I am evaluating an internal 2 factor authentication implementation in an organization. The system designer wants to remove regular user names and passwords from all user workstations such that each user will have his badge as a login token and will have to enter a 6 digit key to login into his workstation. Is this a normal practice? and does it make the scenario more secure or less secure? as a security reviewer, I find this as reducing the security of the workstation because the 6 digit pins are easy to capture by over the shoulder attacks and stealing a badge is not that difficult. Regular user names and strong passwords are harder to capture by similar attack. Remember that we are talking about an internal network with many other technical controls. My argument is that using just a card and a pin is more vulnerable to internal physical attacks.

2 Answers 2


In practice 2-factor auth means 2 of the following

  • Something you are
  • Something you know
  • Something you have

In this case he is replacing username and password which are both in the "Something you know" category for a token code and a badge which both fall under the "Something you have". So there is negligible augmentation in the way authentication is happening on that computer.

Hope this helps.

  • But does that affect the security posture as described in my scenario?
    – AdnanG
    Jun 9, 2015 at 6:49
  • Like I said, the change in security from your current process is negligible. You aren't more or less secure. This is not 2 factor-auth. This is single factor-auth. Make sure you take that into account when you give your recommendation.
    – Phobos
    Jun 9, 2015 at 15:51
  • 1
    it is intact two factor authentication as you are using something you have and something you know.
    – AdnanG
    Jun 9, 2015 at 15:59
  • In addition to @AdnanG's comment, "username" is not considered a factor of authentication in the "something you know" category as it is not private. It is "something everybody knows". Jun 10, 2015 at 9:48

Your scenario have many "if" points. Oversoulder see and memorize the pin, get badge, etc.
In general smartcard+pin is counted as addon to the username/password but in particular situations it provide enough security as it is actually (in some degree) 2-factor authentication (something you have and something you know)
Moreover the certificate in smartcard can be revocated so if card is stolen knowledge of the pin will not help

  • 1
    True, the "if" statements are to show how threats are materialized.
    – AdnanG
    Jun 9, 2015 at 11:08

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .