Multi-Factor Authentication & Account Recovery Methods

Learning Objectives

By the end of this tutorial, you will be able to:

• Contrast the differences between HOTP (Counter-based) and TOTP (Time-based) authentication algorithms.
• Explain the cryptographic exchange that occurs during a FIDO2/WebAuthn hardware key verification.
• Diagram a SIM-Swapping attack pathway and implement carrier-level countermeasures.
• Identify OSINT (Open Source Intelligence) techniques hackers use to guess security question answers.
• Design and manage an offline, disaster-proof account recovery plan.

Table of Contents

1. The Crisis of Single-Factor Security
2. Deep Dive: The 3 Core Factors of Authentication
3. Understanding TOTP: How Authenticator Apps Work Behind the Scenes
4. Hardware Security Keys: Phishing-Resistant Public-Key Cryptography
5. The Vulnerabilities of SMS/Email 2FA
6. Anatomy of a SIM-Swapping Attack
7. The Recovery Dilemma: Security vs. Availability
8. Mastering Backup Codes
9. Security Questions: Deprecation and OSINT Vulnerabilities
10. Step-by-Step: Setting Up a Secure Authenticator Vault (Aegis Guide)
11. Hands-On Practice Exercises

1. The Crisis of Single-Factor Security

Single-Factor Security: An authentication setup that relies on only a single credential (such as a password), creating a single point of failure that is vulnerable to theft or guessing.

If you protect your online accounts using only a password, you are relying on Single-Factor Security (Something You Know).

Even if your password is a 30-character passphrase, it can be compromised if:

• You type it on a computer infected with a keylogger.
• A site you use experiences an unencrypted database leak.
• You are tricked by a convincing phishing page.

Multi-Factor Authentication (MFA) introduces a second layer of defense. Even if an attacker gets your password, they are blocked because they cannot replicate the physical possession or biometric factor required to complete the login.

2. Deep Dive: The 3 Core Factors of Authentication

Authentication Factors: The three traditional categories of credentials used to verify identity: Knowledge (something you know), Possession (something you have), and Inherence (something you are).

To build true MFA, you must combine factors from different categories. If you use two items from the same category, you do not have MFA.

       AUTHENTICATION FACTORS
       +------------------------------------+
       |  1. KNOWLEDGE: Something You Know  | ---> Password, PIN, Passphrase
       +------------------------------------+
       |  2. POSSESSION: Something You Have | ---> Smartphone, YubiKey, Token
       +------------------------------------+
       |  3. INHERENCE: Something You Are   | ---> Fingerprint, Face ID, Iris
       +------------------------------------+

A. Something You Know (Knowledge)

• Definition: Information stored in your brain that you must retrieve.
• Examples: Passwords, PIN codes, patterns, recovery phrases, security questions.
• Risks: Easily forgotten, writeable, interceptable, and guessable by computers.

B. Something You Have (Possession)

• Definition: A physical item that you must hold in your hand.
• Examples: A smartphone (receiving a prompt), a hardware key (YubiKey), a hardware bank calculator, a USB token.
• Risks: Can be physically lost, stolen, or damaged.

C. Something You Are (Inherence)

• Definition: A physical or behavioral characteristic unique to your body.
• Examples: Fingerprint scans, facial geometry scans, retinal patterns, voice identification.
• Risks: Cannot be changed if compromised. If a company leaks your hashed face layout, you cannot replace your face like you would change a password.

3. Understanding TOTP: How Authenticator Apps Work Behind the Scenes

Time-Based One-Time Password (TOTP): A security standard that generates a temporary 6-digit code by applying an HMAC hash algorithm to a shared secret key and the current Unix timestamp.

Most authenticator apps use TOTP (Time-based One-Time Password), which is an open internet standard (RFC 6238).

Key Components of TOTP:

• Shared Secret Key:

  Shared Secret Key: A unique, random cryptographic key shared securely between the server and the authenticator app during setup, used as the seed for generating codes.

• Unix Epoch Time:

  Unix Epoch Time: A system for tracking time by counting the number of seconds elapsed since 00:00:00 UTC on January 1, 1970, which serves as a universal counter for TOTP synchronization.

• HMAC (Hash-based Message Authentication Code):

  HMAC: A specific type of message authentication code involving a cryptographic hash function and a secret cryptographic key, ensuring code integrity and authenticity.

