How to implement 2FA without user phone

Question

I have a problem: users share their credentials with other users. I have to create a way to ensure that users are using their own credentials to access the system. I think creating a 2 factor authentication, but I can not use the user's phone. Does anyone know a way to do this through software and not hardware (like biometric device)?

There is a detail that discards solutions about educating users. Some users have reported that their credentials have been stolen and used by former officials, and unfortunately we had a real case with this situation.

Answer 1

2-factor logins consist of 2 of three things: something you either have, are, or know. Passwords are something known, so you'd have to implement something you are or have. Biometrics, ie "measuring people"; iris scanners, fingerprint scanners, voiceprints, hand scanners, and facial recognition are examples of biometrics that either require specialized equipment, or can easily be fooled by someone with access to a dollar store. So unless you have a human supervising them, biometrics are out.

So that leaves something you have.

A simple and annoying way to do this is to restrict user logins to their computer. Sure, you know Bob's password, but you don't have his computer. So login fails. That's about the cheapest way t o do it. Otherwise you can issue hardware tokens. Then you'd enter your password and the code from the hardware token or have the hardware token inserted into the USB port.

The challenge to doing this via software is having it be something you have or are. Software by definition is generally neither of them.

PS you already know this, but you have a huge problem with people sharing passwords. Effectively you have no audit trail or way to specifically hold someone accountable for what was done under their login. I assume you already knew that...

Answer 2

_{I'm turning my previous comments into a proper answer}

The solution to stopping account sharing within your company is to

Educate the user & Make registration convenient

No gimmick in the world will prevent your users from account sharing if they are not informed about it. No matter how strong the 2FA is coupled to the person. Requiring a DNA sample upon login just prompts people to keep a jar of spit besides their desk.

Educate their users and tell them why loss of audit trail is bad for them (and their coworkers).

If your registration is cumbersome then make it easier. For example instead of them sending you (the admin) an email maybe make a simple web form where they can register with their employee ID.
Lowering entry bounds is always good when it comes to stopping account sharing.

---

_{This answer has become obsolete after the question was edited}