2

Are the authentication strength of the different authentication factor categories (knowledge-factors, posession-factors and inherence-factors) ranked in any way, like "inheritance-factors are stronger than posession-factors"?

I would assume that inheritance-factors are the strongest, but they also can not be changed and if they get leaked that's quite bad. I would assume posession factors to be the weakest as anyone can steal them, but at least you know when they are no longer in your posession.

Is there any kind of ranking between the strength of the authentication categories themselves or are they just three different things, each good in their own way?

If they are not ranked, is it fair to evaluate authentication strength based on how many factors were authenticated or are details essential to this kind of question?

2

If they are not ranked, is it fair to evaluate authentication strength based on how many factors were authenticated or are details essential to this kind of question?

They're not ranked, generally.

Also, it's not "fair" to evaluate simply on how many factors are used. The details matter.

Consider a hypothetical example of a two-factor authentication system that uses a face-recognition (but the face-recognition has a 50% false positive rate) along with a password (but the password is restricted to 4 or fewer digits).

The above hypothetical two-factor system is pretty dumb, but illustrates that evaluating purely on the number of factors is incomplete. The details matter.

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.