130
votes
Accepted
Are texted 2FA security codes deliberately easy to remember?
I have noticed this too, and I think it is a result of the human brain's tendency to apply patterns to random noise. This seems to be more common when specifically trying to remember a string of ...
- 1,138
126
votes
Why can't I share a one use code with anyone else?
They're not being precise because they don't have to, and precise language might confuse some users.
They could say, for example, "You should not share unused codes that are less than an hour old ...
- 6,080
100
votes
Accepted
How are one-time password generators like Google Authenticator different from having two passwords?
Passwords are revealed every time you use them: if you have two passwords and you type them into a fraudulent web form, they are both stolen.
The shared secret can't be calculated from a single OTP (...
- 19.2k
99
votes
Accepted
What's the point of Microsoft Account 2FA if it still lets me log in using password instead?
You didn't actually set up 2FA. You set up your authenticator as an alternative method of single-factor authentication. This is clear from the first screenshot: "... to sign in without a password&...
- 50.3k
79
votes
Accepted
Why do apps with phone verification send the user a message, rather than have the user send one to them?
It's quite easy to send an SMS message that appears to come from the phone number of your choice without actually controlling that number. And so sending an SMS from a number doesn't verify your ID in ...
- 10.3k
77
votes
Accepted
Force user to remove USB token
You are trying to use a technical tool to solve a social problem. The answer is that cannot fit.
Techniques can provide great security when correctly used, but only user education can allow proper ...
- 26.8k
75
votes
Accepted
Why is SMS used as a way of verifying a user's mobile, when it is not even encrypted in transit?
Yes, you're right. SMSes are not recommended in any two-factor authentication (2FA) process nowadays. They can be easily intercepted and modified.
That's why a lot of companies are recommending other ...
- 1,554
70
votes
Why is SMS OTP not as secure as Authenticator Applications such as Microsoft Authenticator?
A few reasons:
It's relatively easy (though getting harder, thankfully) for an attacker to hijack somebody's phone number; the attacker convinces the cell provider to either port the victim's number ...
- 50.3k
65
votes
Accepted
Attacker circumventing 2FA. How to defend?
Not all two-factor authentication schemes are the same. Some forms of 2FA, such as sending you a text message, are not secure against this attack. Other forms of 2FA, such as FIDO U2F, are secure ...
- 100k
59
votes
Are texted 2FA security codes deliberately easy to remember?
Roughly 85% of six digit random numbers will have at least one repeating digit and 40% will have a repeating sequential digit next to each other. (I am happy to be corrected on my math.)
These keys ...
- 707
55
votes
Should 2FA be enabled on service accounts?
The trouble with requiring MFA on service accounts, is that it would have to be fully automated. For instance, a time based OTP.
But as this OTP is based on a secret seed, it is effectively just ...
- 1,638
53
votes
Is 2FA via mobile phone still a good idea when phones are the most exposed device?
Is 2FA via mobile the best security there is? No. SMS 2FA is the weakest form of 2FA, however, it's still worthwhile because it does improve security and it has a relatively low barrier of entry ...
- 31.6k
53
votes
Accepted
When does 'something you have' NOT become 'something you know'?
When I have a public/private RSA-keypair with 4096 bit and I remember the private key without storing it anywhere, is it something I know?
Yes.
When I write down or store the private part of a ...
- 206k
53
votes
Why is SMS used as a way of verifying a user's mobile, when it is not even encrypted in transit?
SMS is not exactly plaintext.
The network operator has it in plaintext, but the attack surface there is limited and both organizational and technological measures limit the exposure.
Over the air, it ...
- 3,568
51
votes
What, if anything, can a person accomplish who has intercepted an emailed QR image for Authenticator?
They will be able to initialize Authenticator and to produce at any time the same 6-digit PINs as you. Not less and not more.
If they don't know your password, you are still safe. But effectively the ...
- 12.5k
49
votes
Accepted
Should the average user with no special access rights be worried about SMS-based 2FA being theoretically interceptable?
There is no real concept of an "average user with no special access rights". From the perspective of an attacker the main point is if the effort needed for an attack is less then the gain of the ...
- 206k
49
votes
Accepted
What is the point of entering numbers in the two-factor authentication app?
A Challenge/Response mechanism provides mutual authentication. The request needs to be validated on both sides and it is a more positive overt action.
For MFA notification-based 2FA, all one needs to ...
- 132k
47
votes
Attacker circumventing 2FA. How to defend?
Out of band 2FA is the correct approach. This means that you have a second factor that can't be phished, like a client cert or FIDO U2F. Codes, or SMS-based 2FA models are the weakest 2FA options ...
- 35.9k
45
votes
Accepted
Is it safe to store 2FA tokens together with passwords in 1password?
I work for 1Password, and I wrote exactly about this question when we introduced the feature.
The answer depends on what security properties you actually want from time-based one time passwords (TOTP)....
- 6,625
43
votes
Accepted
What is the risk of having a 2FA key permanently plugged into my device?
The threat model for the Nano is protecting accounts from remote access, not from direct access from an approved device. You essentially make the device itself the "thing you have" factor with the ...
- 132k
40
votes
Accepted
2FA: Why do I need to keep my backup codes for each platform on paper?
Writing them to paper is one of the simplest, guaranteed to be safe from malware and hardware failure for the average people. If you have a password manager, usually you can store secure notes too, ...
- 561
36
votes
In a "card not present" transaction, is the credit card number, expiry date & CVV considered as a "What you have" or a "What you know"?
A requirement for "what you have" based authentication is that ownership can be clearly assigned to a single specific entity. This specifically means that this information/device can not be (easily) ...
- 206k
36
votes
Why can't I share a one use code with anyone else?
It's to prevent social engineering attacks against you. Imagine, for example you logged into your two-factor gmail account on a shady public computer where a keylogger recorded your email address and ...
- 39.5k
33
votes
What is the point of entering numbers in the two-factor authentication app?
This is to prevent multi-factor authentication fatigue attack and other situations where the victim erroneously approve the authentication attempt.
From Advanced Microsoft Authenticator security ...
- 33k
32
votes
Don't one-time recovery codes for 2FA introduce a backdoor?
tl/dr: One time recovery codes give account owners an option for regaining lost access. People who consider this an additional risk
can always ignore it or destroy it, but people who are worried ...
- 31.5k
32
votes
Accepted
Security of 2FA codes in-transit
If we assume TLS is not broken, then it doesn't really make sense to add obfuscation to transmit the OTP codes.
If we assume TLS is broken, it doesn't really make sense, as the Javascript transmitted ...
- 16.9k
31
votes
Accepted
How does password reset work if 2FA is enabled?
Technically, this is a question about how you should implement 2FA (or how you should expect it to be implemented), since there's nothing inherent in 2FA that answers your questions in either ...
- 50.3k
30
votes
Should 2FA be enabled on service accounts?
Multi-factor authentication is certainly possible without human intervention.
However, it requires a frame challenge.
When dealing with humans, the three typical factors for authentication are ...
- 6,080
29
votes
Is 2FA via mobile phone still a good idea when phones are the most exposed device?
SMS 2FA is not only a bad idea; it's worse than not having 2FA at all (password only). This is because virtually all services offering "SMS 2FA" are actually delivering SMS 1FA! That is, they allow ...
Only top scored, non community-wiki answers of a minimum length are eligible