The Math: How it works

1. Secret Key Sharing: When you enable 2FA on a site, the server generates a random string of bytes (the Shared Secret Key) and shows it to you as a QR Code.
2. Key Storage: Your app scans the QR Code and saves the Secret Key inside its local storage.
3. Calculating the Counter: Both the server and the app look at the current Unix Epoch Time (number of seconds since Jan 1, 1970). They divide this time by 30 seconds. $$\text{Counter} = \lfloor \text{Current Unix Time} / 30 \rfloor$$
4. HMAC Hashing: The app hashes the Counter using the Shared Secret Key with the HMAC-SHA1 algorithm: $$\text{Hash} = \text{HMAC-SHA1}(\text{Secret Key}, \text{Counter})$$
5. Dynamic Truncation: The algorithm takes this 160-bit hash and truncates it into a simple 6-digit number that is easy to read.

Because the system time is synchronized worldwide, both your phone and the server compute the exact same number at any given second, without ever needing to communicate with each other over the network.

4. Hardware Security Keys: Phishing-Resistant Public-Key Cryptography

Hardware Security Key: A physical token that authenticates users utilizing public-key cryptography and enforces site URL verification, making it immune to credential phishing attacks.

Standard TOTP is secure, but it can still be defeated by Adversary-in-the-Middle (AiTM) Phishing. If you log into a fake page, the phishing server will ask for your 6-digit TOTP code and forward it to the real website instantly.

To block this, the security industry created FIDO2 / WebAuthn hardware keys.

Key Concepts in Hardware Security:

• Public-Key Cryptography (Asymmetric Cryptography):

  Public-Key Cryptography: A cryptographic system that uses pairs of keys: public keys (which can be shared openly with anyone) and private keys (which are kept strictly secret by the owner).

• Challenge-Response Authentication:

  Challenge-Response: An authentication protocol where a server presents a challenge (a random cryptographic puzzle) and the client must sign it using a private key to prove ownership.

• Origin Verification:

  Origin Verification: A browser-enforced security check that verifies the exact protocol, domain name, and port of the website requesting authentication to block spoofed sites.

[ Browser (on phishing page) ] <---> [ Hardware Key ]
              |
              v
     Domain Verification: 
     Phishing URL does not match registered URL.
     Hardware Key refuses to sign challenge!

The Cryptographic Exchange

1. Registration: When you link a YubiKey to your account, the key generates a new public/private key pair. It sends the Public Key to the server and keeps the Private Key locked in its hardware chip.
2. Authentication Challenge: When you log in, the server sends a random puzzle (a challenge) along with the domain name of the website (e.g., github.com).
3. Origin Check: The hardware key checks the browser's active address bar. If you are on g1thub.com instead of github.com, the key stops.
4. Cryptographic Signature: If the origin matches, the key signs the challenge using its private key. The server verifies this signature using the stored public key.

Because the private key never leaves the physical USB device, and origin checks are enforced by hardware, FIDO2 keys are 100% phishing-resistant.

5. The Vulnerabilities of SMS/Email 2FA

Out-of-Band Delivery Risks: The vulnerabilities associated with sending validation codes through networks (cellular or standard email) that can be intercepted or diverted.

Many services default to SMS or Email codes because they require no user setup. However, these are the least secure 2FA methods:

Core Vulnerabilities Defined:

• IMSI Catcher (Stingray):

  IMSI Catcher: A cellular eavesdropping device that mimics a legitimate cell tower, forcing nearby mobile devices to connect to it and allowing the operator to intercept SMS traffic.

• SS7 Vulnerabilities:

  SS7 Vulnerabilities: Security flaws within the Signalling System No. 7 global telecommunications protocol suite that allow attackers to intercept calls and silently redirect text messages.

• No Encryption: SMS is sent in plaintext over cellular networks and can be intercepted using IMSI catchers (Stingrays) or routing exploits (SS7 vulnerabilities).

• Phishing Susceptibility: Attackers can build phishing boxes that request and capture SMS codes.

• SIM Swapping: The cell carrier can be tricked into porting your phone number to a hacker's SIM card.

6. Anatomy of a SIM-Swapping Attack

SIM Swapping: A social engineering exploit where an attacker ports a victim's phone number to a hacker-controlled SIM card to hijack incoming OTPs.

Here is how a hacker hijacks your phone number to bypass SMS 2FA:

Step 1: Hacker collects your Name, Address, & DOB (via breaches).
Step 2: Hacker calls your carrier: "I lost my SIM card, activate this new one."
Step 3: Hacker answers basic identity checks using leaked data.
Step 4: Carrier employee links your phone number to the hacker's SIM card.
Step 5: Your phone loses service. Hacker intercepts all SMS recovery codes.

