Hi,
I understand your question.
The main purpose of the two factor security system is that it generates a random code on your cellphone which you are then required to enter along with your password when logging on to the site, if you click on login with Facebook for instance it logs you in without you needing to enter the secret key, effectively by passing the security feature.
Yes, you skip Joomla login (with two factor authentication), but you must be authenticated with a social network (
much safer than Joomla).
Now let us say a person did not use one email for all of their accounts for example they use a personal email address for facebook and a work email to register on our site.
You can link your pre-existing account with Social Network Authentication, read docs at
http://docs.easy-profile.com/index.php/article/social-connect-intro.
Now someone comes along that wants to steal their personal info so this individual creates a fake Facebook account using their victim's work email address, when they now click on login with Facebook the system sees that this address exists so it links the two, the criminal can now login using Facebook and bypass the two factor authentication and gain access to all of the victim's personal info.
This is not possible for 2 reason:
- Facebook require to confirm your email address, otherwise you can not use Social Login
- If email match with another account is required Username and Password to link to pre-existing account (of course, first you have to confirm the email with facebook)
My question is basically this is it possible to if you click on any of the login with buttons have the system redirect you to a page that asks you to then enter the secret key before you are logged in.
No.
Or can one ad something that hides all personal information from the profile, with a button "View Info" which asks you to confirm your password before it shows any personal info
Sorry, I not understand this question.
Keep in mind that Joomla is a Open Source Project and it running on Open Source Systems (PHP), so, also with Two Factor Authentication Joomla never will reach the Security levels of most Important Social Providers.
Two Factor Authentication plugin is a feature for Joomla Authentication, not for Social Providers Authentication*.
* Some Social Provider like Google Plus have own Two Factor Authentication (see screenshot), so when you try to login via Google Plugin, you need to insert gmail credentials plus Two Factor code.