130
Your password was not stolen. As you pointed out, Opera Mini uses proxy servers. Per the link provided in thexacre's answer, Google incorrectly identifies the servers as being in Nairobi, Kenya:
When you use Opera Mini, you're connected to Opera servers, which
download websites you want, compress and transform them, and at the
end they are sent to ...
128
I have noticed this too, and I think it is a result of the human brain's tendency to apply patterns to random noise. This seems to be more common when specifically trying to remember a string of numbers.
126
They're not being precise because they don't have to, and precise language might confuse some users.
They could say, for example, "You should not share unused codes that are less than an hour old with anyone else and no one from Google will ever ask for this code."
You and I would know what they mean. My father in law and grandpa won't know why, though. ...
118
If I'm understanding your question properly, the attack you are proposing is to brute-force passwords against a server like this, then once it shows you the MFA screen, go try that password on other websites that this user has accounts on.
This is a great question! Good find! But you seem to be overlooking two points:
This is no weaker than not having MFA, ...
99
Passwords are revealed every time you use them: if you have two passwords and you type them into a fraudulent web form, they are both stolen.
The shared secret can't be calculated from a single OTP (or even from a set of them**), so a stolen OTP is only valid for limited time. The shared secret is never transferred during the authentication, so stealing it ...
87
As you noted, the main three are:
Something you know
Something you have
Something you are
I'd argue that there are others:
Something you can do, e.g. accurately reproducing a signature.
Something you exhibit, e.g. a particular personality trait, or even neurological behaviour that could be read by an fMRI. These are not strictly "are" features, as they're ...
85
The answers I've gotten have been good, but I wanted to provide a bit more depth, going specifically in to why the system exists at all, which should explain a bit more about what it's good for.
Disclaimer: While I now work for Google, I knew nothing about this project at the time this answer was written. Everything reported here was gathered from public ...
81
It's quite easy to send an SMS message that appears to come from the phone number of your choice without actually controlling that number. And so sending an SMS from a number doesn't verify your ID in the same way as receiving an SMS to a number.
78
You are trying to use a technical tool to solve a social problem. The answer is that cannot fit.
Techniques can provide great security when correctly used, but only user education can allow proper use. I often like the who is responsible for what question. That means that users should know that they will be accountable for anything that could be done with ...
76
Two-factor authentication refers specifically and exclusively to authentication mechanisms where the two authentication elements fall under different categories with respect to "something you have", "something you are", and "something you know".
A multi-step authentication scheme which requires two physical keys, or two passwords, or two forms of biometric ...
64
Not all two-factor authentication schemes are the same. Some forms of 2FA, such as sending you a text message, are not secure against this attack. Other forms of 2FA, such as FIDO U2F, are secure against this attack -- they have been deliberately designed with this kind of attack in mind.
FIDO U2F provides two defenses against the man-in-the-middle attack:...
56
Roughly 85% of six digit random numbers will have at least one repeating digit and 40% will have a repeating sequential digit next to each other. (I am happy to be corrected on my math.)
These keys are generated using the standard TOTP algorithm. The article summarizes this implementation, showing there isn't any effort to generate a memorable number:
...
54
The trouble with requiring MFA on service accounts, is that it would have to be fully automated. For instance, a time based OTP.
But as this OTP is based on a secret seed, it is effectively just another password stored in a config available to the service account. And it therefore gives no real additional security above that of just a single factor such ...
47
Out of band 2FA is the correct approach. This means that you have a second factor that can't be phished, like a client cert or FIDO U2F. Codes, or SMS-based 2FA models are the weakest 2FA options because they're in-band, and as you've described, can be phished just as credentials can.
They're convenient because they can be used by nearly anyone, and ...
47
There is no real concept of an "average user with no special access rights". From the perspective of an attacker the main point is if the effort needed for an attack is less then the gain of the attack. Even an "average user" might have crypto wallets or precious twitter accounts. Sometimes the gain of an attack is also not that obvious, like when a ...
45
Seeing as you're using Opera Mini this is a likely explanation:
Unlike straightforward web browsers, Opera Mini fetches all content
through a proxy server and reformats web pages into a format more
suitable for small screens.
https://en.wikipedia.org/wiki/Opera_Mini
Of course it's difficult to be certain, and 2FA is still vulnerable to certain ...
44
There are two standard ways to build such a device:
Time-based. The device has a secret key K (known only to the device and to your bank). When you press the button, The device computes F(K, T) (where T is the current time) and outputs it as a 6-digit code.
Your bank, which also knows K, can compute the same function. To deal with the fact that the ...
36
A requirement for "what you have" based authentication is that ownership can be clearly assigned to a single specific entity. This specifically means that this information/device can not be (easily) cloned and that access to the information requires access to the original device.
But credit number, CVV & expiry date are static information which can be ...
36
It's to prevent social engineering attacks against you. Imagine, for example you logged into your two-factor gmail account on a shady public computer where a keylogger recorded your email address and password (but weren't able to use it while you were logged in), but you have two factor authentication enabled and remembered to sign out at the end of your ...
35
Absolutely!
Somewhere you are is quite widely used in corporate IT. In many environments, if you are on an office network, you can login using only a password, but if you are out of the office you must use an additional factor, usually a token.
The current time is arguably another authentication factor, a classic example being a time delay safe. Office ...
35
U2F is capable of using an encrypted channel using public key crypto to ensure ONLY the right server can get the one time token. This means plugging it in when on a phishing site means nothing happens—they can't get into your account. Instead they have to rely on technical attacks like XSS and local malware.
It is supposed to be able to hide the fact ...
34
Passwords and biometrics have distinct characteristics.
Passwords are secret data. Data is abstract: it flows quite freely across networks. Cryptography defines many algorithms which can use secret data to realize various security properties such as confidentiality and authentication. The shortcomings of passwords are due to the fact that they are meant to ...
34
As I understand it, Yubikey acts like a USB keyboard. You plug it in your computer, place the cursor in a form field, press the button on the Yubikey, and it sends out a text string of 44 characters to the computer like you are typing those 44 characters. The computer doesn't know the difference between you typing it or the Yubikey generating it.
A website ...
33
I find it hard to see what security benefits this could provide. In multifactor authentication, the point is to use different factors — i.e., "something you know", "something you have", "something you are". Just repeating the same factor twice seems a bit pointless.
But let me speculate some about what the purpose could be.
1. Stop keyloggers
Only ...
31
A smart card works by keeping a secret hidden and answering a challenge that proves it has the secret. It, theoretically, should never reveal that secret to anyone and it should be unrecoverable. There are some technical ways you might be able to get around it, but most of them are destructive to the card. This means you know if your smartcard has been ...
30
Authy show me secret numbers without any connection with server. How can it do it ?
Authy is using a one-time passcode (OTP) algorithm which come in a number of flavors, the two most popular being HMAC-based OTP (HOTP) and Time-based OTP (TOTP). Authy is using TOTP.
Both algorithms are essentially the same; they require some seed data and a counter to ...
27
This is not a "one is better than the other" issue. Both increase the burden of an attacker to break into your system:
Using (and enforcing) keys increases the "quality of the password" ("mypassword123" vs "long_binary_asymetric_keypair_here"). Humans are very bad at remembering long passphrases with good entropy.
Using 2Factor auth ensures that an attacker ...
27
TL;DR It's a Security vs. Usability thing. I prefer, and advocate for, the way GitHub does it; If the user is already logged in with a 2FA'd session, then require the password when entering the "sensitive" account area (changing email address or 2FA), and then allow disabling 2FA. Once disabled, send a notification email.
This is largely a fight between the ...
27
Multi-factor authentication is certainly possible without human intervention.
However, it requires a frame challenge.
When dealing with humans, the three typical factors for authentication are something you know (password), something you have (TOTP device/program, phone with SMS, access to an email account, etc.), and something you are (biometrics). You ...
26
Nope. There are three. All others mentioned here either:
can be reduced to one of canonical three (e.g. "something you can do" is a personal feature, so classified as "something you are"; "someone you know" means you can present a proof of connection to someone - that's "something you have"!)
are not part of authentication, but authorization (time, network ...
Only top voted, non community-wiki answers of a minimum length are eligible
