Skip to main content
added 126 characters in body
Source Link

At least one way to look at this is to consider the strength and quality of the authentication offered at the target site against the Identity Provider (IDP) you intend to federate with.

For example, consider if you have a choice between opening a new account with a plain old password (which you will store in your Password Manager app) vs. redirecting to an IDP that performs Risk-Based Authentication (RBA) in addition to your password for the IDP. The system with RBA potentially will consider a variety of factors to score the authentication session, such as the IP address of the client, the characteristics of the browser, the "normal" pattern of the behavior for that user, etc. If the risk score turns out to be high, you may get prompted for answering some questions or another step up method already configured at that IDP.

In this case, which option do you prefer? Just the plain-old password, or an IDP with Password+RBA? Services such as Facebook are gradually deploying risk-based capabilities on top of the authentication service (which is why you may get prompted with a picture of a friend to name, etc). You can read more about RBA in this report:

http://www.landsbankinn.is/library/Documents/Frettir/The_Forrester_Wave_Risk-B1.pdf

a more generic definition is available from here:

http://whatis.techtarget.com/definition/risk-based-authentication-RBA

Regards.

At least one way to look at this is to consider the strength and quality of the authentication offered at the target site against the Identity Provider (IDP) you intend to federate with.

For example, consider if you have a choice between opening a new account with a plain old password (which you will store in your Password Manager app) vs. redirecting to an IDP that performs Risk-Based Authentication (RBA) in addition to your password for the IDP. The system with RBA potentially will consider a variety of factors to score the authentication session, such as the IP address of the client, the characteristics of the browser, the "normal" pattern of the behavior for that user, etc. If the risk score turns out to be high, you may get prompted for answering some questions or another step up method already configured at that IDP.

In this case, which option do you prefer? Just the plain-old password, or an IDP with Password+RBA? Services such as Facebook are gradually deploying risk-based capabilities on top of the authentication service (which is why you may get prompted with a picture of a friend to name, etc). You can read more about RBA in this report:

http://www.landsbankinn.is/library/Documents/Frettir/The_Forrester_Wave_Risk-B1.pdf

Regards.

At least one way to look at this is to consider the strength and quality of the authentication offered at the target site against the Identity Provider (IDP) you intend to federate with.

For example, consider if you have a choice between opening a new account with a plain old password (which you will store in your Password Manager app) vs. redirecting to an IDP that performs Risk-Based Authentication (RBA) in addition to your password for the IDP. The system with RBA potentially will consider a variety of factors to score the authentication session, such as the IP address of the client, the characteristics of the browser, the "normal" pattern of the behavior for that user, etc. If the risk score turns out to be high, you may get prompted for answering some questions or another step up method already configured at that IDP.

In this case, which option do you prefer? Just the plain-old password, or an IDP with Password+RBA? Services such as Facebook are gradually deploying risk-based capabilities on top of the authentication service (which is why you may get prompted with a picture of a friend to name, etc). You can read more about RBA in this report:

http://www.landsbankinn.is/library/Documents/Frettir/The_Forrester_Wave_Risk-B1.pdf

a more generic definition is available from here:

http://whatis.techtarget.com/definition/risk-based-authentication-RBA

Regards.

Source Link

At least one way to look at this is to consider the strength and quality of the authentication offered at the target site against the Identity Provider (IDP) you intend to federate with.

For example, consider if you have a choice between opening a new account with a plain old password (which you will store in your Password Manager app) vs. redirecting to an IDP that performs Risk-Based Authentication (RBA) in addition to your password for the IDP. The system with RBA potentially will consider a variety of factors to score the authentication session, such as the IP address of the client, the characteristics of the browser, the "normal" pattern of the behavior for that user, etc. If the risk score turns out to be high, you may get prompted for answering some questions or another step up method already configured at that IDP.

In this case, which option do you prefer? Just the plain-old password, or an IDP with Password+RBA? Services such as Facebook are gradually deploying risk-based capabilities on top of the authentication service (which is why you may get prompted with a picture of a friend to name, etc). You can read more about RBA in this report:

http://www.landsbankinn.is/library/Documents/Frettir/The_Forrester_Wave_Risk-B1.pdf

Regards.