Tag Info

Hot answers tagged

74

As you noted, the main three are: Something you know Something you have Something you are I'd argue that there are others: Something you can do, e.g. accurately reproducing a signature. Something you exhibit, e.g. a particular personality trait, or even neurological behaviour that could be read by an fMRI. These are not strictly "are" features, as ...


30

Absolutely! Somewhere you are is quite widely used in corporate IT. In many environments, if you are on an office network, you can login using only a password, but if you are out of the office you must use an additional factor, usually a token. The current time is arguably another authentication factor, a classic example being a time delay safe. Office ...


23

There are two standard ways to build such a device: Time-based. The device has a secret key K (known only to the device and to your bank). When you press the button, The device computes F(K, T) (where T is the current time) and outputs it as a 6-digit code. Your bank, which also knows K, can compute the same function. To deal with the fact that the ...


22

This is not a "one is better than the other" issue. Both increase the burden of an attacker to break into your system: Using (and enforcing) keys increases the "quality of the password" ("mypassword123" vs "long_binary_asymetric_keypair_here"). Humans are very bad at remembering long passphrases with good entropy. Using 2Factor auth ensures that an ...


22

Nope. There are three. All others mentioned here either: can be reduced to one of canonical three (e.g. "something you can do" is a personal feature, so classified as "something you are"; "someone you know" means you can present a proof of connection to someone - that's "something you have"!) are not part of authentication, but authorization (time, network ...


20

Passwords and biometrics have distinct characteristics. Passwords are secret data. Data is abstract: it flows quite freely across networks. Cryptography defines many algorithms which can use secret data to realize various security properties such as confidentiality and authentication. The shortcomings of passwords are due to the fact that they are meant to ...


17

Abstracted across a network, most biometrics implementations can still be boiled down to the category of "something you know". For a discussion of how that happens with "something you have," take a look at How is "something you have" typically defined for "two-factor" authentication?. Biometrics suffers from a problem where once a ...


15

Biometrics can be effective as authentication or as identification, but not both at the same time. According to Wikipedia, retinal scans are accurate to approximately one in one million, meaning on the earth today there are approximately 7,000 individuals who will be identified as you in a retinal scan. Assuming no further authentication is necessary, ...


14

If you're willing to delegate your user authentication function to someone else, then Google's two factor authentication is a good option.


13

I'm assuming that you mean for logon (or unlocking). I believe three factor is supported natively in Windows 7 with: Windows Biometric Service (requires attched device) PIV-compliant smart card (requires attached device) Password (Kerberos V5 for AD, and NTLMv2 for local) Windows Vista and Windows 7 have the same interactive logon architecture. They use ...


13

A weak password + two-factor authentication might still be safer than a strong password alone but it will be less safe than a strong password + two-factor authentication. It all depends on how weak you go: if you go all the way and make the password trivial you effectively end up with one-factor authentication (the Google text message to your phone). But ...


13

Specifically for Google, if you use two-factor authentication it is safe to "weaken" your password "from a 16-character password with a search space on the order of 1030 to an 8-character password with a search space on the order of 1014" as long as you use a good 8-character password (i.e. completely random and not re-used across sites). The strength of ...


13

I personally prefer Google Authenticator which is basically an elegant implementation of Time-Based One-Time Password Algorithm but I would not feel comfortable saying it “is more secure”. To use one of my favourite buzzwords… it all comes down to Threat Modelling. What exactly are you trying to protect against? Is it a technical attacker who might be able ...


12

Social engineering is hard to mitigate problem. Why? Because it's targeting the weakest security point of all system: users. So indeed, the more complicated the system is, the more complicated for attacker it gets. But usually, they get information because someone does not respect the protocol, e.g. sending confidential data by fax, giving information to ...


12

There are significant problems with all of these as a primary identifier. For example: Fingerprints/Palm - What happens if I fall off my bike and scuff my hand across the ground? My fingerprints are ruined for some time - possibly permanently. DNA - have you seen how easy it is to pick up blood or other material containing DNA? Typing - this has some ...


