Skip to main content

Questions tagged [multi-factor]

a multi factor authentication requires at least two sets of credentials. This is typically something you know (e. g. a password) and something you own (e. g. a token generator or mobile phone), but could also be something you are (a biometric).

Filter by
Sorted by
Tagged with
4 votes
1 answer
460 views

How important is HOTP/TOTP secret key security?

I'm prototyping an application that generates MFA codes. For developer simplicity I'm storing source data in clear text in Google Authenticator URI format (ex: otpauth://totp/totp@authenticationtest....
mrjonleek's user avatar
0 votes
0 answers
66 views

How to make SMS-based 2FA safer?

This is a problem that many of us face: A surprising number of financial institutions' websites offer additional authentication only via SMS and/or phone call. But I will refer to my situation ...
NotAnAccountant's user avatar
0 votes
1 answer
69 views

Do 2FA Codes on the same device defeat their purpose? [duplicate]

I have my iPhone connected to my MacBook and receive SMS codes on my computer, which is very convenient. I also recently learned you can have an authentication app on your MacBook too. I just wonder ...
user1721135's user avatar
-1 votes
1 answer
97 views

What 2FA should I use for my website login and what are the risks of 2FA?

Now I know this website is not for asking for specific software recommendations, but for my website for work purposes (as mentioned in another question,) I feel I need a more secure login protocol ...
security_paranoid's user avatar
0 votes
0 answers
28 views

Why is selecting a code in banking app necessary for MFA? [duplicate]

At my old bank, logging in via a browser required that I open their app on my phone and tap a button to authenticate my login. My new bank is very similar but instead of a single button to click, I ...
user2132672's user avatar
0 votes
0 answers
24 views

If I'm rolling out MFA to users, should I provide TOTP, SMS or both? [duplicate]

My site's users currently do not have any MFA options, but we're planning to release this feature in the near future. We've already built support for TOTP and have it working internally, but some on ...
Ben Johnson's user avatar
0 votes
2 answers
178 views

In 2FA, why can't the second factor be the computer? [duplicate]

When two-factor authentication is described to me, people always say that it's important for security to demonstrate at least two of 1) something you know, 2) something you have, and 3) something you ...
OpenAI was the last straw's user avatar
0 votes
0 answers
80 views

What types of attacks can MFA using an hardware authenticator prevent?

I recently looked into the topic of MFA in combination with some hardware authenticator (USB keys like Nitrokey/Yubico) to potentially improve the overall security of my digital daily activities (web ...
Stephan's user avatar
31 votes
2 answers
5k views

What is the point of entering numbers in the two-factor authentication app?

Nowadays, 2FA apps usually require you to insert a number which you are presented with when trying to authenticate. For example, the following screenshot is from Microsoft Authenticator: This is ...
hb20007's user avatar
  • 559
0 votes
3 answers
300 views

If you don't need a PIN for your card in Apple Wallet and don't need a PIN to use Apple Wallet, how is that safe?

I've just added a card to my Apple Wallet and noticed that I didn't need a PIN. Now since Apple Wallet is apparently already "secure", I don't need a PIN to use it either. Is this a loophole ...
Coconut's user avatar
18 votes
5 answers
5k views

How do Yubikeys improve security if I am typically also forced to enable other, weaker 2FA methods?

It is typically recommended to enable 2FA wherever possible. Moreover, it is typically recommended to enable not just any 2FA method, but Yubikeys in particular. Yubikeys are considered to be the ...
gaazkam's user avatar
  • 6,027
0 votes
0 answers
106 views

How 2FA with Biometrics improve security?

Where I work, this is the passwordless registration/login flow for our Mobile App A user registers with a username and a phone number. An SMS OTP is sent to the phone number to verify it. Initial ...
Sentenzalb's user avatar
0 votes
1 answer
108 views

Any tips for organization-wide 2FA enforcement?

I'm hoping to lead my organization (around 15 people, all remote) in overhauling our security practices, and part of that is making sure each team member is using 2FA on the platforms/tools that offer ...
Matt Herrero's user avatar
0 votes
0 answers
71 views

Secure Passwordless MFA authentication on mobile app

I want to secure my mobile app with a passwordless MFA mechanism. The registration/login flow would be: You register you account online with a username and a mobile phone (an OTP will be sent to ...
PinkWhaleRider's user avatar
-1 votes
1 answer
83 views

Digital Signatures as an Alternative to TOTP Backup Codes

It seems pretty common for websites to issue a bunch of backup codes for MFA that the user saves somewhere. Instead, why don't they provide the user with the private key for a digital signature and ...
SameOldNick's user avatar
0 votes
0 answers
136 views

Is this a safe setup to prevent email account hack?

I would like to protect a Gmail account from being hacked. Suppose I use the following approach for login/authentication: Username, Password 2FA via security stick the stick is in a place that is not ...
fkarger's user avatar
  • 21
0 votes
1 answer
127 views

Why don't operators and CMS developers of discussion forums offer 2FA?

