Group Actions
Engagement
  • Author Author: colporteur
  • Date Created: Date Created
  • Views 893 views
  • Likes 5 likes
  • Comments 5 comments
Related
Recommended

Authenticators share your experience with 2FA

colporteur

I recently needed an authenticator app to gain access to a security website. I looked at the three the website security vendor recommended for my phone. One I could use for free and the other two were free, only after I purchased a subscription that I could cancel.

The free authenticator app generated the numbers but didn’t work on the site. Back to tech support. They confessed to making an error in setting up my account. They corrected the problem and sent me a new link. I tried again to use the free authenticator app following the instructions the vendor provided, still it didn’t work.

image

Instead of going back to tech support, I branched out on my own and found authenticator software for Linux. I loaded Authenticator 3.32. The app generated codes but still failed to provide me with access to the site.

I then changed the provider option in the software to Amazon. I entered the 2FA token provided by the security website. The code generated by the authenticator passed authentication on the security website and it permitted me access.

What changed when I replaced the provider with Amazon? I’m going to assume it is the algorithm used to generate the codes.

I’m going off to do some research, but was hoping someone might have some insight or experience they will share.

Parents

  • Hi Sean,

    It's hard to know for sure precisely what happened since you mention it was a mistake in their account setup, but regarding this bit:

    "I then changed the provider option in the software to Amazon"

    That sounds like you're using "delegated authentication" where the site decides to trust you, _provided_ another (usually major) firm trusts you (trust isn't the correct word here, but it will do). You often have a choice of provider (not always, it is dependent on the site). By you selecting Amazon and logging in with them, then the original site you were using will trust you (because they can confirm directly with Amazon that Amazon was OK with you logging in with your Amazon account, presumably).

    Two factor authentication doesn't specify an algorithm, so it can differ, so usually specific software (or from a specific set) would need to be used. 

    Long story short, it's just a set of steps that help to make it less likely that someone who had stolen your credentials could impersonate you, because they would also have had to have stolen multiple credentials, or your mobile phone or whatever is being used for the other factor in 2FA. 

     

  • in reply to shabaz

    (Can't edit). By "Two factor authentication doesn't specify an algorithm" I mean the term "two factor authentication" could use one of any number of different algorithms, so you can't mix-and-match different software to do it always. It can also be called "multi-factor authentication" if you're googling it. It's just an umbrella term, that doesn't specify the details.

Comment
  • in reply to shabaz

    (Can't edit). By "Two factor authentication doesn't specify an algorithm" I mean the term "two factor authentication" could use one of any number of different algorithms, so you can't mix-and-match different software to do it always. It can also be called "multi-factor authentication" if you're googling it. It's just an umbrella term, that doesn't specify the details.

Children
No Data