A lecture slide mentioned methods of authentication, one of them being. Who the entity knows. But the lecturer said it was up to me to research it. I've Googled as hard as I can but to no avail :( I can't find an example or even a reference, the best I've come up with is something to do with background checks.

  • Do you have a link to the presentation? Could you post presentation title and or presenter's name?
    – this.josh
    Commented Aug 27, 2011 at 18:38
  • could you give more details about where you saw it ? Commented Aug 29, 2011 at 12:14

4 Answers 4


A Google search for authentication "who the entity knows" returns a few hits. Here's one PDF:


Fourth-Factor Authentication: Somebody You Know

ABSTRACT User authentication in computing systems traditionally depends on three factors: something you have (e.g., a hard-ware token), something you are (e.g., a fingerprint), and something you know (e.g., a password). In this paper, we explore a fourth factor, the social network of the user, that is, somebody you know.

Human authentication through mutual acquaintance is an age-old practice. In the arena of computer security, it plays roles in privilege delegation, peer-level certification, help-desk assistance, and reputation networks. As a direct means of logical authentication, though, the reliance of human being on another has little supporting scientific literature or practice.

In this paper, we explore the notion of vouching, that is, peer-level, human-intermediated authentication for access control. We explore its use in emergency authentication, when primary authenticators like passwords or hardware tokens become unavailable. We describe a practical, prototype vouching system based on SecurID, a popular hardware authentication token. We address traditional, cryptographic security requirements, but also consider questions of social engineering and user behavior.

  • I loathe PDF; especially pasting text from PDF to anywhere. Anyone know any useful way of doing that without weird line breaks?
    – DanBeale
    Commented Aug 27, 2011 at 17:54
  • 1
    You might try ctrl+shift+v when you paste - it pastes without formatting. Commented Aug 28, 2011 at 2:32

See "It's Not What You Know, But Who You Know" (by Stuart Schecter, Serge Egelman, and Robert W. Reeder, published at CHI 2009) for one research paper on the subject. They propose that each user may select "trustees" who they trust. If the user forgets their password, the trustees can help them recover access to their account.


I bet that what they are trying to refer to is a web of trust system. That is usually referred to in the context of trusting public encryption keys. A quick Google search also shows a tool for vetting websites that works in a similar theory.

In these networks, trust is derived from apparent consensus from the community or by a chain that leads back to individuals that you trust. If people are verified by others you are connected to, or by a large enough portion of the community, you get a sense of trust even without knowing that person. That may be because your good friend Alice says that Bob (or Bob's key) is good.

See http://en.wikipedia.org/wiki/Web_of_trust

  • Keep your friends close, but your enemies closer. Commented Aug 27, 2011 at 12:32

That's an interesting one. Normaly authentication is performed by either: a) Something you know (password) b) Something you have (token) c) Something you are (biometrics)

Perhaps your lecturer was talking about reputation-based systems, like ebay and p2p networks? Not a direct authentication mechanism, but it has similar properties.

  • 1
    Or maybe web of trust?
    – Nam Nguyen
    Commented Aug 27, 2011 at 11:58
  • same thing imho :-)
    – chris
    Commented Aug 27, 2011 at 17:52

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .