Token authentications for two factor authentication question / suggestion?
While I comprehend the desire for two factor authentication it is severely problematic in many ways for non casual technology creators.
The issue stems from a couple of assumptions made when two tokens are used.
#1 the first is assumption of use of Google or Apple products there are about 90 telephone operating systems in use today Andriod and IOS are only two.
#2 Email token generation is inherently insecure as smtp is vulnerable to man in middle and interception by packet capture. The assumption of security in email system is false.
#3 Device portability is necessary for development and in multisystem or grid of servers the assumption tat a single device that stores the token is a flaw.
#4 Often companies will use SMS as a method of authentication like Amazon does this is as bad as and worse than smtp (email) as the actual sms protocal is either Xmpp or SMTP all phone numbers have a email address for the phone number and the server for all phone numbers is public info to allow text messaging to work between networks. I can automatically look up the telephone numbers email server and do a PCAP on the IP with my text message content as the filter and find the token in capture, same goes for all cellular traffic. CLEC license holders do these things as normal QOS testing. This assumption of any SMS security is flawed.
#5 The use of either Apple or Google for any form of security is a major false trust issue as both are 100% compromised and easily circumvented due to their use of SWIFT security provided by Dr Chow of Elizabethtown University head of cyber security as the basis for secure payment. This system is designed on a 56bit 1976 security standard that was implemented in 1981 and has not been updated since. LOL ANy standard 64 bit home computer can access the system and defraud security measures with a bit of knowledge. Trust in their security is laughable. I know I have directly addressed the issue and was informed that they also rely on perceptual security.
Suggestions
#1 allow account holders to opt out of two factor token authentication.
#2 As simple asterisk server can be set up with a voice menu prompt to enter a displayed captcha code on login the person logs in with correct password their phone number on account is called and they enter on screen captcha prompt this allows the asterisk server instance to authenticate the current session token on server side until user logs out. Call Data Record provides receipt of transaction.
#3 When a user logs in with two factor opted out of, the already provided questions and answers can be used to verify identity.