Collaborate Disseminate
I’m prototyping an application that generates MFA codes. For developer simplicity I’m storing source data in clear text in Google Authenticator URI format (ex: otpauth://totp/totp@authenticationtest.com?secret=I65VU7K5ZQL7WB4E).
What is co… Continue reading How important is HOTP/TOTP secret key security?
This is a problem that many of us face: A surprising number of financial institutions’ websites offer additional authentication only via SMS and/or phone call. But I will refer to my situation specifically.
How can this be made safe again… Continue reading How to make SMS-based 2FA safer?
I have my iPhone connected to my MacBook and receive SMS codes on my computer, which is very convenient. I also recently learned you can have an authentication app on your MacBook too. I just wonder if this doesn’t defeat the purpose?
I al… Continue reading Do 2FA Codes on the same device defeat their purpose? [duplicate]
My organisation uses Google workspace.
2FA is enforced organisation wide
Enforce password rotation every 90 days [can always discuss if wanted but not current focus]
We encourage that people use for example Google Authenticator for their … Continue reading Google Workspace – Password rotation and Logged in Google Authenticator [closed]
Now I know this website is not for asking for specific software recommendations, but for my website for work purposes (as mentioned in another question,) I feel I need a more secure login protocol than just password- even though the passwo… Continue reading What 2FA should I use for my website login and what are the risks of 2FA?
At my old bank, logging in via a browser required that I open their app on my phone and tap a button to authenticate my login.
My new bank is very similar but instead of a single button to click, I have to choose, in the app, from a number… Continue reading Why is selecting a code in banking app necessary for MFA? [duplicate]
My site’s users currently do not have any MFA options, but we’re planning to release this feature in the near future. We’ve already built support for TOTP and have it working internally, but some on my team think that it won’t be very user… Continue reading If I’m rolling out MFA to users, should I provide TOTP, SMS or both? [duplicate]
Someone has hacked into my facebook and has it to no matter where i try to log in it forces me to go to a forced 2fa page which both options under it are hyperlinked to nonsense. can someone take a look to maybe offer some suggestions in r… Continue reading Facebook hacked with forced 2fa on infinite loop [closed]
I’m exploring the concepts of TOTP/HOTP in a simple JavaScript application with the help of this OTPAuth plugin.
The knowledge gap I’m hoping to fill is how do mobile MFA applications deduce the countdown timer duration from TOTP.generate(… Continue reading How to derive a TOTP countdown? [closed]
When two-factor authentication is described to me, people always say that it’s important for security to demonstrate at least two of 1) something you know, 2) something you have, and 3) something you are. It seems to me that the specific c… Continue reading In 2FA, why can’t the second factor be the computer? [duplicate]