I have now done the tedious work and enabled 2FA for all accounts in my gopass (if the site offered an option). Some only offer insecure SMS or a proprietary app, or even nothing at all. What is ...
Sybil's user avatar
  • 1,479
0 votes
1 answer
202 views

Using DUO Mobile for Enterprise (Work) and Personal Accounts

As an avid proponent of "don't mix work and pleasure," I have been using Microsoft Authenticator for personal use, and my company uses Duo mobile for enterprise security. This solution is ...
the_chemist's user avatar
0 votes
1 answer
217 views

What is the benefit of a passkey over using 2FA like Google Authenticator?

At the moment to log into (for example) Paypal I type a password then the code from Google Authenticator. If I understand correctly having a passkey installed on my phone eliminates the password. It ...
John Rennie's user avatar
12 votes
2 answers
2k views

Do passkeys allow an attacker to gain account access by accessing a single device?

Some companies such as Github suggest passkeys replace both passwords and 2FA: passkeys satisfy both password and 2FA requirements Github thus allows logging in with a passkey without any second ...
holocronweaver's user avatar
1 vote
1 answer
143 views

Is 3DS compatible with secure 2FA technologies? (TOTP, WebAuthn)

Is PSD2's Strong Customer Authentication requirement possible to satisfy with secure 2FA solutions, such as TOTP and WebAuthn? For the purposes of this question, I'm classifying all systems where an ...
Michael Altfield's user avatar
2 votes
1 answer
273 views

How does google know my iPhone device name?

I have just signed into google using my browser, and google two step authentication has just started. When signing into google on my browser, it informed me that an authentication had been sent to my ...
Richard's user avatar
  • 21
0 votes
2 answers
106 views

Do all sites offer something like recovery codes? [closed]

I've always given two-factor authentication a wide berth because of my experience with it; with Dropbox, for example, they want an e-mail confirmation when I log in, but eight minutes pass until I ...
Matthias Ronge's user avatar
0 votes
3 answers
184 views

Is using TOTP from Authenticator app on a mobile device instead of passwords inherently 2FA?

A related discussion can be found, specifically addressing the security implications of using only TOTP for single-factor authentication However, in my view, using a TOTP code from a Google ...
Luka Demetrashvili's user avatar
0 votes
1 answer
338 views

Is Using an Authenticator App on the Same Device as the Passwordless Application a True 2FA?

I am building an application that a user can receive an access to by an internal worker. This works using a magic link, where the user will receive a one time link to authenticate in the app. Now I ...
Luka Demetrashvili's user avatar
1 vote
1 answer
355 views

Are 2FA browser plugins sufficiently secure?

Regarding 2FA browser plugins, I follow the uneducated opinion that they usually provide sufficient security. Since a desktop computer is a unique device (even a virtual machine) and provides that ...
Jonathan Root's user avatar
0 votes
0 answers
171 views

If only 'two' insecure MFA options are available (email and sms) which is 'most secure'? [duplicate]

Although I disagree with the term MFA entirely if it refers to 'login code send to email', it's a one-time password at best, and likely badly implemented with its associated risks. I do see quite some ...
Bob Ortiz's user avatar
  • 6,675
1 vote
0 answers
122 views

Are banks significantly reducing security by migrating everyone to mobile banking?

I have noticed a disturbing trend across banks (in the EU). Previously, many banks used 2FA by combining a login/password for an online banking website with a mobile authenticator app. However, many ...
TooTea's user avatar
  • 851
2 votes
1 answer
344 views

Is TOTP "more secure" and harder to crack than HOTP and why?

In addition to my question: How many known time/result combinations does it take to guess a HOTP/TOTP secret?. I've read often that TOTP is more secure than HOTP. One example: TOTP provides higher ...
Bob Ortiz's user avatar
  • 6,675
1 vote
2 answers
2k views

Are passkeys a secure replacement for 2FA?

Passkeys seems great for me as an individual, instead of passwords and TOTP tokens I can now slowly ditch the passwords and the somewhat annoying (but important!) TOTP tokens which I have locked in my ...
Anthon Nilsson's user avatar
2 votes
0 answers
262 views

Why are Yubico Yubikeys limited to 32 OATH accounts? [closed]

Is the 32 OATH QR code account limit on Yubikeys due to a storage constraint? Because the Yubikey 5 series has been out for a few years now it'd be amazing if there is a new version released soon with ...
AdamHurwitz's user avatar
0 votes
2 answers
541 views

What is the point of required user verification in WebAuthn?

User verification in WebAuthn can either be required, preferred, or discouraged. The last two are a hint to the authenticator that may be ignored. I see how they could be used to prevent client-side ...
tobib's user avatar
  • 153
0 votes
0 answers
131 views

Difference between PassKeys and using touch-id to login in Apps

PassKeys is a new way to sign-in to web-apps and mobile apps by FIDO alliance. I looked at it and could understand how it works; However, I'm unable to understand difference from using touch-id to ...
Procrastinator's user avatar
1 vote
1 answer
150 views

Is using the computer for MFA safe?

