whether a solution I'm considering for a web app is particularly secure / in line with best practices etc.
Scenario - a web application, it's a stock management app for small retailers. ...
0
votes
1
answer
130
views
Microsoft 2FA triggered without password?
Currently, I have someone attempting to login to my microsoft account. Upon looking at my activity history I am now seeing almost a hundred failed sign in attempts with the reason being "...
3
votes
0
answers
181
views
Can a bad guy ever get access to my gmail account using ONLY the 2fa app or ONLY the recovery phone (plus username)?
Let's say X is a malicious person.
Let's say I have a gmail account with a recovery phone and with 2fa
enabled. Let's say X knows the username but not the password. X doesn't have any other ...
- 131
3
votes
1
answer
287
views
When is FIPS certification important?
I was looking at YubiKeys and noticed that they sell FIPS certified keys alongside non-FIPS certified keys. Both seem to have the same feature sets, but the FIPS certified keys are more expensive. ...
- 185
0
votes
1
answer
84
views
2FA implementation security
I am looking to implement 2FA. I know of duo and eg. Eset secure authentication. But both solutions seem to be implemented in a strange way, that is they require some form of communication with either ...
- 461
0
votes
0
answers
17
views
Should I back up my Google Authenticator codes to my Google Account? [duplicate]
I just opened the Google Authenticator app and it says: "Sign in to back up your codes to your Google Account".
How is that secure?
I mean, wouldn't doing that essentially defeat the purpose ...
- 287
22
votes
2
answers
5k
views
What, if anything, can a person accomplish who has intercepted an emailed QR image for Authenticator?
A web hosting company has emailed me a QR code so I can have Authenticator generate a 6-digit PIN to use as the second factor after I've logged into my portal with username and password. What, if ...
- 341
1
vote
2
answers
71
views
Windows controlled folder access to secure Chrome cookies?
I've read about Linus Tech Tips hack, where a malware stole the browser cookies & was able to log in to Linus's channel.
Is this preventable with Windows controlled folder access (preventing apps ...
- 111
3
votes
2
answers
218
views
FIDO2: should I set user verification to "discouraged" with two-factor authentication?
I provide a web application that uses FIDO2 for two-factor authentication. Recently I got reports that Windows users have to enter a PIN each time they use their hardware token. As far as I understand,...
- 153
2
votes
2
answers
162
views
Why is individual user security important to a company?
Companies universally seem to invest massive amounts of time and development resources into protecting users from security-related crimes. The trend seems to be increasing steadily over the past 15 ...
- 273
1
vote
0
answers
152
views
How spammers are abusing 2fa SMS in web apps?
My webapp has an SMS 2FA option. When someone enrolls, it sends an SMS to the number specified by the user with hard coded text that contains a token that the user needs to then enter in the web app ...
- 213
0
votes
0
answers
64
views
How could one use multi-factor authentication to derive a static secret key?
Scenario:
The setup is that each user has a randomly generated key A used for encrypting data stored on the server and a password-derived key B used to store A on the server without the server getting ...
- 115
0
votes
1
answer
46
views
How to use MFA without relying on a smartphone? [closed]
We have a situation where our company's operators need to authenticate with a 6-character OTP on some websites.
For security reasons, we don't want them to use an app (eg.: Authy) on their personal ...
- 174
1
vote
2
answers
389
views
How am I meant to back up my second factors?
I currently use MFA wherever possible. To do so, I mainly use the Google Authenticator app, as well as a YubiKey. However, I recently realized that backing these up is very, very difficult.
YubiKey
...
- 111
1
vote
2
answers
384
views
How MS Authenticator works
When using MS Authenticator on a Microsoft account, the user fills in the email address or username. After that, the user presses one of the three numbers in the MS authenticator app and is logged in. ...
- 51
0
votes
1
answer
504
views
Implementing secure two factor authentication with Google Authenticator?
I would like to add two factor authentication to a login screen. My understanding of the process is the following:
Generate a QR Code
Scan this Code with Google Authenticator app
Use a library to ...
- 121
2
votes
1
answer
164
views
Should I display the 2FA secret only once or it can be always available?
A logged-in user enables 2FA for his account and a QR code with the secret is displayed.
Is it correct to display the same QR code again when the user visits the 2FA settings page after some time? Or ...
- 133
0
votes
1
answer
55
views
Does this implementation of 2FA expose valid credentials?
I have come across scenarios where a website would send OTP once a user has supplied valid username/password. A confirmation dialog e.g. An OTP has been sent to your registered mobile number would be ...
- 195
4
votes
2
answers
211
views
LastPass - Can MFA stop hackers from cracking a local vault?
After the recent LastPass security incidents (where old backup copies of users' encrypted vaults have leaked), I was wondering if an account had MFA configured at the time, it makes a difference for ...
- 141
0
votes
2
answers
587
views
How does a single mobile banking app implement a two factor authentication? [duplicate]
Recently I had more or less the same discussion with the helpdesk of several banks; a bank has a new mobile app that allows logging in without sending an SMS and without asking a confirmation code by ...
