Question

I’ve been given the task of finding and evaluating some authentication libraries for use in one of our products and one of the selling features being pushed by some solutions is ‘two-factor authentication’.

What is this method and how does it work? Are there better methods (such as three-factor authentication, I guess)?

Answer 1

Two factor authentication is using two factors to authenticate a person (or sometimes a process).

This might be a PIN number (something you know) and a debit card (something you have).

There are many authentication factors that might be used:

Authentication factors apply for a special procedure of authenticating a person as an individual with definitively granted access rights. There are different factor types for authentication:

• Human factors are inherently bound to the individual, for example biometrics (‘Something you are’).
• Personal factors are otherwise mentally or physically allocated to the individual as for example learned code numbers. (‘Something you know’)
• Technical factors are bound to physical means as for example a pass, an ID card or a token. (‘Something you have’)

From wikipedia.

Which factors you choose depend on the type of access required, security needed, cost, and especially what people are willing to put up with.

People get irritated with strong passwords that change every 4 months, so you might find employees happier with laptops that have fingerprint scanners and they can use a weak password and a fingerprint – two factor authentication may be easier for users.

But others might not like the privacy implications of biometric security and would rather carry around a keychain device that produces numbers which are typed in along with a password.

High security situations may require all three factors – something you have such as a card, something you are such as retinal imaging, and something you know such as a password.

But the costs and irritation go up as you add more levels.

-Adam