5

Currently, some services use a second layer of veficiation if logging in from a new device:

  • Gmail and Facebook send a text or call with a code
  • Facebook generates a code in the mobile application

The problem is:

Countless times, I've been abroad with a cell phone whose battery had died, and needed to access my Gmail or Facebook account.

The alternative is to carry printed versions of access codes in your wallet, but this is not optimal, especially if more web services will eventually roll this out.

What other alternatives for the second layer of authentication exist that don't rely on having a mobile phone present, but would be suitable for logging on from, let's say, and old PC somewhere?

In other words, what else could Google and the others be doing?

(Please note that this question concerns two-factor authentication, and not two-step authentication as for the latter, a system could simply ask for two passwords.)

Improve this question
3
  • You say carrying printed access codes is "not optimal" but you don't specify why. It's not like they take up a lot of room in your wallet.
    – mricon
    Sep 5, 2014 at 14:19
  • The present day two factor Authentication Technology is inherently flawed.The problem is the [two factor]authentication technology in it's current form does NOT offer a compact and unbreakable solution for entire life-cycle of your "cybernetic identity" – identity creation, validation/verification, deletion, lost, expiration and much more including ID provisioning.That's why the US is coming up with the NSTIC (National Strategy for Trusted Identities in Cyberspace) nist.gov/nstic/guiding-principles.html and the European Union is coming up with the SSEDIC eid-ssedic.eu
    – user52380
    Sep 5, 2014 at 15:54
  • @mricon, yes they can, especially if all services start doing it
    – Baumr
    Sep 10, 2014 at 12:04

3 Answers 3

Reset to default
3

Several initiatives are ongoing to address this issue. Google has been working with the YubiKey folks to create a tiny dedicated USB dongle device to act as a second factor. You can see details here Forbes story here. You can also use YubiKey today to kludge up a solution if you are so inclined.

Improve this answer
4
  • Interesting, but that still requires you to have to carry something around... what if you've just been robbed of everything you have, and need to access your Gmail to print off another boarding pass for a flight that is taking off soon? (Luckily, that hasn't happened to me.)
    – Baumr
    Sep 5, 2014 at 12:47
  • 2
    As you know factors are based on something you know, something you have, something you are, etc. So you probably need to look into a biometrics but even then you would need a device to read it. Good question lots of folks are noodling. I have considered geolocation a nice potential factor that might work if you are a good planner.
    – zedman9991
    Sep 5, 2014 at 12:52
  • I liked Facebook's old approach of asking who people are in tagged photos, unless the attacker is a close friend, they'd be hard pressed to get past that IMO
    – Baumr
    Sep 5, 2014 at 13:00
  • 2
    Nice idea but doesn't pass the strict test for another factor as that and the UID/password are both something you know. Seems illogical at first but if you consider that both could be intercept by a man in the middle or coerced you can see how a strictly different factor provides even more protection.
    – zedman9991
    Sep 5, 2014 at 13:11
1

You can use a cloud-based password manager and a USB dongle.

This would be the safest and most convenient solution especially if your phone is unavailable. USB dongle can be strengthened with a code. The token serves as a "something you have" factor and the code is "something you know" just like with your credit card. The database of your login credentials is in the cloud so you can access it from any computer, so you will be able to access any of your accounts anywhere, not just Google.

For example this is the way WWPass Passkey and BlackBook password manager work together. As a bonus, you also can encrypt you emails with the same PassKey, access VPNs and a do number of other things (more here). Ok, you have to carry a device with you, but it has no battery and much safer technically than a phone.

As with any "dongle" solution it may be difficult to work with a really old computer though.

Improve this answer
1

In other words, what else could Google and the others be doing?

FIDO2 web Authentication is what Google or Facebook could do.

It is a web API that is included in browsers and related web platform or apps. A lot of this being developed currently so not sure when social media apps will include this.

With web authentication, you will be able to use Windows Hello or Fingerprint scanner from your Mac for second-factor authentication. You don’t need a mobile phone or USB dongle for that.

Improve this answer

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .