2

Is username counted as one-factor, something you know?

A smart card (which contains the username and user information inside the card) is something you have.

What if the smart card doesn't contain the user information but the username is checked on the server before the smart card is used?

Improve this question
1
  • Make it about physical objects - say, name and driver's licence - and ask yourself whether these count as separate pieces of information. It will be the same for digital things.
    – Mike Ounsworth
    Aug 25, 2018 at 15:11

3 Answers 3

Reset to default
5

If the username is secret and not reasonably ex tractable from card, I would say yes.

If the username is not secret, or at least easily guessable because it is strongly based on something not secret like your name it should not be considered a "factor" for authentication.

If the username is easily retrievable from the card we do not have independent factors which is what we really need when discussing Multi-Factor-Authentication.

Improve this answer
5
  • if the is no independent factors, mean there is no two-factor authentication? even if you have "something you know, something you have, and something you are." rule
    – Wei Wen
    Aug 22, 2018 at 7:26
  • 1
    If something I know and something I have are the same information, they are not independent. If I have a smart card and a password but my password is on a sticker on the smart card (true story) then loosing the smart card is also loosing the password. The factors are not independent which is what we need.
    – Meir Maor
    Aug 22, 2018 at 8:12
  • mean independent from each other is part of two-factor authentication? Is there any other requirement to be two-factor authentication. Because i creating a two-factor authentication protocol. Which part I need to be careful about.
    – Wei Wen
    Aug 22, 2018 at 8:20
  • I don't see how being independent is required for two factor authentication. My PIN is absolutely tied to my debit and credit cards, but that doesn't mean that it doesn't count as two factor authentication.
    – Maarten Bodewes
    Aug 23, 2018 at 4:54
  • Your pin is not easily extracted from your card, hence the loss of one does not imply the loss of the other, this is independence IMHO.
    – Meir Maor
    Aug 23, 2018 at 5:07
2

Is username counted as one-factor, something you know?

A username is not a factor of authentication, a username is used for identification. To prove what you claim to be, you authenticate your "identity" against a system by providing something that you and only you know, something secret.

What if the smart card doesn't contain the user information but the username is checked on the server before the smart card is used?

This is a standard authentication workflow, some systems check first the username and then prompt user for password or ask him to use other mean like smart-card.

Improve this answer
1

The three factors for authentication are, again:

  • something you have
  • something you know
  • something you are

You can of course not use any of these for authentication without additional constraints. To use any of these for authentication it is important that an adversary cannot replicate the authentication factor.

Generally names can be easily guessed, which means that a user name is not suitable to use as a factor for authentication.

Similarly, having a smart card is of little use if an adversary can simply extract any secret information that is stored on the card.

Biometrics are not very useful if the authentication can be fooled by accepting a picture or gummi fingerprint.

Improve this answer

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .