17

The HowToGeek article How To (Un)Lock Your PC By Being Nearby (With a Bluetooth Phone) got me thinking.

Is there any software (or combination of software) that allows three-factor authentication for a Windows box? I'm thinking of something that would work well with commonly-available laptop hardware. So, the likely factors involved could be:

  • Something you know
    • Windows password
  • Something you are
    • Fingerprint reader
    • Facial recognition
    • Voice recognition
  • Something you have
    • Bluetooth device
    • USB key

The above is just a list for the more general scope of this question. For me personally, the factors would probably be: Password, Fingerprint, Bluetooth. Is there software that allows for this? Most times, when I hear about software that enables alternate authentication methods, it's still single-factor—allowing you to use, for example, your phone or your fingerprint instead of a password. I know there's some software that enables a two-factor option also, but are there any solutions that allow you to require all three?

Improve this question
7
  • For which Windows versions?
    – this.josh
    Jul 7, 2011 at 21:49
  • 2
    @this.josh I'm going to leave the question open for any versions, but my particular case is for Windows 7 Ultimate.
    – Iszi
    Jul 7, 2011 at 22:29
  • 1
    What's your threat model? Three-factor seems like overkill to me for most purposes. I'm having a hard time imagining a threat model where three factors makes sense, though maybe it's just my lack of imagination. (To put it another way, if three factors is good, does that mean that four factors is even better? Hint: there's a flaw in that reasoning...)
    – D.W.
    Sep 18, 2012 at 5:26
  • 3
    Remember how it was recently discovered that the most common fingerprint scanner stored your login password in the registry? Yeah, sometimes more factors is not necessarily better.
    – tylerl
    Sep 21, 2012 at 8:24
  • 1
    @tylerl Using a fingerprint as an additional authentication factor is different from using it as an automatic password filler.
    – Iszi
    Sep 21, 2012 at 14:19

4 Answers 4

Reset to default
13

I'm assuming that you mean for logon (or unlocking).

I believe three factor is supported natively in Windows 7 with:

  • Windows Biometric Service (requires attched device)
  • PIV-compliant smart card (requires attached device)
  • Password (Kerberos V5 for AD, and NTLMv2 for local)

Windows Vista and Windows 7 have the same interactive logon architecture. They use a Credential Manager which interfaces to Credential Providers.

The Credential Manager can support four types of credentials:

  • "user name and password" (keyboard based something you know)
  • Certificate (something you have)
  • Smart Card with PIN (something you have + something you know)
  • Biometric (something you are)

Windows XP and Windows 2000 share a slightly different logon architecture. They use a Graphical Identification and Authentication (GINA) module. The module is responsible for collecting credentials and authenticaing the credentials. Microsoft provides a standard module: MSGINA.DLL. Microsoft provides three ways to modify the GINA module's behavior, and also allows replacement with a third party GINA. The three modification methods are: pre or post-processing, hooking, and registry settings. The Microsoft provided standard GINA supports Smart Card with PIN login. For biometric authentication, it seems common to have an administrator install a third party GINA module. It appears to me that this architecture would support three-factor authentication.

I also found evidence that Windows NT supports three factor authentication.

"Windows NT supports two and three factor authentication, including tokens, smart cards and biometrics." Stephen Cobb

Improve this answer
2
  • 1
    I think I forgot to include in the question: How do I actually implement it?
    – Iszi
    Jul 12, 2012 at 21:28
  • 2
    If you want to create your own Credential Providers, there are samples in the Windows SDK. Also see the example here The basic architecture is described here
    – David Marshall
    Sep 20, 2012 at 20:39
5
+200

I haven't set this up, but I think in theory you could make this work using what I will grant is not the most beautiful configuration ever.

As you can see here (as well as a zillion other places), you can set up bitlocker on a machine with or w/o a TPM. Most people configure BitLocker using TPM with TPM + pin. But you could also configure it using a USB stick that has the key. I believe this configuration allows you to put the bitlocker key on a USB thumb drive (satisfying something you have) and protecting it with a key (something you know). A bit more searching found this link which seems to include a step by step for doing just this (TPM + USB startup key + pin).

Once the machine boots, normal Windows logon kicks in, and you could do fingerprint logon to the OS (something you are).

That said, I'm not convinced the threat model will fully support this being the best path...it would take a bunch of thought. But it might. :)

Improve this answer
2
  • I'm not sure why there's a down-vote here. This appears to be the first answer that actually gives a viable example of how to implement 3FA, instead of simply stating whether or not it's possible.
    – Iszi
    Sep 24, 2012 at 16:53
  • Nor am I...but can't please all the people all the time. :) If you set this up I'm curious how well it works. I thought a bit more about it and I think it will...
    – Eric Fleischman
    Sep 24, 2012 at 16:57
1

On Linux, PAM provides the ability to configure your authentication policy. You can configure PAM to require two factors -- or, if you want, to require three factors. You can read the PAM documentation for more information about how to do this.

Disclaimer: I can't imagine three-factor authentication making sense for most deployments. I would question whether the security vs convenience tradeoff will make sense. You should think carefully about what will happen when user gets locked out. Odds are that the weakest link in your system will not be the authentication mechanism: it will be the protocol for handling users who were locked out, or it will be social engineering attacks on the authorized users of the system, or it will be the backdoors that users set up so they can get work done without being bothered by the annoying three-factor authentication (e.g., the blank password that the user sets to make it quicker to log in, or the USB dongle that the user leaves attached to the device), or some other weak spot.

Anyway, I think the need for three-factor authentication is going to be such a rare case that I don't think there's any point in providing a recipe you can cut-and-paste: I think any shop that really needs three-factor authentication can go read the PAM manuals and work out how to do it.

Improve this answer
2
  • 1
    @Iszi is asking about Windows. So your answer regarding Linux and PAM isn't exactly what he wants. ;)
    – user10211
    Sep 18, 2012 at 10:44
  • @TerryChia, oh, right you are! Sorry, I missed that.
    – D.W.
    Sep 18, 2012 at 20:58
0

Sensipass provides 3-factor authentication by facilitating personal interactions with biometric images, such as a facial scan. It works well on smartphones and laptops with cameras. They are building browser extensions as it is currently a IDaaS product, but no native Windows implementation yet from what I can see. Very innovative though!

Improve this answer

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .