The three classes that we all know and love:

  1. Something you know.
  2. Something you have.
  3. Something you are.

I've also seen references to "somewhere you are". Is this really a fourth factor? How many factors are there?

At some point some of the factors might start to resemble others such as the blurring of the "something you have" as described in this sec.SO question.

  • I would assume the somewhere you are is basically going to be a related to firewalls only allowing X IPs to communicate to the server/application.
    – Eric
    Commented Jan 6, 2012 at 20:11
  • "Somewhere you are" could also require being physically present in front of a given system.
    – bstpierre
    Commented Jan 6, 2012 at 22:10
  • @Eric, as bstpierre indicated, I was alluding more to GPS than IP address. Commented Jan 6, 2012 at 22:38
  • 1
    possible duplicate of Four-factor authentication Commented Sep 26, 2014 at 10:01

1 Answer 1


“Somewhere you are” seems to be a very reasonable authentication factor in 2012. A few weeks ago my Android’s Google Maps app prompted me to turn on my Wi-Fi to better locate me. My GPS was on and had a good location but Google was going the extra mile (or better stated – extra meters) by triangulating local Wi-Fi signals (Street View collected that for a reason).

So if Google wants to authenticate me based on my location compared to my typical routine they probably will have a valid factor for 90% of my trekking around this planet.

My gasoline pump asks for my Zip Code to process my credit card. My Zip Code is the same as that of the querying pump so it seems potential exists in that use case too. I know that typically the Zip Code question is "Something you know" but think about the actual location and likelihood it is me especially considering we are collocated in the same Zip Code and I have been there many times before.

Other factors will probably similarly be added with the changes in technology and virtual presence. “Something you do” might be one for example. My typing rhythm and keyboarding differs from many (e.g. lots of backspaces).

I am sure there will be some opportunities for factors in 10 years that we cannot conceive of today just as my Google Maps Android tracking was unconceivable to me 10 years ago.

  • 2
    GPS is definitely allowing somewhere you are to be a new form of factor. Note that typing patterns are already considered a form of biometrics and thus something you are. Commented Jan 6, 2012 at 20:51
  • 1
    Your statement about typing patterns also hints to the other side to my question: how many orthogonal factors can be defined? Commented Jan 6, 2012 at 21:13
  • 2
    @logicalscope: Maybe you should post that question. It is an interesting security question and of great importance nowadays.
    – Count Zero
    Commented Jan 7, 2012 at 10:24
  • @zedman9991 Realize this is an old question but just wanting to point out that the typing rhythm is considered a biometric ("something you are"). See en.wikipedia.org/wiki/Keystroke_dynamics.
    – Lan
    Commented Dec 11, 2014 at 17:33

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .