Two-factor Authentication

Computer authentication is all about making sure that people are who they say they are. Authentication is usually the first step that you have to perform before being allowed to work on a computer.

For most of us today authentication is synonymous with entering a username and password. Passwords are one form of authentication and when you perform only one such form you are employing single factor authentication.

Two factor authentication is becoming increasingly important. Passwords are much too easy to “steal” by guessing them, phishing for them or simply looking under mouse pads.

Two factor authentication requires, naturally, two mechanisms for authentication. A password might be used but only accompanied by something else. What other authentication “factors” are there?

Wikipedia has a good taxonomy for authentication techniques. It breaks up authentication into three categories:

  • Something a person knows
  • Something a person has
  • Something a person is or does
  • A password is an example of something a person knows. A smartcard is an example of something the person has. A fingerprint is an example of something a person is or does.

    In case you’re thinking that a person has a fingerprint, you may be right. The difference between has and is may not always be easy to ascertain. To some degree, it’s a matter of convenience and intended purpose. The intended distinction between the two categories is that while you can lose or give away something you have you can’t do the same with something you are or do. This is mostly true although, if you saw Minority Report or, more recently, the made-for-TV version of The Andromeda Strain you’ve seen gruesome fictional depictions of “stealing” eyeballs and fingerprints.

    Two factor authentication requires that two authentication techniques be employed. Ideally each technique would use a different mechanism. Perhaps something you know (a password) and something you have (an RSA or Verisign OTP device). Some companies, however, have started to make use of two factor authentication based on two things the user knows. You’ve probably seen banking Web sites, for example, that ask you for a password as well as your mother’s maiden name or the name of your pet.

    Being in the security space, my company has spent a lot of time looking into the issue of two factor authentication. Smartcards seem like a great idea but we are disillusioned by inconsistent implementation of standards and the need for a plethora of drivers for different devices and different cards. OTP (one time password) devices don’t require any drivers but the companies that dominate the market (RSA and Verisign) are not very partner friendly.

    Employing biometrics seems like a good alternative to relying on what the user has. IBM/Lenovo laptops have been shipping fingerprint readers for years. Microsoft makes an inexpensive fingerprint reader, as well.

    Maybe, soon, giving your computer “the finger” will take on a completely different meaning.

    24 Responses to “Two-factor Authentication”

    1. I agree with your points, excellent post.

    2. Micki Mayden says:

      Great site you have here.. It’s hard to find good quality writing like yours these days. I honestly appreciate people like you! Take care!!

    3. Hello, There’s no doubt that your site could possibly be having internet browser compatibility issues. Whenever I take a look at your website in Safari, it looks fine but when opening in Internet Explorer, it’s got some overlapping issues. I simply wanted to provide you with a quick heads up! Other than that, fantastic website!

    4. Jimmie Grudt says:

      I’m curious to find out what blog platform you have been using? I’m experiencing some small security issues with my latest site and I’d like to find something more safe. Do you have any recommendations?

    5. naturally like your web-site but you have to check the spelling on quite a few of your posts. Several of them are rife with spelling problems and I find it very bothersome to tell the truth nevertheless I’ll surely come back again.

    6. Stevie Gioe says:

      I do love the manner in which you have framed this challenge and it does indeed provide us a lot of fodder for thought. However, coming from what precisely I have personally seen, I really hope as the actual comments stack on that folks continue to be on issue and in no way get started upon a soap box regarding the news of the day. Anyway, thank you for this exceptional point and while I can not really go along with this in totality, I regard the standpoint.

    7. Michal Dube says:

      I agree with your details , good post.

    8. Good information. Lucky me I came across your blog by chance (stumbleupon). I have book-marked it for later!

    9. Hi there! I know this is kinda off topic nevertheless I’d figured I’d ask. Would you be interested in exchanging links or maybe guest authoring a blog article or vice-versa? My site discusses a lot of the same topics as yours and I think we could greatly benefit from each other. If you happen to be interested feel free to shoot me an e-mail. I look forward to hearing from you! Fantastic blog by the way!

    10. Eko Ugnis

      I found a great…

    11. Thanks for your personal marvelous posting! I truly enjoyed reading it, you can be a great author.I will be sure to bookmark your blog and may come back very soon. I want to encourage you to continue your great work, have a nice weekend!

    12. Tanika Dejoseph

      I found a great…

    13. Jose Ron says:

      Please let me know if you’re looking for a writer for your blog. You have some really good posts and I feel I would be a good asset. If you ever want to take some of the load off, I’d absolutely love to write some material for your blog in exchange for a link back to mine. Please shoot me an email if interested. Thanks!

    14. Elida Kellie says:

      I appreciate your wordpress web template, where do you down load it from?

    15. Facebook Proxy

      I found a great…

    16. It’s hard to find educated people on this subject, but you sound like you know what you’re talking about! Thanks

    17. Angele Kaup says:

      Enjoyed examining this, very good stuff, thanks.

    18. Kati Mashek says:

      After I originally commented I appear to have clicked the -Notify me when new comments are added- checkbox and now whenever a comment is added I recieve four emails with the exact same comment. Perhaps there is an easy method you can remove me from that service? Thanks!

    19. After looking into a number of the blog posts on your blog, I honestly like your way of writing a blog. I saved as a favorite it to my bookmark site list and will be checking back soon. Please check out my website as well and tell me your opinion.

    20. Lorraine Herbick

      I found a great…

    21. Jazmine Aron says:

      Good site you’ve got here.. It’s difficult to find quality writing like yours these days. I really appreciate people like you! Take care!!

    Leave a Reply