Additionally, is two-factor authentication in general less secure, and if so, why?


Yes, it appears that RSA SecureIDs were compromised. RSA hasn't clearly stated that the algorithm or other critical data is safe, and not saying so outright is pretty revealing.

No, this doesn't make other forms of two-factor authentication any less secure.

  • +1 @ceejayoz: So is there even the remote chance that the recent exploits were a response to RSA's reported breach in security, but only in the sense that a party not related to the breach at RSA had already broken the encryption or key generation algorithm, and were concerned the window of opportunity to exploit it might close due to an unexpected response by RSA; such as the release of even stronger algorithm and/or modified seed. Meaning the breaches that have been reported to be related to RSA's breach are only indirectly related, and this was not a chained-exploit; no pun intended. – blunders Jun 4 '11 at 1:48
  • @ceejayoz: Also, I'm wondering if the concept of attacking the server hosting the two-factor authentication or server algorithms/data enabling it as an exploit some how makes it less secure in general, simple by the awareness of it as an attack vector, and the level of trust such an authentication method might be given. – blunders Jun 4 '11 at 1:53
  • 1
    I think everyone using SecureIDs and similar tech has been aware of the potential danger of a breach of the algorithms. These authentication methods are supplemental to strong passwords, as well. RSA appears to be reissuing new SecureIDs to the affected customers. – ceejayoz Jun 4 '11 at 2:26
  • +1 @ceejayoz: Thanks for the clarification, my take is that there has been an exponentially increase in the awareness of this threat. Also, don't believe security in general has exponentially improved in the recent past. So, my claim is that two-factor authentication is now in fact less secure due to greater awareness of these exploits. Passwords provide very limited level of security; meaning the security provided by passwords is really related to IDS and physical security, passwords alone are of little value; that said, keys, not passwords are the my main focus of my question. – blunders Jun 4 '11 at 3:07
  • 1
    Why would awareness of potential exploits make it less secure? If companies know about the exploits, they are more likely to take measures to prevent attacks using these venues. – ceejayoz Jun 4 '11 at 3:19

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.