I've been looking into the various pros/cons of tokenless (particularly SMS based) and traditional token based two-factor authentication (think RSA SecurID). After doing some research, I think I have a better understanding of the two options when it comes to usability, cost, etc, but I'm having trouble finding good in-depth independent analysis of the security of each solution.
As I understand it so far, tokenless 2FA is cheaper and easier to deploy. I also appreciate that some people are less likely to forget their mobile than they are to forget their OTP token. Disadvantages include the fact that some level of SMS reception is required, although vendors have produced solutions to deal with this, including send the next code immediately after the last one is used, "day use" codes and sending multiple codes in each SMS. Am I right in thinking that these "solutions" are actually a bit of a security compromise? If so, how much of a compromise are they, realistically? I've also heard some say that going through the process of receiving the SMS each time can be a pain for regular users, with traditional tokens being more practical. Has anyone found this to be the case?
Advantages of traditional OTP tokens include the fact that no phone reception is required, and they're practical for regular users. Would you recommend deploying traditional tokens to employees that travel internationally (due to mobile reception issues)?
With tokenless 2FA being both cheaper and easier to deploy, you'd think that traditional tokens would be going out of fashion much quicker than they are. If you were to believe the marketing material from companies such as SecureEnvoy, the days of traditional OTP tokens are numbered. However, I get the impression this isn't quite the case. This leads me to think that many companies are sticking with traditional physical tokens because they believe them to be more secure than tokenless 2FA. Is this the case, or is it due to some other factor? Are traditional solutions like RSA SecurID just trading on the market position they've established in the past, or is there still case for physical tokens?
On first inspection, soft tokens seem to provide some of the benefits of SMS based tokens, without the requirement for SMS reception. If users have smartphones, would that be a better option? Is it a no-brainer to deploy soft tokens over SMS based to users of smartphones, or are there other factors to consider?
I'm aware that I've really asked a few related questions, so just to recap, my questions are:
a) Is tokenless 2FA (particularly SMS based) a security compromise over traditional tokens?
b) Are physical tokens still popular just because they're tried and tested, with companies like RSA trading on the reputation they've established, or is there still an objective case for sticking with physical tokens?
c) Have people found that SMS based 2FA is impractical for regular users and found themselves deploying physical tokens to those users?
d) Are the solutions such as "day use" codes and multiple codes in a single SMS much of a security compromise compared to the default of single codes being sent and stored in an SMS?
e) For users of smartphones, is it a no-brainer to deploy soft tokens rather than rely on SMS based 2FA?
f) Can anyone direct me to some appropriate literature that I should be reading to really get a feel for some of the above issues?
The questions are quite closely related, so I've kept them all together. Please let me know if you feel I should be seperating the above out into separate StackExchange questions.