- 109
0
votes
1
answer
120
views
Why is physical security key helpful, since most accounts have alternative 2FA methods a hacker could use?
I would like to know why a physical security key is useful to have as default 2FA method given most accounts have some form of account recovery/alternative 2FA method. Google has had a bunch of ...
- 103
2
votes
3
answers
165
views
How should 2FA/MFA be implemented so it isn't easily bypassed?
At least twice now I heard most sites implement 2FA/MFA poorly and after X amount of attempts it should lock you out. They didn't give clear enough information for me to know what they're talking ...
- 21
2
votes
1
answer
1k
views
How to interpret a Google "Someone is trying to sign in to your account from another device" message?
I received this message on my Pixel 4a phone yesterday evening:
I pressed "No, it's not me" and then saw this message:
I was at home with a cat and five-year-old son. I was cooking and my ...
- 1,629
9
votes
2
answers
3k
views
Security of 2FA codes in-transit
I work on a service that handles user authentication & authorization. I recently added 2FA support (email, sms, TOTP) and while it works great, I was wondering about the security of the one-time ...
- 193
0
votes
0
answers
51
views
Benefit of only having MFA challenge on the very first login
I'm trying to select a suitable password store for a team - one of my main requirements is that users be authenticated via a removable key file rather than simply a master password.
I have been using ...
- 101
3
votes
2
answers
180
views
Is there any Security Benefits (auditing) to keeping old emails/text that give 2FA account codes?
Is there any Security Benefits/Risk in keeping old "Here is your 2FA login code" in email and text?
I always wonder if seeing one that is unread could queue me in to something bad happening ...
- 133
1
vote
0
answers
108
views
Going about sharing 2FA key between multiple login methods on a Synology NAS + browser & SSH authentication
I've recently acquired a Synology server (DS720+) and have it accessible outside my LAN via a VPN. I have 2FA on for logins to the server via the web portal, but I have found many use cases for ...
- 11
1
vote
1
answer
77
views
Does using TouchID and WebAuthn with a password manager defeat the 2FA?
For quite some time WebKit and others support WebAuthn. This allows for a pretty seamless 2FA experience with a key, like Yubico. On Apple devices TouchID/FaceID can also be used as a hardware key.
...
- 141
0
votes
1
answer
105
views
Why can't SMS be read online?
I am looking for a technical explanation from a security standpoint why SMS is, seemingly by principle, made impossible to read online whereas it looks it should be easily implemented. I have recently ...
- 165
3
votes
2
answers
243
views
Is asking users to enrol in SMS 2FA when they already have an authenticator good security practise?
I already have an authenticator for Amazon AWS, and I'm being regularly asked to add an SMS 2FA as well.
If I add SMS MFA, will I become vulnerable to sim-swapping attacks on that MFA?
Same thing with ...
- 1,132
1
vote
0
answers
217
views
Does having authenticator app/OTP generator built into Password Manager defeat its purpose?
For example the KeepassOTP plugin is one of a few plugins for Keepass, that allows users to view their OTP code from within the password manager itself. Does this defeat the purpose of having a OTP as ...
- 283
0
votes
1
answer
291
views
Rogue login to Google account after Windows clean install
Yesterday I downloaded a sketchy .exe on my Windows desktop and executed it. A command prompt window appeared then nothing abnormal happened. I tried running MalwareBytes but it didn't display any ...
- 11
2
votes
2
answers
181
views
What is the name for printed 2FA codes on a wallet card?
What is the correct name for the 2FA device that is printed codes on a wallet card?
These codes are sequentially numbered from 001 to 224. The log in screen displays 2 numbers in that range and the ...
- 943
3
votes
1
answer
520
views
Does Push 2FA protect against phishing/MitM better than TOTP?
I was having the debate of TOTP vs Push Notifications and found this claim online:
Is the 2FA method protected against phishing?
Chart Explanation: The most common method of phishing is persuading a
...
- 278
0
votes
1
answer
39
views
What is the two_factor_authentication.recovery_codes_regenerated security event in the GutHub account
I made some changes to my GitHub account security, notably I added two new hardware security keys and removed SMS as a 2FA backup method.
8 days later today, I randomly checked the GitHub's own ...
- 224
3
votes
1
answer
399
views
Does sending TOTP code along with username and password defeat the purpose of 2FA?
Related: Implementation flow of MFA with TOTP
I'm trying to implement 2FA with TOTP in my web application.
The implementation I've looked at (the ASP.NET Core implementation of 2FA) does something ...
- 33
0
votes
2
answers
80
views
Is this a valid use case for email 2FA?
We have a private website for our clients which needs a username and password for login to see protected information. The users are created by ourselves by petition of our clients for some of their ...
0
votes
1
answer
134
views
Can static IP address be used as a component of MFA? [duplicate]
Can I use static IP address as a component of 2 factor authentication for SFTP login?
0
votes
0
answers
120
views
Can OTPs substitute password? [duplicate]
One-time passwords (OTPs) usually serve as the 2nd factor in a 2FA scheme. But, in isolation, I believe they are more secure than passwords, since they are ephemeral and passwords are still badly ...
- 111