Is Second Factor Authentication Broken? an Analysis of 2FA Token Harvesting Techniques and the Transition to Universal Second Factor Authentication

Abstract

Second factor authentication (2FA) is the process of providing two different authentication factors to gain access to desired resources. 2FA involves combining something the user knows, most commonly a password, with something that they have. The “something they have” ranges from one-time passcodes sent through SMS or mobile applications, to biometrics and hardware tokens. While 2FA is better than simply using passwords to secure accounts, recently released tools reveal critical vulnerabilities for users attempting to secure accounts with SMS or authenticator app-based one-time passcodes (OTPs). This project details how one of those particular tools accomplishes the task of automatically harvesting user credentials and OTPs. Additionally, the project details how Universal 2nd Factor (U2F), an open source authentication protocol, can be used to provide more robust security for user accounts than 2FA. The project discusses features of the protocol’s security as well as issues associated with implementation.