133 votes
Accepted

How did someone log-in to my Gmail account from Kenya?

Your password was not stolen. As you pointed out, Opera Mini uses proxy servers. Per the link provided in thexacre's answer, Google incorrectly identifies the servers as being in Nairobi, Kenya: ...
user avatar
129 votes
Accepted

Are texted 2FA security codes deliberately easy to remember?

I have noticed this too, and I think it is a result of the human brain's tendency to apply patterns to random noise. This seems to be more common when specifically trying to remember a string of ...
user avatar
  • 1,128
125 votes

Why can't I share a one use code with anyone else?

They're not being precise because they don't have to, and precise language might confuse some users. They could say, for example, "You should not share unused codes that are less than an hour old ...
user avatar
  • 5,756
118 votes
Accepted

Do 2FA sites leak info by confirming a correct password guess?

If I'm understanding your question properly, the attack you are proposing is to brute-force passwords against a server like this, then once it shows you the MFA screen, go try that password on other ...
user avatar
100 votes
Accepted

How are one-time password generators like Google Authenticator different from having two passwords?

Passwords are revealed every time you use them: if you have two passwords and you type them into a fraudulent web form, they are both stolen. The shared secret can't be calculated from a single OTP (...
user avatar
  • 15.9k
99 votes
Accepted

What's the point of Microsoft Account 2FA if it still lets me log in using password instead?

You didn't actually set up 2FA. You set up your authenticator as an alternative method of single-factor authentication. This is clear from the first screenshot: "... to sign in without a password&...
user avatar
  • 38.7k
91 votes
Accepted

Four-factor authentication

As you noted, the main three are: Something you know Something you have Something you are I'd argue that there are others: Something you can do, e.g. accurately reproducing a signature. Something ...
user avatar
  • 131k
91 votes
Accepted

How secure are the FIDO U2F tokens

The answers I've gotten have been good, but I wanted to provide a bit more depth, going specifically in to why the system exists at all, which should explain a bit more about what it's good for. ...
user avatar
  • 81.9k
80 votes
Accepted

Why do apps with phone verification send the user a message, rather than have the user send one to them?

It's quite easy to send an SMS message that appears to come from the phone number of your choice without actually controlling that number. And so sending an SMS from a number doesn't verify your ID in ...
user avatar
  • 10.1k
77 votes
Accepted

Force user to remove USB token

You are trying to use a technical tool to solve a social problem. The answer is that cannot fit. Techniques can provide great security when correctly used, but only user education can allow proper ...
user avatar
73 votes
Accepted

Why is SMS used as a way of verifying a user's mobile, when it is not even encrypted in transit?

Yes, you're right. SMSes are not recommended in any two-factor authentication (2FA) process nowadays. They can be easily intercepted and modified. That's why a lot of companies are recommending other ...
user avatar
  • 1,357
69 votes

Why is SMS OTP not as secure as Authenticator Applications such as Microsoft Authenticator?

A few reasons: It's relatively easy (though getting harder, thankfully) for an attacker to hijack somebody's phone number; the attacker convinces the cell provider to either port the victim's number ...
user avatar
  • 38.7k
65 votes
Accepted

Attacker circumventing 2FA. How to defend?

Not all two-factor authentication schemes are the same. Some forms of 2FA, such as sending you a text message, are not secure against this attack. Other forms of 2FA, such as FIDO U2F, are secure ...
user avatar
  • 98.1k
58 votes

Are texted 2FA security codes deliberately easy to remember?

Roughly 85% of six digit random numbers will have at least one repeating digit and 40% will have a repeating sequential digit next to each other. (I am happy to be corrected on my math.) These keys ...
user avatar
  • 697
55 votes

Should 2FA be enabled on service accounts?

The trouble with requiring MFA on service accounts, is that it would have to be fully automated. For instance, a time based OTP. But as this OTP is based on a secret seed, it is effectively just ...
user avatar
53 votes
Accepted

When does 'something you have' NOT become 'something you know'?

When I have a public/private RSA-keypair with 4096 bit and I remember the private key without storing it anywhere, is it something I know? Yes. When I write down or store the private part of a ...
user avatar
52 votes

Is 2FA via mobile phone still a good idea when phones are the most exposed device?

Is 2FA via mobile the best security there is? No. SMS 2FA is the weakest form of 2FA, however, it's still worthwhile because it does improve security and it has a relatively low barrier of entry ...
user avatar
  • 31k
52 votes

Why is SMS used as a way of verifying a user's mobile, when it is not even encrypted in transit?

SMS is not exactly plaintext. The network operator has it in plaintext, but the attack surface there is limited and both organizational and technological measures limit the exposure. Over the air, it ...
user avatar
  • 3,395
50 votes
Accepted

Should the average user with no special access rights be worried about SMS-based 2FA being theoretically interceptable?

There is no real concept of an "average user with no special access rights". From the perspective of an attacker the main point is if the effort needed for an attack is less then the gain of the ...
user avatar
47 votes

Attacker circumventing 2FA. How to defend?

Out of band 2FA is the correct approach. This means that you have a second factor that can't be phished, like a client cert or FIDO U2F. Codes, or SMS-based 2FA models are the weakest 2FA options ...
user avatar
  • 35.4k
46 votes

What is a YubiKey and how does it work?

As I understand it, Yubikey acts like a USB keyboard. You plug it in your computer, place the cursor in a form field, press the button on the Yubikey, and it sends out a text string of 44 characters ...
user avatar
  • 7,349
45 votes

How did someone log-in to my Gmail account from Kenya?

Seeing as you're using Opera Mini this is a likely explanation: Unlike straightforward web browsers, Opera Mini fetches all content through a proxy server and reformats web pages into a format ...
user avatar
  • 8,404
43 votes
Accepted

What is the risk of having a 2FA key permanently plugged into my device?

The threat model for the Nano is protecting accounts from remote access, not from direct access from an approved device. You essentially make the device itself the "thing you have" factor with the ...
user avatar
  • 123k
38 votes
Accepted

2FA: Why do I need to keep my backup codes for each platform on paper?

Writing them to paper is one of the simplest, guaranteed to be safe from malware and hardware failure for the average people. If you have a password manager, usually you can store secure notes too, ...
user avatar
  • 506
36 votes

Four-factor authentication

Absolutely! Somewhere you are is quite widely used in corporate IT. In many environments, if you are on an office network, you can login using only a password, but if you are out of the office you ...
user avatar
  • 32.6k
36 votes

How secure are the FIDO U2F tokens

U2F is capable of using an encrypted channel using public key crypto to ensure ONLY the right server can get the one time token. This means plugging it in when on a phishing site means nothing happens&...
user avatar
  • 821
36 votes

In a "card not present" transaction, is the credit card number, expiry date & CVV considered as a "What you have" or a "What you know"?

A requirement for "what you have" based authentication is that ownership can be clearly assigned to a single specific entity. This specifically means that this information/device can not be (easily) ...
user avatar
36 votes

Why can't I share a one use code with anyone else?

It's to prevent social engineering attacks against you. Imagine, for example you logged into your two-factor gmail account on a shady public computer where a keylogger recorded your email address and ...
user avatar
  • 38.6k
35 votes
Accepted

Is it safe to store 2FA tokens together with passwords in 1password?

I work for 1Password, and I wrote exactly about this question when we introduced the feature. The answer depends on what security properties you actually want from time-based one time passwords (TOTP)....
user avatar

Only top scored, non community-wiki answers of a minimum length are eligible