I am a little confused about the definition of two factor authentication. Does a login method containing a hardware generated pin and SMS verification constitute two factor authentication?
2 Answers
Strictly speaking 2FA only means two factors are used to authenticate a user.
What we usually see is a password based authentication coupled with an SMS or app (e.g. RSA Secure ID or Google Authenticator) generated OTP (One-Time Password) code.
In your example, two factors are used.
- Hardware generated PIN
- SMS verification
However this doesn't comply with the best practice where at least two of the following principles are considered.
- Who you are (Identification), like just giving your username.
- What you know (1st Authentication), like giving your password.
- What you have (2nd Authentication), like giving an OTP from a token/app.
- What you are (3rd Authentication), like giving IRIS-scan or fingerprint (although this is debatable because some state that bio-metrics is a means of Identification).
Both the SMS and the hardware generated PIN are in the category 'What you have'. If you use two 'What you have' factors, both are equally likely to be stolen [Remember why noting down passwords is a bad practice.]
Most infosec professionals refer to an authentication solution as "two-factor" when it combines factors from two different authenticator categories: what you know, what you have, and what you are (biometrics). A hardware device generating a PIN (one-time password presumably?) and a phone receiving a SMS verification code (also presumably generated randomly by the authentication server) would normally be considered two 'what you have' factors.
Thus they wouldn't meet the normal definition of two-factor authentication, despite offering pretty good security against attacks.
hardware generated pin, I suppose you must be talking about a synchronized PIN like SecureID, right?