Search Results
| Search type | Search syntax |
|---|---|
| Tags | [tag] |
| Exact | "words here" |
| Author |
user:1234 user:me (yours) |
| Score |
score:3 (3+) score:0 (none) |
| Answers |
answers:3 (3+) answers:0 (none) isaccepted:yes hasaccepted:no inquestion:1234 |
| Views | views:250 |
| Code | code:"if (foo != bar)" |
| Sections |
title:apples body:"apples oranges" |
| URL | url:"*.example.com" |
| Saves | in:saves |
| Status |
closed:yes duplicate:no migrated:no wiki:no |
| Types |
is:question is:answer |
| Exclude |
-[tag] -apples |
| For more details on advanced search visit our help page | |
Results tagged with multi-factor
Search options answers only
not deleted
user 53333
a multi factor authentication requires at least two sets of credentials. This is typically something you know (e. g. a password) and something you own (e. g. a token generator or mobile phone), but could also be something you are (a biometric).
0
votes
Is there a way to get 2 factor authentication using an email account instead of a phone app?
Email is almost always secured by "a thing you know" (password), and thus in context is the same kind of factor as the first factor on the web site (also password). This fails the goal of 2FA that the …
- 52.1k
3
votes
Accepted
What is the most private option for 2FA with OpenSSH?
Public key auth is definitely the best way to go here, as it is very well supported (including by PuTTY, for all that it insists on using its own key format just to make life a hassle for its users). …
- 52.1k
1
vote
Accepted
How can losing 2FA render encrypted data inaccessible?
It depends on the second factor used. (EDIT: Note that this answer is generic to 2FA for encryption in general, and not specific to BitWarden; I don't know enough about how their 2FA works to say.)
So …
- 52.1k
70
votes
Why is SMS OTP not as secure as Authenticator Applications such as Microsoft Authenticator?
A few reasons:
It's relatively easy (though getting harder, thankfully) for an attacker to hijack somebody's phone number; the attacker convinces the cell provider to either port the victim's number …
- 52.1k
1
vote
Why can't SMS be read online?
First and foremost: SMS-based 2FA is in fact bad. It's not very secure (SMS is sent over poorly-secured channels and often leaks in a bunch of places) and greatly raises the risk of SIM-hijacking atta …
- 52.1k
1
vote
Accepted
Why is physical security key helpful, since most accounts have alternative 2FA methods a hac...
Security is only as strong as the weakest link in the attacker's way. If you have an account with 2FA options of "FIDO2/Webauthn" (Yubikey/Titan Key/etc.) and "SMS", your account is at greater risk th …
- 52.1k
1
vote
What is the point of required user verification in WebAuthn?
Preferred tells the client "I want you to do this, if you can". "Required" tells the client "if you can't do this, abort". While you're entirely correct that the server can't count on the client to en …
- 52.1k
13
votes
Is phishing ineffective against a Gmail account that has 2FA?
"Phishing" is a broad term for online social engineering attacks where the attacker impersonates somebody the victim trusts. Phishing attacks can have many goals; basically anything that the the user …
- 52.1k
21
votes
If we fixed SIM jacking would SMS then become a valid way to send an MFA token to?
In addition to the issues with SS7, SMS is not meaningfully encrypted. Sometimes the last mile portion (between tower and device) is encrypted, but that encryption is weak and can be broken. Other tim …
- 52.1k
2
votes
Accepted
Should a user refill their 2FA when they login into a different account and back?
It's probably best to ask the user what they want to do, after they sign in (including 2FA if needed). In particular, offer the ability to:
[Default] Forget the other account on this device (requires …
- 52.1k
4
votes
Is it a bad idea to replace passwords with OTP?
The main way that OTPs are weaker than regular passwords is that they need to be made available to the user through some method, before the user has authenticated. There are a few ways to do this, wit …
- 52.1k
2
votes
Is using WebAuthn alone considered as two factor authentication?
WebAuthn by itself, no. WebAuthn is simply a public-key-based authentication method with some requirements for how the proof of ownership occurs. You can, for example, use WebAuthn with a hardware tok …
- 52.1k
31
votes
Accepted
How does password reset work if 2FA is enabled?
Technically, this is a question about how you should implement 2FA (or how you should expect it to be implemented), since there's nothing inherent in 2FA that answers your questions in either directio …
- 52.1k
1
vote
Why do TOTP two-factor authenticators use shared keys?
The phone would store the private key and can sign an increment counter/timestamp
So far so good
the authenticating server could verify the signature with the public key
"The signature", you say. …
- 52.1k
3
votes
Accepted
Do passkeys allow an attacker to gain account access by accessing a single device?
Passkeys are inherently single-factor - they only require or prove possession of a private key, which the server has no capability to determine how you are storing or protecting - but the intended use …
- 52.1k