Search Results
| Search type | Search syntax |
|---|---|
| Tags | [tag] |
| Exact | "words here" |
| Author |
user:1234 user:me (yours) |
| Score |
score:3 (3+) score:0 (none) |
| Answers |
answers:3 (3+) answers:0 (none) isaccepted:yes hasaccepted:no inquestion:1234 |
| Views | views:250 |
| Code | code:"if (foo != bar)" |
| Sections |
title:apples body:"apples oranges" |
| URL | url:"*.example.com" |
| Saves | in:saves |
| Status |
closed:yes duplicate:no migrated:no wiki:no |
| Types |
is:question is:answer |
| Exclude |
-[tag] -apples |
| For more details on advanced search visit our help page | |
Results tagged with multi-factor
Search options answers only
not deleted
user 291964
a multi factor authentication requires at least two sets of credentials. This is typically something you know (e. g. a password) and something you own (e. g. a token generator or mobile phone), but could also be something you are (a biometric).
0
votes
Is the following considered 2FA?
It depends on how strict your definition of “2FA” is and whether system B actually enforces password authentication via system A.
The idea of course is that the user authenticates with both the passwo …
- 22.9k
2
votes
Accepted
What 2FA should I use for my website login and what are the risks of 2FA?
2FA is obviously a widely accepted and deployed concept, so you probably won't find a lot of people who are against it. Database leaks have happened far too many times, and users are notoriously bad a …
- 22.9k
6
votes
Accepted
How important is HOTP/TOTP secret key security?
The entire security of HOTP/TOTP relies on the shared secret. If the secret is compromised, then the password for any counter value or point in time can be calculated – in the past, present or future. …
- 22.9k
1
vote
Query on best practice - using 2FA to self-authorise IP addresses in an allow-list
You seem to have it backwards. Instead of going through all kinds of different authentication methods, you should first figure out the requirements, ideally together with your customers. Then you can …
- 22.9k
3
votes
Whats the safest way to store 2fa/mfa secret key in database?
You cannot hash the TOTP key, because the key itself is needed for the TOTP calculations. If the server only has a hash of the key, that doesn't help.
Instead, the user-specific TOTP keys should be en …
- 22.9k
2
votes
Accepted
Is clientDataJson and attestationObject required to verify assertion during authentication i...
No, you do not need the clientDataJson or the attestationObject to verify an authentication assertion. What must and what should be stored from the registration data is specified in step 23 of the reg …
- 22.9k
6
votes
Accepted
How effective is re-entering your password to enable high-risk functions on your account whe...
The password manager of the browser is a client-side feature which websites have no control over. Whether or not you use it is your own choice. So if a website asks for re-authentication, and you “byp …
- 22.9k
44
votes
Why don't we use HTML password inputfields for usernames and 2FA codes in the front-end of w...
When using password authentication, then the authentication element is in fact the password. The username is just an identifier which could be entirely public (unless it contains sensitive data like a …
- 22.9k