4

For a business account at a Bitcoin exchange, either of two people need to be able to send bitcoins or withdraw. This account will be configured with two-factor authentication.

How can two of the business' staff, located in different offices, each have access to the account?

The exchange specifically will be with BitFloor using Google Authenticator OTP, but the same question would apply for using Mt. Gox, with Yubikey, for instance.

Improve this question
1
  • Apparently with YubiKey, the exchange needs to accommodate multiple OTP authentication devices. It looks like the only exchange to support multiple simultaneous Yubikey authenticators is Mt. Gox. The private key for Google Authenticator can be replicated so that doesn't have this restriction, as Daniel H answered below.
    – Stephen Gornick
    Commented Aug 28, 2012 at 18:16

2 Answers 2

Reset to default
2

With Google Authenticator, you scan a barcode into your phone and it generates a temporary 6-digit key every minute, regardless of whether the app is open or not. It is not limited to one person, just to one account. These codes rely on times being in sync so that when an authenticator code expires, it expires on the site as well. Most use two protocols - HOTP and TOTP.

Highlights from this answer: https://security.stackexchange.com/a/35159

HOTP = Client and server share a counter, when code generated, timer increments, producing a new one-time login code.

TOTP = HOTP except the counter is replaced by the current time. So long as the system times are in sync, both the client and the server will be on the same page as far as what 2FA code is currently the correct one.

If multiple people scan this barcode, they will all generate the same keys. Thus, all you need to do is have both people present when setting up two-step authentication (or save the barcode if they have incompatible schedules, but be sure to shred it later), and they will both be able to access the account whenever they want.

Due to best OpSec practices, it is best to have separate 2FA keys, or use an alternative method, such as key-pair authentication where each user has their own key to access the server. This is better for auditing purposes where you can determine more easily the difference between different users, especially if one user decides to do something malicious using a shared authentication code.

Improve this answer
2
  • Oh, of course -- with Google Authenticator I can copy the QR code (e.g., screen shot if necessary) and then share that (in a secure manner) with each party that needs access.
    – Stephen Gornick
    Commented Aug 28, 2012 at 18:13
  • @SentientFlesh I think your edit should have been a separate answer. I'm leaving it before this comment because it adds good information, but that information isn't always usable by website clients, depending on what the security policies actually are.
    – Daniel H
    Commented Dec 24, 2019 at 13:50
0

With Mt.Gox you can add multiple authenticators; while I'm not sure if you can add two copies of the same type of authenticator, it is worth a try.

Improve this answer

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge you have read our privacy policy.

Not the answer you're looking for? Browse other questions tagged or ask your own question.