Questions tagged [multi-factor]

a multi factor authentication requires at least two sets of credentials. This is typically something you know (e. g. a password) and something you own (e. g. a token generator or mobile phone), but could also be something you are (a biometric).

Filter by
Sorted by
Tagged with
137 votes
8 answers
70k views

How hard is it to intercept SMS (two-factor authentication)?

A lot of two-factor authentication mechanisms use SMS to deliver single-use passphrase to the user. So how secure is it? Is it hard to intercept the SMS message containing the passphrase? Do mobile ...
Paul Podlipensky's user avatar
133 votes
6 answers
48k views

How secure are the FIDO U2F tokens

Google and Yubico just announced the availability of cryptographic security tokens following the FIDO U2F specification. Is this just another 2FA option, or is this significantly better than solutions ...
tylerl's user avatar
  • 83.3k
99 votes
7 answers
17k views

Attacker circumventing 2FA. How to defend?

Detailed in the latest NSA dump is a method allegedly used by Russian intelligence to circumvent 2FA. (In this instance Google 2FA with the second factor being a code.) It’s a fairly obvious scheme ...
TheJulyPlot's user avatar
  • 7,819
88 votes
7 answers
22k views

Why is SMS used as a way of verifying a user's mobile, when it is not even encrypted in transit?

I did some research about how secure and private SMS messages are. Providers and governments can see these SMS messages in plaintext, but what is weird is that these messages are not encrypted in ...
Mohammed Rady's user avatar
86 votes
5 answers
15k views

Are texted 2FA security codes deliberately easy to remember?

I have 2FA setup on my bank account. When I login, I receive a six-digit code as an IM on my phone that I enter into the website. These codes always seem to have a pattern to them. Either something ...
Bob Kaufman's user avatar
86 votes
2 answers
20k views

How did someone log-in to my Gmail account from Kenya?

While on holiday in France in May I received an email from Google "New sign-in". Your Google Account was just used to sign in: Nairobi, Kenya. Tuesday, 26 May 2015 22:10 (East Africa Time). I ...
Colonel Panic's user avatar
68 votes
5 answers
44k views

What is a YubiKey and how does it work?

How do YubiKeys work? Are there any alternatives? Here is a picture of one:
Gabriel Fair's user avatar
  • 1,515
67 votes
6 answers
15k views

Four-factor authentication

I'm sure you've all heard of two-factor/multi-factor authentication. Basically it comes down to these factors: Knowledge - something you know (e.g. password, PIN, pattern) Possession - something you ...
rink.attendant.6's user avatar
65 votes
5 answers
7k views

Do 2FA sites leak info by confirming a correct password guess?

Here's my relatively layman's view of the issue. Many websites tout multifactor authentication (MFA) as an enormous boost to the security of users' accounts, and it can be if implemented properly. ...
Ben Sandeen's user avatar
64 votes
6 answers
11k views

Is 2FA via mobile phone still a good idea when phones are the most exposed device?

Everyone knows that two factors are better than one. My problem is that often the only second factor allowed is text messages sent to your mobile phone. This creates two concerns: I travel frequently ...
functionalparanoia's user avatar
63 votes
2 answers
10k views

How are one-time password generators like Google Authenticator different from having two passwords?

Google Authenticator uses the TOTP algorithm to generate your One-Time Password (OTP). TOTP works like this : The server generates a secret key and shares with the client (you) when the client ...
Ashwin's user avatar
  • 1,657
60 votes
9 answers
61k views

Two-Step vs. Two-Factor Authentication - Is there a difference?

These days, there's pretty much three forms of authentication in general use on the web: Single-factor authentication, e.g.: PIN or password. Two-factor authentication, e.g.: Single-factor plus a ...
Iszi's user avatar
  • 27.1k
51 votes
10 answers
14k views

Is an SSH key with a passphrase a 2FA?

This is a really theoretical question, but if I use an SSH key with a passphrase to login on a server, could this be considered as a two-factor authentication (2FA)? Indeed, I need the SSH (private) ...
Antonin M.'s user avatar
51 votes
5 answers
6k views

Should the average user with no special access rights be worried about SMS-based 2FA being theoretically interceptable?

Security experts are constantly discouraging users from using SMS-based 2FA systems, usually because of worries the auth code could be intercepted by an attacker, either through a SIM swap or a MitM ...
Nzall's user avatar
  • 7,433
46 votes
8 answers
10k views

Force user to remove USB token

I'm looking at setting up secure laptops using BitLocker with pre-boot PIN and startup key. I'm wondering if there is a way to force the user, who is remote, to remove the USB with the startup key ...
IamNaN's user avatar
  • 742
44 votes
1 answer
6k views

Why is SMS OTP not as secure as Authenticator Applications such as Microsoft Authenticator? [duplicate]

Why is SMS OTP not as secure as Authenticator Applications such as Microsoft Authenticator, etc? Is it because of snooping of mobile communications? or?
Nathan Aw's user avatar
42 votes
3 answers
63k views

How does HSBC's "Secure Key" actually work?

