Cyberstudy
PDF p.90 In progress

Soft Authentication Tokens

Open PDF at p.90 15 flashcards

Summary

PDF p.90

Soft authentication tokens are one-time passwords (OTPs) generated by the identity provider and sent to the user via SMS, email, or an authenticator app. While SMS and email tokens are vulnerable to interception, authenticator apps offer a more secure alternative.

In plain words

Supplementary — not from your PDF

Soft tokens are one-time codes delivered by software: SMS, email, or an authenticator app. Apps are the stronger option; SMS and email codes can be intercepted and count only as two-step verification.

Detailed explanation

PDF p.90
  • Soft Authentication Tokens
    • Definition: OTPs generated by the identity provider and transmitted to the user.
    • Transmission Methods: Sent via SMS/text message, email, or authenticator app.
    • Expiry: Typically have an expiry period, even if counter-based.
  • SMS and Email Tokens
    • Nature: Do not count as an ownership factor.
    • Description: Considered two-step verification rather than true MFA.
    • Vulnerability: Highly susceptible to interception.
  • Authenticator App Tokens
    • Definition: More secure OTPs generated by software installed on a computer or smartphone.
    • Registration: Users register each identity provider with the app using a QR code to communicate the shared secret.
    • Authentication Process: Users unlock the app with their device credential to view the OTP token.
    • Security: Less risk of interception compared to SMS or email, but potential malware threats on shared-use devices.

Important terms

taken from the text above
Soft Authentication Tokens
OTPs generated by the identity provider and transmitted to the user.
Transmission Methods
Sent via SMS/text message, email, or authenticator app.
Expiry
Typically have an expiry period, even if counter-based.
SMS and Email Tokens
Considered two-step verification rather than true MFA.
Nature
Do not count as an ownership factor.
Authenticator App Tokens
More secure OTPs generated by software installed on a computer or smartphone.
Registration
Users register each identity provider with the app using a QR code to communicate the shared secret.
Authentication Process
Users unlock the app with their device credential to view the OTP token.

Examples & real-world scenarios

Supplementary — not from your PDF
  • A code texted to your phone.
  • An authenticator app set up by scanning a QR code.
  • A code emailed during a login.

Scenario

An executive's phone number is moved to an attacker's SIM through social engineering at the phone company, and SMS codes now go to the attacker. An authenticator app wouldn't have been affected.

Common mistakes

Supplementary — not from your PDF
  • Treating SMS codes as strong MFA.
  • Forgetting that authenticator apps can be exposed by malware on the device.

Practical skills

Supplementary — not from your PDF
  • Recommend a soft-token method for a given risk level.

What I should remember

Key Points PDF p.90
  • Soft Authentication Tokens
    • Definition: OTPs sent to users.
    • Methods: SMS, email, authenticator app.
    • Expiry: Have an expiry period.
  • SMS and Email Tokens
    • Two-Step Verification: Not true MFA.
    • Vulnerability: Prone to interception.
  • Authenticator App Tokens
    • Secure OTPs: Generated by an app.
    • Registration: Uses QR codes for shared secrets.
    • Authentication: Requires unlocking the app.
    • Security: Less interception risk, potential malware threats.