How to Prevent SIM Swapping:

1. Disable SMS 2FA: Switch accounts to TOTP apps or security keys.

2. Carrier PIN/Passcode:

   Carrier PIN/Passcode: A secondary security passcode configured with a mobile provider that must be verified before any changes (like SIM replacements or transfers) can be made to the account.

   Call your mobile operator and request a high-security lock passcode. This requires a specific numeric PIN to be spoken over the phone before any SIM card modifications can occur.

3. Port-Out Freeze:

   Port-Out Freeze: A carrier-level security lock that completely blocks the transfer of a phone number to another network provider unless the customer undergoes strict in-person identity verification.

   Request a port-out freeze, which stops your number from being moved to another carrier without in-person ID verification.

7. The Recovery Dilemma: Security vs. Availability

The Recovery Dilemma: The security trade-off between creating rigid login verification pathways and offering accessible backup routes to prevent lockout.

If your account is secure, recovering it will be difficult. If your recovery options are easy, a hacker can exploit them to break in.

You must design a balanced account recovery plan to avoid getting locked out when you lose your devices.

8. Mastering Backup Codes

Backup Codes: Single-use, static strings of characters generated during 2FA configuration to serve as secondary recovery credentials if primary keys are unavailable.

Backup codes are your safety net. They bypass MFA checks when you don't have your phone or key.

• Single-Use: Each backup code works only once. When you use one, cross it off your list.
• Format: Usually a list of 8-to-10 characters.
• Location: Store them physically. Do not save them on cloud folders or as open images on your phone.

9. Security Questions: Deprecation and OSINT Vulnerabilities

Security Questions: A legacy password-reset mechanism relying on personal history answers, deprecated due to their susceptibility to OSINT profiling.

Many websites require you to set up Security Questions (e.g., "What is your mother's maiden name?" or "What was the name of your first school?") as an alternative recovery method.

The Security Flaw

Answers to these questions are static, easily discoverable through public records, OSINT (Open Source Intelligence), or social engineering (like those "First car, first concert" quizzes people answer on Facebook).

• OSINT (Open Source Intelligence):

  OSINT: The practice of legally collecting, analyzing, and synthesizing information gathered from publicly available, open sources (such as public databases, search engines, and social media profiles) to compile profiles on individuals.

Hacker searching your Facebook profile:
- Find mother's name -> Maiden name found.
- Find high school name -> Answer to school question found.
Result: Hacker bypasses your password and recovers your account.

The Solution: Lie and treat them as secondary passwords!

You do not have to tell the truth. Your security answers should be random strings or passphrases that you store in your Password Manager.

• Question: What was the name of your first pet?
  • Bad Answer: Rocky (Easy to guess/find)
  • Secure Answer: blue-guitar-ocean-carpet (Random passphrase)

10. Step-by-Step: Setting Up a Secure Authenticator Vault (Aegis Guide)

Secure 2FA App Configuration: The step-by-step installation and backup procedure needed to establish an open-source, encrypted authenticator database.

Unlike Google Authenticator, which historically did not support encrypted local exports, Aegis Authenticator (Android) and Raivo OTP or Tofu (iOS) are privacy-focused, open-source apps that give you complete control over your keys.

Here is how to set up Aegis:

Step 1: Install Aegis

Download Aegis Authenticator from the Google Play Store or F-Droid.

Step 2: Configure a Password and Biometrics

1. Open Aegis and go to Settings -> Vault.
2. Set a strong password to encrypt your vault.
3. Enable biometric unlock (fingerprint) for convenience.

Step 3: Add an Account

1. On your website account settings (e.g., GitHub), go to Security -> 2FA.
2. Select Authenticator App. You will see a QR code.
3. In Aegis, tap the + button at the bottom right.
4. Scan the QR code. The account is now added.

Step 4: Create an Encrypted Backup

1. In Aegis, go to Settings -> Backups.
2. Select Export.
3. Choose Aegis (encrypted) format.
4. Save the backup file (.json) to an external USB drive. If your phone breaks, you can import this file into a new Aegis app, type your vault password, and recover all your 2FA accounts instantly.

11. Hands-On Practice Exercises

Hands-On Exercises: Practical activities designed to help you configure carrier pins and safely generate backup codes.

Exercise 1: Build a Carrier Lock Plan

1. Find the customer support number for your mobile carrier.
2. Call them or open their official app.
3. Search for "Account PIN" or "Port protection."
4. Set up a secure 6-digit PIN that must be provided before any modifications are made to your SIM card.

Exercise 2: Generating and Storing Backup Codes

1. Go to your Google Account Security settings.
2. Go to 2-Step Verification.
3. Select Backup Codes and generate a new set.
4. Print them out or write them in a physical notebook. Keep this notebook in a secure drawer.