Two-factor authentication Without Mobile Phone

Question

Two-factor authentication is based on the notion of “something you know” and “something you have”. Is it absolutely necessary for having your mobile phone involved in two-factor authentication, which is used by all the big companies, like Google etc.?

Instead of relying on a third-party device, why can't the existing alphanumeric text password be modified so as to provide increased security. What if a single factor authentication would provide the security as a two factor would do.

I have developed such system, which basically combines a simple image-based challenge and normal text password in one step.

Update from comments:

The system locks the account if the text password is correct but the image number is wrong for 3 attempts. The account remains locked until original user unlocks it. In real-time, I will add a link where the original user can unlock the account by using a secondary email or mobile.

The image number is a 2-digit number. On an average if the normal password length is 8 digits, then the total length would become 10 digits, making highly time consuming for brute force attack. Also I'm using a grid of 4x7, total 28 images, so user wont have any problem in finding his image

The images are NOT same for different users, they are randomly selected by the system from large database of images while creation of account and the system requires the normal password to be at least 8 characters.

Would this idea be acceptable in real-time situations?

Answer 1

First off, the solution you describe in your blog post is not two factor authentication. You have two 'something you know' factors: your password and your special image.

(edited with updates to answer the extended question, 'can single factor authentication provide the security of multifactor authentication.'

Second, there appears to be some confusion about what authentication factors are. Authentication factors are 'something you know,' 'something you have', and 'something you are'. Something you know is something that you store in your brain. Passwords are the most common example, but it includes anything and everything that relies on your memory to know. You use your brain to remember your password. You use your brain to remember what image you selected.

Something you are refers to stuff about you that is inherent to you being you. Biometrics Are the most common example here. Your retina shape, your finger print, etc.

Something you have is a physical object in your possession. Examples include mobile phones, hardware tokens, certificates, printed challenge response 'bingo' cards, your car, etc.

You only get multi-factor authentication when you combine something you know, something you have, and something you are. You do not get multifactor authentication when you combine multiple elements of the same factor. A password and securid token combined make for multifactor authentication, because you know one and have the other. Two passwords combined makes single factor authentication because you know both. A password and pre-selected image combined is single factor authentication because you know both.

Third, no, single factor authentication does not provide the same security as multifactor authentication, no matter how hard you try. Different factor, by their very nature, provide different assurances.

Something you know is easy to remember - it must be in order to scale across many users. This makes it easy to provision. You don't have to physically distribute anything like a hardware fob, just ask people to remember a password. It's easy to forget a password and require reprovisioning. It's also somewhat hard to steal, since you can't dig into someone's brain and just take their memory, but theft does not require proximity (monitoring network traffic is enough to steal a password), key loggers work against it, and it's hard to detect that it's stolen. It's also easy to replace - just set a new password and be done.

Something you have is something you carry with you. This makes it harder to provision, since you now have to physically distribute a piece of hardware to everyone (or the equivalent with certificates), though this may be possible with mail or trusted courier. It typically requires expensive infrastructure, though cell phones carried by everyone mitigates that cost. It's easy to forget your hardware device at home, or at the main office during travel, etc, which requires backup infrastructure for temporary provisioning. Something you have is easier to physically steal, though now it requires physical proximity to take your hardware device out of your pocket. It's easy to detect that tit's stolen, since it is no longer in your possession. It's hard to replace, since you must re-provision with that expensive process.

Something you are is hard to provision - you need special, often expensive equipment to collect biometrics from your users. Your users may find that creepy, and might resist collection. You need physical proximity to collect samples. It's impossible to forget to bring biometrics with you - they are you! Depending upon the biometric, it can be difficult or easy to steal, but it's never secret. Your dna is left everywhere, fingerprints are left everywhere, retina is temporarily anywhere you look. Something you are is impossible to replace. You have two eyes, 5fingers (unless you have a birth defect or lost one or more fingers in an injury) and can never get new ones, so if they are compromised you cannot be reprovisioned new credentials. Nor can you get new credentials of the same type if you lose them all - if you lose both hands, you have no more finger prints.

You get strength by combining multiple factors, because this offsets the weaknesses of one factor. With only something(s) you know, you only get the strengths of what you know. Add some hardware that you have, and now theft becomes obvious at the expense of cost and usability.