Recently, I discovered that MFA apps just calculate that codes based on a private key and the time clock, so it's easy to use tools like gnu pass to replace those apps with your computer. But what are ...
Vitor Figueredo Marques's user avatar
0 votes
0 answers
139 views

Two-Factor authentication bypass

I use two-factor authentication where possible, I was always under the impression that not only it prevents brute-force attacks, but makes it safer to use my accounts in untrusted environments. I ...
week's user avatar
  • 101
0 votes
0 answers
402 views

Every time I log into Facebook, the SMS based 2FA code appears to get intercepted (UK)

Historically, whenever I logged in I got a standard looking text from "Facebook" stating my login code. As of this morning, when I attempt to log in, I get a fake looking text from a random ...
ReflexReaction's user avatar
0 votes
1 answer
136 views

Query on best practice - using 2FA to self-authorise IP addresses in an allow-list

I want to know whether a solution I'm considering for a web app is particularly secure / in line with best practices etc. Scenario - a web application, it's a stock management app for small retailers. ...
clumsybiker's user avatar
0 votes
1 answer
249 views

Microsoft 2FA triggered without password?

Currently, I have someone attempting to login to my microsoft account. Upon looking at my activity history I am now seeing almost a hundred failed sign in attempts with the reason being "...
cryptarus's user avatar
3 votes
0 answers
260 views

Can a bad guy ever get access to my gmail account using ONLY the 2fa app or ONLY the recovery phone (plus username)?

Let's say X is a malicious person. Let's say I have a gmail account with a recovery phone and with 2fa enabled. Let's say X knows the username but not the password. X doesn't have any other ...
capet's user avatar
  • 130
3 votes
1 answer
794 views

When is FIPS certification important?

I was looking at YubiKeys and noticed that they sell FIPS certified keys alongside non-FIPS certified keys. Both seem to have the same feature sets, but the FIPS certified keys are more expensive. ...
Unknown's user avatar
  • 185
0 votes
1 answer
152 views

2FA implementation security

I am looking to implement 2FA. I know of duo and eg. Eset secure authentication. But both solutions seem to be implemented in a strange way, that is they require some form of communication with either ...
atapaka's user avatar
  • 471
22 votes
2 answers
5k views

What, if anything, can a person accomplish who has intercepted an emailed QR image for Authenticator?

A web hosting company has emailed me a QR code so I can have Authenticator generate a 6-digit PIN to use as the second factor after I've logged into my portal with username and password. What, if ...
Tim's user avatar
  • 341
1 vote
2 answers
151 views

Windows controlled folder access to secure Chrome cookies?

I've read about Linus Tech Tips hack, where a malware stole the browser cookies & was able to log in to Linus's channel. Is this preventable with Windows controlled folder access (preventing apps ...
Ninja Dev's user avatar
  • 111
3 votes
2 answers
421 views

FIDO2: should I set user verification to "discouraged" with two-factor authentication?

I provide a web application that uses FIDO2 for two-factor authentication. Recently I got reports that Windows users have to enter a PIN each time they use their hardware token. As far as I understand,...
tobib's user avatar
  • 153
2 votes
2 answers
210 views

Why is individual user security important to a company?

Companies universally seem to invest massive amounts of time and development resources into protecting users from security-related crimes. The trend seems to be increasing steadily over the past 15 ...
Jason C's user avatar
  • 273
1 vote
0 answers
245 views

How spammers are abusing 2fa SMS in web apps?

My webapp has an SMS 2FA option. When someone enrolls, it sends an SMS to the number specified by the user with hard coded text that contains a token that the user needs to then enter in the web app ...
Michael's user avatar
  • 223
0 votes
0 answers
106 views

How could one use multi-factor authentication to derive a static secret key?

Scenario: The setup is that each user has a randomly generated key A used for encrypting data stored on the server and a password-derived key B used to store A on the server without the server getting ...
n-l-i's user avatar
  • 326
0 votes
1 answer
86 views

How to use MFA without relying on a smartphone? [closed]

We have a situation where our company's operators need to authenticate with a 6-character OTP on some websites. For security reasons, we don't want them to use an app (eg.: Authy) on their personal ...
Tom's user avatar
  • 174
3 votes
2 answers
926 views

How am I meant to back up my second factors?

I currently use MFA wherever possible. To do so, I mainly use the Google Authenticator app, as well as a YubiKey. However, I recently realized that backing these up is very, very difficult. YubiKey ...
Joseph's user avatar
  • 131
1 vote
2 answers
1k views

How MS Authenticator works

When using MS Authenticator on a Microsoft account, the user fills in the email address or username. After that, the user presses one of the three numbers in the MS authenticator app and is logged in. ...
Martijn's user avatar
  • 51

1
2 3 4 5
15