Search Results
| Search type | Search syntax |
|---|---|
| Tags | [tag] |
| Exact | "words here" |
| Author |
user:1234 user:me (yours) |
| Score |
score:3 (3+) score:0 (none) |
| Answers |
answers:3 (3+) answers:0 (none) isaccepted:yes hasaccepted:no inquestion:1234 |
| Views | views:250 |
| Code | code:"if (foo != bar)" |
| Sections |
title:apples body:"apples oranges" |
| URL | url:"*.example.com" |
| Saves | in:saves |
| Status |
closed:yes duplicate:no migrated:no wiki:no |
| Types |
is:question is:answer |
| Exclude |
-[tag] -apples |
| For more details on advanced search visit our help page | |
Results tagged with multi-factor
Search options answers only
not deleted
user 70738
a multi factor authentication requires at least two sets of credentials. This is typically something you know (e. g. a password) and something you own (e. g. a token generator or mobile phone), but could also be something you are (a biometric).
2
votes
Can "something you are" be implemented without effectively turning into "something you know"?
That's the reason why you should never use biometrics alone as authentication except in secured environments. You fingerprint is indeed private in the sense it only belongs you, but as an information …
- 26.9k
0
votes
do password managers count as a MFA authentication factor
Whether it is stored in a password vault or not a password is just something you know. You could write it on a paper, give it to someone else and that is enough for him to use it, while you can still …
- 26.9k
0
votes
Is 2-factor authentication for webmail useful when e-mail checking through other methods is ...
It looks like the the mail admin stopped in the half of the way. You are right on one point: if one single access only needs user + password, the global security level of the mail server is user-passw …
- 26.9k
3
votes
Does the new Danish authentication solution for online contact with municipality etc. genuin...
The 6 digit code is only something you know and the app is not unique so cannot be a something you have. Furthermore a 6 digit code + a password would only be 2 something you know.
But if the app also …
- 26.9k
1
vote
Accepted
Do all sites offer something like recovery codes?
You must be aware that all those recovery things are nothing more than backdoors actually lowering the overall security of an authentication system. Simply as the alternative would be manual (meaning …
- 26.9k
1
vote
How to reliably backup to cloud services without hampering security?
I suppose you have a copy of the key of your home. And I suppose you have already given such a copy to someone you trust (wife/husband, parents, etc.). I know that there is a slight difference between …
- 26.9k
77
votes
Accepted
Force user to remove USB token
You are trying to use a technical tool to solve a social problem. The answer is that cannot fit.
Techniques can provide great security when correctly used, but only user education can allow proper us …
- 26.9k
0
votes
2FA: Do app passwords render the second factor invalid?
The problem with OTP authentication, is that human interaction is involved. You are supposed to first type your password, they type the second factor (or let the usb thing simulate a keyboard and type …
- 26.9k
0
votes
Best practices for storing 2FA recovery codes
I keep my passwords in a local storage password manager, with a backup on a different device, because as a rather old dinosaurus, I do not really trust the cloud for strong privacy. The same in my rea …
- 26.9k
1
vote
What are some existing or ideas where the use of a password can be replaced to login to a se...
The state of the art for remote authentication is usage of a client certificate. It has even a legal value is some countries (France and other European countries) because it is brute force resistent, …
- 26.9k
7
votes
Bank asked for a cross login?
Disclaimer: IANAL
1 is this common now?! conversely is it brand new?
First time I read of it, but I know that many online banking system propose to aggregate your other bank accounts on their …
- 26.9k
7
votes
Don't one-time recovery codes for 2FA introduce a backdoor?
Password recovery has always been a security weakness because the goal is to allow to make an action on a account without knowing the password. In controlled systems you had to go to the admin desk, t …
- 26.9k
1
vote
Storing password in sqlite vs asking user to type it in every time
It is just my opinion, but you should not try to re-invent a square wheel when round ones are just around. As an old Unix user, I think that a good application should do one single thing and do the be …
- 26.9k
0
votes
Are security questions considered as 2FA?
Security question can only substitute to a password: they are something you know because you do not need a specific object to answer them (not something you have) and anybody knowing the response can …
- 26.9k
0
votes
Does IMAP/POP3/ASP undermine Two-Factor Auth?
You have to specifically allow that option for a reason: it does defeat the 2FA, because the password is enough to allow access.
The reason is to allow rich clients that are unable to use 2FA like ma …
- 26.9k