Take the 2-minute tour ×
Information Security Stack Exchange is a question and answer site for Information security professionals. It's 100% free, no registration required.

The three classes that we all know and love:

  1. Something you know.
  2. Something you have.
  3. Something you are.

I've also seen references to "somewhere you are". Is this really a fourth factor? How many factors are there?

At some point some of the factors might start to resemble others such as the blurring of the "something you have" as described in this sec.SO question.

share|improve this question
    
I would assume the somewhere you are is basically going to be a related to firewalls only allowing X IPs to communicate to the server/application. –  Eric Jan 6 '12 at 20:11
    
"Somewhere you are" could also require being physically present in front of a given system. –  bstpierre Jan 6 '12 at 22:10
    
@Eric, as bstpierre indicated, I was alluding more to GPS than IP address. –  logicalscope Jan 6 '12 at 22:38

1 Answer 1

up vote 5 down vote accepted

“Somewhere you are” seems to be a very reasonable authentication factor in 2012. A few weeks ago my Android’s Google Maps app prompted me to turn on my Wi-Fi to better locate me. My GPS was on and had a good location but Google was going the extra mile (or better stated – extra meters) by triangulating local Wi-Fi signals (Street View collected that for a reason).

So if Google wants to authenticate me based on my location compared to my typical routine they probably will have a valid factor for 90% of my trekking around this planet.

My gasoline pump asks for my Zip Code to process my credit card. My Zip Code is the same as that of the querying pump so it seems potential exists in that use case too. I know that typically the Zip Code question is "Something you know" but think about the actual location and likelihood it is me especially considering we are collocated in the same Zip Code and I have been there many times before.

Other factors will probably similarly be added with the changes in technology and virtual presence. “Something you do” might be one for example. My typing rhythm and keyboarding differs from many (e.g. lots of backspaces).

I am sure there will be some opportunities for factors in 10 years that we cannot conceive of today just as my Google Maps Android tracking was unconceivable to me 10 years ago.

share|improve this answer
2  
GPS is definitely allowing somewhere you are to be a new form of factor. Note that typing patterns are already considered a form of biometrics and thus something you are. –  logicalscope Jan 6 '12 at 20:51
    
+1 Good point, thanks. –  zedman9991 Jan 6 '12 at 20:53
1  
Your statement about typing patterns also hints to the other side to my question: how many orthogonal factors can be defined? –  logicalscope Jan 6 '12 at 21:13
2  
@logicalscope: Maybe you should post that question. It is an interesting security question and of great importance nowadays. –  Count Zero Jan 7 '12 at 10:24

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.