0

When two-factor authentication is described to me, people always say that it's important for security to demonstrate at least two of 1) something you know, 2) something you have, and 3) something you are. It seems to me that the specific computer I'm using to log into an application should qualify as "something I have," but I've never seen anybody propose that as a second factor, even though people are happy to use a "leave-it-plugged-in" Yubikey as a second factor. Why isn't this more common?

This is NOT a duplicate of the linked questions because I am asking specifically about the use of a computer as a second factor, and the linked questions are about the use of phones or keys as a second factor. Since phones and keys are regularly used as second factors, and I'm asking why computers are never used as second factors, the questions are completely different.

3

2 Answers 2

3

This does exist to some extent - for example one of the conditions that you can use in Azure Conditional Access Policies is that the user is connected from a trusted (i.e, Azure AD joined) device.

But the main issue is that while it's easy to say "the computer is the second factor", what does that actually mean when the user is trying to authenticate over (for instance), HTTPS? You can't just use the IP or MAC address and there aren't usually reliable ways to expose things like the device serial numbers (which could be spoofed anyway). Cookies or other tokens stored on the system can be exported or stolen, so can't be used. And if you require a TPM and store information in that, then you're potentially blocking access to any user who doesn't have one (as well as needing a way to expose that through to the server you're authenticating on).

And there's also the question of what you mean by "computer". Do you mean that physical hardware (which bits?), or the specific installation of the operating system?

The closest that you normally get this is certificate-based authentication, when certificates are automatically issued to the devices (such as through ADCS). It's not technically the computer that's being trusted there - but unless an attacker is able to steal or export the certificate is has a similar outcome.

2
  • Honestly, I'm not sure how any hardware-based authentication works except by certificates, but why can't whatever software runs on a Yubikey or on my smartphone just be run directly on the computer? Apr 3 at 13:15
  • @A.R. you could create a fully software based implementation - but a big part of the benefit of something like a Yubikey is that it's really hard to get the private keys off it. If those keys are just stored on your computer they're much easier to steal. But there are also practical considerations - it's often not convenient for users to only be able to access their accounts from a single machine, and to lose access if the system fails.
    – Gh0stFish
    Apr 3 at 16:23
0
  1. something you know, 2) something you have, and 3) something you are

Almost that. You forgot only.

The system authenticating you isn't smart. Basically it will look on a table and say "If someone appears here saying he is George Washington and its password is this one, grant access." And any attacker that guesses, steals or captures that password is George Washington.

An authenticator factor is useless if isn't something only you know, only you have or only you are. That's why security people insist on password managers: they generate passwords that only you know. Even if 123456 is a valid password on lots of places, isn't an usable password because half the world knows it. And even if "having 5 fingers" is a biometric factor, isn't useful because isn't unique.

You computer is not something only you have, unless you carry the computer around and show it to the person trying to authenticate you. As some software have to export some identifying information from it and show to the authentication system, an attacker can extract the same information and use on his computer.

And what about hardware keys? Well, they are different from your computer. Your computer is a general usage computer, not a dedicated device where its only mission is to safeguard a secret value with its life. Some HSMs (hardware security module) have features that will permanently brick itself and erase everything stored if tampering is detected.

Capturing data from inside the hardware key is almost impossible, capturing identifying bits from your computer is almost trivial. That's why a hardware key is considered an authentication factor but your computer isn't.

9
  • I'm confused. You say that my "computer is not something only [I] have," but I'm pretty sure nobody else has my computer. Apr 4 at 13:01
  • 1
    What you call "my computer" is just a series of identifying bits that an attacker can copy and use. MAC address, HDD serial number, hidden files... they may look unique to your computer but an attacker can copy those values and use in your place, just like your password.
    – ThoriumBR
    Apr 4 at 13:29
  • But what I'm not getting is how that's different from "my phone." Phone apps like Authy and Microsoft Authenticator are a very common (and seemingly well-regarded) second factor, but surely they're also just a series of identifying bits from the software side, yes? Apr 4 at 13:34
  • It depends on the implementation. Authenticator apps often use algorithms like time-based one-time passwords (TOTP) or HMAC-based one-time passwords (HOTP). Those rely on a shared secret stored on a device. While this device is usually a smartphone, nothing prevents you from using a PC instead. For receiving SMS tokens, you need a cellular module (which may very well be integrated into a PC) and a SIM card. So the factor isn't “the phone”, even if that may be a common thing to say. It's a shared secret and/or a SIM card.
    – Ja1024
    Apr 4 at 14:10
  • It seems a lot of the confusion boils down to terminology issues. Instead of talking about “the phone” or “the PC” as factors, you should distinguish between software tokens (information which is stored on a device but can be copied anywhere else) and hardware tokens (which are tamper-resistant and -- to some extend -- prevent you from copying the stored information). People aren't really using “their phone” for authentication. They either authenticate with a software token (like a HOTP shared secret) which just happens to be on their phone. Or they use the SIM card as a hardware token.
    – Ja1024
    Apr 4 at 14:37

Not the answer you're looking for? Browse other questions tagged .