Fourth, Yes, you can use things other than your mobile phone for multi-factor authentication. Phones are just used a lot because they are with everyone and don't require carrying a separate physical object, like a watch, hardware token, cardboard challenge card, etc.

Fifth, your solution sounds very much like passkey (based on your blog; I was not willing to provide my email to sign up for your service). I believe I've heard of this solution in another product as well. Are you sure you haven't recreated someone else's work? Are you sure your solution is devoid of patent challenges?

Sixth, your solution may well have many issues. Just off the top of my head, in about 10 minutes, here's a starting list...

1. If you do not always show the same set of images, the attacker can simply try to authenticate many times and watch what images don't change. One of them must be the right one.
2. If you do always show the same set of images, the attacker can try them one at a time
3. If you show too many images, it will reduce usability. If you don't show enough images, the picture effectively adds no security.
4. If the real image is located in the same location for every user, or in s predictable location for each authentication (like using rand() to choose the location), the attacker won't even need to know the image, they will just need to predict the next location and enter the location id.
5. The images are 'public' in that they are always shown pre-authentication, after being shown an email address. If a user uses the same image at multiple sites, so s/he can remember it, and those sits show different images on the challenge page, this helps the attacker - only the images common to both sites are likely to be the correct one.
6. A naïve solution following your description allows the attacker to enumerate all valid accounts by presenting the challenge if the email is entered. What happens if the account doesn't exist? Are random images shown every time? Just like number 1 of this list, if all images rotate off the selection list at some point, the attacker will know that the account doesn't exist. You need to do the math to demonstrate that the performance is low enough compared to the size of the userbase that a system-wide brute force attack will not be successful in a reasonable amount of time, or you need to not leak logins. Since your solution doesn't exist on s system yet, and is meant as s general purposes solution, you cannot predict the performance of the target server which makes your solution very difficult to prove username enumeration happens to be safe.
7. Because you are using images, you cannot prevent shoulder surfing on the set of images. This needs to be evaluated for impact to your solution.
8. Are you preventing shoulder surfing against the selected image entry field?
9. If you lock out accounts due to bad authentications, you present a denial of service attack against the system. You also only slow down an attack, not prevent it. Once you unlock the account, the attack can begin again.
10. I saw no mathematical proof of the strength of your visual-password solution. Without such proof (which is not hard to do, given the attack optimizations herein) your solution is be default not trustworthy.
11. What prevents the user from selecting a password that represents the image? For example, the password "trees" for an image of trees? Not addressing this will make for a new and interesting optimization for the attacker.

Answer 2

This does nothing for security and actually reduces the security. You are violating one of the basic security principals by giving away the existence of an account by displaying information after only an e-mail. I suppose you could get around this by displaying something for every e-mail attempted, but you now have to store a list of 24 images for every attempted e-mail address ever and if that e-mail is used later, now it would change the images displayed unless you limit them to those 24 images that you chose at random. Otherwise, an attacker could detect if a previously tried e-mail address had been created by comparing previous images to current images.

Further, this is only adding a character to the password. It is still something you know. Two factors of something you know is no more secure than knowing one longer thing. For example if my password was "bob" with your system adding 2 numbers, it would still be less secure than if my password was "a3fj%as".

Two factor authentication MUST be two different factors out of "what you know", "what you have" and "who you are" since the idea is that those things are categorically different and hard to compromise two at the same time. You never enter "what you have" in to a computer to be captured (just proof you have it), you are "who you are" so it is hard to copy, particularly if the input is validated as being authentic, and what you know is only in your head other than when you are entering it.

All 3 can be attacked, but they require different attacks. Simply monitoring the input on the form would be sufficient to capture the index of the image as well as the password and your system then falls apart.

Answer 3

Two-factor authentication using third party is always going to be higher level of security since they hacker would have to compromise both factors of security.

Your security implementation:

• Username
• Password
• Image password

All these are static values. So, if they are sniffed via network or logged via HTTP form keylogger then your security is compromised. As the hacker would know the correct image.

Two-factor with mobile:

The text to your phone will be dynamically generated and if a hacker get your username and password they would need to get the dynamically generated password every authentication.

So, if you get a SMS of "1234" then hacker tries to login as that code it would be expired by then.

So, only thing left is session hi-jacking would you could add IP filter onto session and user agent etc.

Ofcourse, be careful with IP filtering as mobile phones change IP so much in sessions.