My bank has recently sent me a Digipass/Secure Key, which looks like a tiny calculator. You press the green button to turn it on, type a PIN to unlock it, then press the green button again to generate ...
DisgruntledGoat's user avatar
40 votes
6 answers
15k views

Should 2FA be enabled on service accounts?

See the title. I'm involved in a security audit right now, and am wondering whether 2FA should be enabled on not just human login accounts but also on service accounts (non-human accounts)? If so, how ...
Jason's user avatar
  • 509
40 votes
6 answers
15k views

Is it safe to store 2FA tokens together with passwords in 1password? [duplicate]

I'm using 1password and I've seen 1password allows you to store 2FA tokens in the same place where you store the password. I don't like the idea of having everything in the same place as if someone ...
Pau Chorro's user avatar
40 votes
2 answers
8k views

Why does Google cripple the 2FA Google Authenticator PAM module?

If you enable 2FA for Google Apps the shared secret is 160 bits. The google_authenticator PAM module on the other hand seems to use 80 bits for the shared secret. According to RFC 4226: R6 - The ...
Akshay Kumar's user avatar
39 votes
11 answers
11k views

Is it safe to use a weak password as long as I have two-factor authentication?

I'm careful to use strong passwords (according to How Big is Your Haystack, my passwords would take a massive cracking array 1.5 million centuries to crack), I don't reuse passwords across sites, and ...
Herb Caudill's user avatar
36 votes
1 answer
17k views

Storing TOTP secret in database, plaintext or encrypted?

I've been reading about 2FA and how it is used, and the thing that struck me most is that everyone seems to be storing the TOTP secret as plaintext in their database. I understand you need the secret ...
Y0lk's user avatar
  • 461
34 votes
6 answers
4k views

Why don't PGP and SSH keys see more widespread use as a second factor when authenticating?

One of the major up-and-coming MFA methods is U2F, which relies on an initial key exchange and challenge-response mechanism. It's a relatively new protocol, and is only starting to see more ...
Jules's user avatar
  • 1,250
32 votes
4 answers
5k views

How is "something you have" typically defined for "two-factor" authentication?

A wide range of products claim to offer "two-factor authentication" (c.v. Two-factor authentication - Wikipedia). Most are deployed as "something you have" to be used in addition to a normal password ...
nealmcb's user avatar
  • 20.8k
31 votes
6 answers
15k views

Why can't I share a one use code with anyone else?

I noticed in some cases when I get a verification code from Google it may say something along the line of: "You should not share this code with anyone else and no one from Google will ever ask for ...
Henry WH Hack v3.0's user avatar
31 votes
2 answers
5k views

What is the point of entering numbers in the two-factor authentication app?

Nowadays, 2FA apps usually require you to insert a number which you are presented with when trying to authenticate. For example, the following screenshot is from Microsoft Authenticator: This is ...
hb20007's user avatar
  • 417
30 votes
9 answers
6k views

When does 'something you have' NOT become 'something you know'?

I am currently trying to get an understanding of multi factor authentication. The biggest issue so far: When does "something you have" NOT get reduced to "something you know"? I ...
Gamer2015's user avatar
  • 717
30 votes
2 answers
30k views

How does Authy's 2FA work, if it doesn't connect to the server?

I thought I knew how two-factor authentication works: I enter the password. Server generates a random number (token) and sends it to me via SMS. I enter this token. Server checks that the token I ...
ceth's user avatar
  • 715
30 votes
4 answers
14k views

How can a website verify that my phone number belongs to me?

I was signing into a Capital One credit card website that I hadn't used in a long time, and once I entered my user name and password, it requested my mobile phone number for additional verification. ...
JPhi1618's user avatar
  • 490
29 votes
3 answers
3k views

How should disabling 2FA be handled by a service?

Due to personal reasons I recently had to disable and re-enable 2FA on quite a few of services. Now during this action I noticed quite a few different practices when it comes to "what should a user do ...
SEJPM's user avatar
  • 9,750
28 votes
14 answers
7k views

Why do we even use passwords / passphrases next to biometrics?

In the last couple of days there were a lot of talking about passwords and passphrases, not only here, but on several blogs and forums I follow (especially after XKCD #936 saw the light of this world)....
StupidOne's user avatar
  • 2,812
27 votes
2 answers
10k views

What's the point of Microsoft Account 2FA if it still lets me log in using password instead?

I have a Microsoft Account linked to a Microsoft Authenticator app for 2FA purposes. Every time I log in, it first sends me the Authenticator request, but I can always click "Other ways to sign ...
ᴍᴇʜᴏᴠ's user avatar
27 votes
9 answers
8k views

How does "Somewhere you are" authentication add further security?

In addition to the authentication techniques that are based on “something you have”, “something you know” and “something you are”, authentication techniques that consider “somewhere you are” are also ...
Joe Smith's user avatar
  • 401
27 votes
3 answers
10k views

Which SSH security is stronger? 2 Factor or Public key

For SSH authentication, which is more secure? 2 Factor Authentication using a USB token/Google Authenticator(time based) OR Public/private key with password Or could they be both used at the same ...
whoiskai's user avatar
  • 379
27 votes
5 answers
2k views

Bank asked for a cross login?

I was creating a new bank account here in the US at HSBC's popular online bank... You know the step where you have to verify the account you're sending from, by receiving two small test payments? I ...
Fattie's user avatar
  • 273
27 votes
1 answer
17k views

What are the differences between the U2F and UAF FIDO authentication standards?

Google recently announced support for Universal 2nd Factor (U2F) authentication in Chrome and started allowing that authentication mechanism to be used for 2-factor authentication across their various ...
Ajedi32's user avatar
  • 4,743
27 votes
6 answers
20k views

Best practices for storing 2FA recovery codes

I’ve recently started using 2FA on a bunch of services and I’m not sure how to best store the recovery codes. I can think of 3 options: In a secure note on LastPass In a Dropbox folder On a usb stick ...
John Devitt's user avatar
26 votes
3 answers
8k views

How to securely store and manage one-time backup codes for 2FA?

I am already using 31 services with 2nd factor authentication and the number is growing. In addition to having multiple authentication devices, I decided for or had to generate a separate set of one-...
techraf's user avatar
  • 9,159
25 votes
6 answers
7k views

Why do apps with phone verification send the user a message, rather than have the user send one to them?

Many apps allow the user to authenticate with their phone number, by having the user enter it, and then sending an SMS with a code to be entered into the app. Very few (if any that I can find still ...
George Green's user avatar
25 votes
2 answers
10k views

What is the risk of having a 2FA key permanently plugged into my device?

Yubico offers the YubiKey Nano, a 2FA key designed to be left inside the device more or less permanently. While it does add comfort to be able to just leave it plugged in, what risks would there be ...
user avatar
25 votes
4 answers
7k views

What is the risk and mitigation of accidentally typing a YubiKey password in an open forum?

I have a YubiKey in my laptop (for testing) and accidentally broadcast my YubiKey password out to the Internet. Since this is only a test key, and has no access to anything of value, here are some ...
makerofthings7's user avatar
23 votes
4 answers
11k views

Is it secure to store a two factor authentication seed in a password manager?

I wonder whether it is really secure to store the Two Factor Authentication seed code (e.g. the secret key for TOTP) within a password manager together with the user and password for the service. If ...
Programie's user avatar
  • 331
23 votes
6 answers
8k views

Is tokenless (specifically SMS) 2FA a security compromise over OTP tokens?

I've been looking into the various pros/cons of tokenless (particularly SMS based) and traditional token based two-factor authentication (think RSA SecurID). After doing some research, I think I have ...
dbr's user avatar
  • 435
22 votes
2 answers
5k views

What, if anything, can a person accomplish who has intercepted an emailed QR image for Authenticator?

A web hosting company has emailed me a QR code so I can have Authenticator generate a 6-digit PIN to use as the second factor after I've logged into my portal with username and password. What, if ...
Tim's user avatar
  • 341
21 votes
6 answers
8k views

Why use a Smartcard for (Two Factor) Auth instead of another medium?

I recently installed Bitlocker on my Windows 8.1 machine, using only a password. I was thinking of getting something other than just a password for my storage drive, something physical, like a USB, SD ...
Lighty's user avatar
  • 2,378
21 votes
4 answers
27k views

Does adding two-factor authentication by OTP really make KeePass more secure

KeePass is an application that keeps all your passwords for you in a database. It is primarily protected by a master password and/or keyfile. If the database is properly encrypted with that password ...
Jeff's user avatar
  • 3,609
20 votes
6 answers
4k views

What extra security does a 2-step website login process with a PIN provide?

I am currently working on a web application with a significant security risk attached to its function. We're using Microsoft Identity Framework to handle user logins, with the system forcing strong ...
Bob Tway's user avatar
  • 559
20 votes
7 answers
7k views

Don't one-time recovery codes for 2FA introduce a backdoor?

Although using multi-factor authentication is clearly a good move, I'm struggling with the 'one-time recovery codes' concept. It seems to me that if you choose to use them, what you're doing is ...
Pendantry's user avatar
  • 317
20 votes
4 answers
4k views

Biometric versus other Two Factor Authentication Mechanisms

Over the years biometrics is the go-to movie authentication mechanism, but in the real world I'm getting conflicting opinions about it. Everything I've learned shows that biometrics are flawed ...
Steve's user avatar
  • 15.3k
19 votes
11 answers
5k views

2 factor authentication - cost effective solution for a web startup [closed]

My local bank uses a 2 factor authentication where customers key in password AND a One Time PIN delivered via SMS to mobile phone OR from a security token device. I am doing a web startup in the ...
Kim Stacks's user avatar

1
2 3 4 5
15