12

"Biometrics" and "100% accuracy" are distracting the other people answering from the core question: "Are there any other benefits to MFA?" and that the answer is in fact Yes, there are other security benefits to MFA. You're 100% certain you can identify everyone connecting to your site. You correctly reject an attacker attempting to brute force their way ...


11

I have one, and I'd recommend them! I actually got it for free from the Yubico guys, when I was attending BSidesLondon. Think of it as an RSA secure-key, except much smaller, cheaper and without a battery. You get (essentially) the same security, though YubiKeys have a signficantly larger keyspace than the RSA ones. They're also incredibly sturdy, and can ...


11

Google Authenticator supports the TOTP and HOTP algorithms. In both algorithms, a secret needs to be shared between the server and the client to successfully generate the one time passwords. I suggest you read the respective RFCs of the algorithms (or my answer here) to understand it better. Yes, if the attacker manages to get hold of the shared secret the ...


11

The initial commit for this code already includes the "80 bits" secret key length. It was not changed afterwards. Now let's analyze things more critically. HOTP is specified in RFC 4226. Authentication uses a "shared secret", which is the value that we are talking about. What does RFC 4226 says about it ? Essentially, there is a a requirement in section 4: ...


11

If you are 100% certain you can, with 100% confidence identify your wife based on her biometric data and that there is a 0% chance of someone spoofing her biometric data, then there will be no benefit to using multi-factor authentication. The problem comes in when the identifier, be it biometric data or username and password, can be leaked or spoofed. ...


10

When authenticating humans, the main danger is impersonation: someone else posing as the expected user. Since humans are biological and not digital, there must be some link between the two worlds: something which ties the concept of the physical identity to sequences of bits on which computers can feed. We use multi-factor authentication because every ...


10

What I can say, generally, is that you should not have a single point of failure. Be it your mobile phone (can be lost, damaged, stolen), some other computer or device (can be damaged), a piece of paper (can be lost, damaged) or even your memory (can forget things, especially if not used too often). Just like passwords usually have fallbacks for recovery ...


9

My metaphor for social engineering is that it's like water - it will find the point of least resistance and work it's way in. When user's have two factor authentication, then you're right that you may seal up one point in the leaky dam of access to the system - I would hope that most users won't blindly hand over their token, and with the security ...


9

There's a few other reasons: Error rate - false accepts and false rejects are still unacceptably high for many types of biometrics. User acceptance - still not widely trusted by users - the various privacy concerns are still quite high, and the idea that a part of your body is now a security mechanism is somewhat freaky for some folks. Security best ...


9

Put simply: cost. In this instance cost takes two forms, resource cost and monetary cost. Chances are great that if you have a computer or system of any type (desktop, server, mainframe, distributed, cloud, etc.) it has a built-in authentication mechanism: passwords. The time and money that it takes to bolt-on or integrate biometrics for average uses is too ...


9

I would recommend looking into PhoneFacter. I have looked at them in the past and found it to be a very interesting concept. Much like your bank they use telephones as the second factor, and offer either SMS or direct voice calls for verification. Whether they are "Cost Effective" will, of course, depend on what those words mean to you.


9

Although I have not personally used them, I have heard very good things from several sources about YubiKey, which is a tiny hardware key that's plugged into a computer USB port and basically provides a one time password which changes each time it is used.


9

We provide a two-factor solution at Duo Security which can use voice, SMS, mobile device, and hardware tokens. Our open-source web and unix clients may also help you evaluate your options (both ours, others, and towards rolling your own). Disclaimer, I am a Duo developer.


9

If an SSH key is protected by a passphrase, then it's just encrypted with that passphrase. There isn't an additional authentication component. That is, you can decrypt the key client-side (and store the decrypted key), and the server won't ever know. In fact, many users use "key agents" which allow you to enter your decryption passphrase only once, and the ...



Only top voted, non community-wiki answers of a minimum length are eligible