New answers tagged

0

If you go too far deep, everything becomes something you have. If attacker has access to your computer and has installed lets say a key logger, then they can extract your password and extract TOTP key from your app. So if your level of security allows for a software app for one time passwords, then a use of a competent password manager shouldn't be worse ...


0

Yes, if the 2FA app contains and uses a secret that's unique to you. If it's got an embedded client key that's different for each install, then it becomes something that you, and only you, have (ignoring the risk of exfiltration). If multiple users have identical 2FA app it can no longer be something that authenticates you, and only the passcode you provide ...


3

The 6 digit code is only something you know and the app is not unique so cannot be a something you have. Furthermore a 6 digit code + a password would only be 2 something you know. But if the app also has a unique token stored in your phone and hard to extract, it becomes a something you have: nobody with the same app and the 6 digit code but anotheur phone ...


12

As far as I am familiar with similar schemes the argument is not that the username is a factor (it's the identity), but the claimed two factors would be: The device you have generates a unique code when you install the app and goes through some type of more robust authentication system (e.g. a similar Dutch scheme1 will sent you both an SMS and an email and ...


2

Correct me if I'm wrong (the source docs, as you say, are in Danish), but this is how it seems. Start by asking what I need, to access a resource protected with this system, that is otherwise too well protected to gain unauthorised access, I get the following: I need a username. This is what you enter as an identity, so it can't also be an authenticating ...


4

Can you guarantee that the person using the 2FA application is using a password, passcode, or other method to unlock either their phone or their authenticator app? Unless you are working in an organization with specific device policies and are sure that people are using their organization-managed device for their 2FA application, you can't. Can you guarantee ...


16

Usernames are not meant to be a secret, and as you show, they can be enumerated. In MFA, you are authenticating as that user. So, the username can't be a factor. By dropping the password and relying on a 2FA app, the 2FA code becomes a single factor. So, they are using 2FA tools to implement a single factor. The secret to open the app (i.e. "the code to ...


Top 50 recent answers are included