1

When I log onto my bank's website on a new device (be it a new phone or a web browser I haven't used before) it prompts me to send an activation code to my phone or email. I have to enter in this one-time code before it will let me log in.

The next time I log in I don't have to do this, unless something happened like I cleared out all my cookies or something. I may even have multi-factor authentication turned on to where I need to do something else like enter in another phrase or a code from a dongle or something but I don't have to do the verification code through a text message or other means unless something changes to my browser/device situation.

What is the term for this? Most of the ____factor Authentication terms are referring to needing to do something every time, I'm just wondering if there's a term for when you only need to do it on new devices.

4

This falls under the area of Adaptive Authentication, although that term covers the whole package - deciding who you are based on multiple factors, and getting more reassurance using multiple resources, including pushing out cookies to act as a factor in future authentications.

A couple of well known examples are:

Determining if you're coming from a device that the server knows about is a "device cookie" in ForgeRock or "device identification" in RSA. But, really, they have multiple factors that they assign weights to when deciding to trust you:

  • Have there been failed authentications for this account?
  • Is the client IP address on a whitelist?
  • Is the client IP address in a good geolocation?
  • Has the account logged in from this IP previously?
  • Is the device recognized from past logins (e.g., device cookie?)
  • How long has it been since this account last logged in?

Coming from a recognized device is weighted heavily, so if that device cookie is missing you often have to do the work to get it. But it's quite possible to write a policy where that isn't the case, given the variety of checks you can use in determining trust.

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.