133
votes
Accepted
How did someone log-in to my Gmail account from Kenya?
Your password was not stolen. As you pointed out, Opera Mini uses proxy servers. Per the link provided in thexacre's answer, Google incorrectly identifies the servers as being in Nairobi, Kenya:
...
- 14.6k
129
votes
Accepted
Are texted 2FA security codes deliberately easy to remember?
I have noticed this too, and I think it is a result of the human brain's tendency to apply patterns to random noise. This seems to be more common when specifically trying to remember a string of ...
- 1,128
125
votes
Why can't I share a one use code with anyone else?
They're not being precise because they don't have to, and precise language might confuse some users.
They could say, for example, "You should not share unused codes that are less than an hour old ...
- 5,756
118
votes
Accepted
Do 2FA sites leak info by confirming a correct password guess?
If I'm understanding your question properly, the attack you are proposing is to brute-force passwords against a server like this, then once it shows you the MFA screen, go try that password on other ...
- 57k
100
votes
Accepted
How are one-time password generators like Google Authenticator different from having two passwords?
Passwords are revealed every time you use them: if you have two passwords and you type them into a fraudulent web form, they are both stolen.
The shared secret can't be calculated from a single OTP (...
- 15.9k
99
votes
Accepted
What's the point of Microsoft Account 2FA if it still lets me log in using password instead?
You didn't actually set up 2FA. You set up your authenticator as an alternative method of single-factor authentication. This is clear from the first screenshot: "... to sign in without a password&...
- 38.7k
91
votes
Accepted
Four-factor authentication
As you noted, the main three are:
Something you know
Something you have
Something you are
I'd argue that there are others:
Something you can do, e.g. accurately reproducing a signature.
Something ...
- 131k
91
votes
Accepted
How secure are the FIDO U2F tokens
The answers I've gotten have been good, but I wanted to provide a bit more depth, going specifically in to why the system exists at all, which should explain a bit more about what it's good for.
...
- 81.9k
80
votes
Accepted
Why do apps with phone verification send the user a message, rather than have the user send one to them?
It's quite easy to send an SMS message that appears to come from the phone number of your choice without actually controlling that number. And so sending an SMS from a number doesn't verify your ID in ...
- 10.1k
77
votes
Accepted
Force user to remove USB token
You are trying to use a technical tool to solve a social problem. The answer is that cannot fit.
Techniques can provide great security when correctly used, but only user education can allow proper ...
- 25.5k
73
votes
Accepted
Why is SMS used as a way of verifying a user's mobile, when it is not even encrypted in transit?
Yes, you're right. SMSes are not recommended in any two-factor authentication (2FA) process nowadays. They can be easily intercepted and modified.
That's why a lot of companies are recommending other ...
- 1,357
69
votes
Why is SMS OTP not as secure as Authenticator Applications such as Microsoft Authenticator?
A few reasons:
It's relatively easy (though getting harder, thankfully) for an attacker to hijack somebody's phone number; the attacker convinces the cell provider to either port the victim's number ...
- 38.7k
65
votes
Accepted
Attacker circumventing 2FA. How to defend?
Not all two-factor authentication schemes are the same. Some forms of 2FA, such as sending you a text message, are not secure against this attack. Other forms of 2FA, such as FIDO U2F, are secure ...
- 98.1k
58
votes
Are texted 2FA security codes deliberately easy to remember?
Roughly 85% of six digit random numbers will have at least one repeating digit and 40% will have a repeating sequential digit next to each other. (I am happy to be corrected on my math.)
These keys ...
- 697
55
votes
Should 2FA be enabled on service accounts?
The trouble with requiring MFA on service accounts, is that it would have to be fully automated. For instance, a time based OTP.
But as this OTP is based on a secret seed, it is effectively just ...
- 1,589
53
votes
Accepted
When does 'something you have' NOT become 'something you know'?
When I have a public/private RSA-keypair with 4096 bit and I remember the private key without storing it anywhere, is it something I know?
Yes.
When I write down or store the private part of a ...
- 181k
52
votes
Is 2FA via mobile phone still a good idea when phones are the most exposed device?
Is 2FA via mobile the best security there is? No. SMS 2FA is the weakest form of 2FA, however, it's still worthwhile because it does improve security and it has a relatively low barrier of entry ...
- 31k
52
votes
Why is SMS used as a way of verifying a user's mobile, when it is not even encrypted in transit?
SMS is not exactly plaintext.
The network operator has it in plaintext, but the attack surface there is limited and both organizational and technological measures limit the exposure.
Over the air, it ...
- 3,395
50
votes
Accepted
Should the average user with no special access rights be worried about SMS-based 2FA being theoretically interceptable?
There is no real concept of an "average user with no special access rights". From the perspective of an attacker the main point is if the effort needed for an attack is less then the gain of the ...
- 181k
47
votes
Attacker circumventing 2FA. How to defend?
Out of band 2FA is the correct approach. This means that you have a second factor that can't be phished, like a client cert or FIDO U2F. Codes, or SMS-based 2FA models are the weakest 2FA options ...
- 35.4k
46
votes
What is a YubiKey and how does it work?
As I understand it, Yubikey acts like a USB keyboard. You plug it in your computer, place the cursor in a form field, press the button on the Yubikey, and it sends out a text string of 44 characters ...
- 7,349
45
votes
How did someone log-in to my Gmail account from Kenya?
Seeing as you're using Opera Mini this is a likely explanation:
Unlike straightforward web browsers, Opera Mini fetches all content
through a proxy server and reformats web pages into a format ...
- 8,404
43
votes
Accepted
What is the risk of having a 2FA key permanently plugged into my device?
The threat model for the Nano is protecting accounts from remote access, not from direct access from an approved device. You essentially make the device itself the "thing you have" factor with the ...
- 123k
38
votes
Accepted
2FA: Why do I need to keep my backup codes for each platform on paper?
Writing them to paper is one of the simplest, guaranteed to be safe from malware and hardware failure for the average people. If you have a password manager, usually you can store secure notes too, ...
- 506
36
votes
Four-factor authentication
Absolutely!
Somewhere you are is quite widely used in corporate IT. In many environments, if you are on an office network, you can login using only a password, but if you are out of the office you ...
- 32.6k
36
votes
How secure are the FIDO U2F tokens
U2F is capable of using an encrypted channel using public key crypto to ensure ONLY the right server can get the one time token. This means plugging it in when on a phishing site means nothing happens&...
- 821
36
votes
In a "card not present" transaction, is the credit card number, expiry date & CVV considered as a "What you have" or a "What you know"?
A requirement for "what you have" based authentication is that ownership can be clearly assigned to a single specific entity. This specifically means that this information/device can not be (easily) ...
- 181k
36
votes
Why can't I share a one use code with anyone else?
It's to prevent social engineering attacks against you. Imagine, for example you logged into your two-factor gmail account on a shady public computer where a keylogger recorded your email address and ...
- 38.6k
35
votes
Accepted
Is it safe to store 2FA tokens together with passwords in 1password?
I work for 1Password, and I wrote exactly about this question when we introduced the feature.
The answer depends on what security properties you actually want from time-based one time passwords (TOTP)....
- 5,769
Only top scored, non community-wiki answers of a minimum length are eligible