Multi-factor authentication
 | It has been suggested that this article be merged with Two-factor authentication. (Discuss) Proposed since July 2015. |
Multi-factor authentication (MFA) is an obsolete[1] method of computer access control in which a user is only granted access after successfully presenting several separate pieces of evidence to an authentication mechanism - typically at least two of the following categories: knowledge (something they know); possession (something they have), and inherence (something they are).[2]
Authentication Factors
Knowledge factors
Knowledge factors are the most commonly used form of authentication. In this form, the user is required to prove knowledge of a secret in order to authenticate.
A password is a secret word or string of characters that is used for user authentication. This is the most commonly used mechanism of authentication. Many multi-factor authentication techniques rely on password as one factor of authentication.[3] Variations include both longer ones formed from multiple words (a passphrase) and the shorter, purely numeric, personal identification number (PIN) commonly used for ATM access. Traditionally, passwords are expected to be memorized
Many secret questions such as "Where were you born?", are poor examples of a knowledge factor because they may be known to a wide group of people, or be able to be researched.
Possession factors
Possession factors ("something only the user has") have been used for authentication for centuries, in the form of a key to a lock. The basic principle is that the key embodies a secret which is shared between the lock and the key, and the same principle underlies possession factor authentication in computer systems.
Several methods are used as possession factors:
Disconnected tokens
Disconnected tokens have no connections to the client computer. They typically use a built-in screen to display the generated authentication data, which is manually typed in by the user.[4]
Connected tokens
Connected tokens are devices that are physically connected to the computer to be used, and transmit data automatically.[5] There are a number of different types, including card readers, wireless tags and USB tokens.[5]
Inherence factors
These are factors associated with the user, and are usually biometric methods, including fingerprint readers, retina scanners or voice recognition.[6]
Legislation
United States
Regulation
Details for authentication in the USA are defined with the Homeland Security Presidential Directive 12 (HSPD-12).[7]
Existing authentication methodologies involve the explained three types of basic "factors". Authentication methods that depend on more than one factor are more difficult to compromise than single-factor methods.[citation needed] [8]
IT regulatory standards for access to Federal Government systems require the use of multi-factor authentication to access sensitive IT resources, for example when logging on to network devices to perform administrative tasks[9] and when accessing any computer using a privileged login.[10]
Guidance
NIST Special Publication 800-63-2 discusses various forms of two-factor authentication and provides guidance on using them in business processes requiring different levels of assurance.[11]
In 2005, the United States' Federal Financial Institutions Examination Council issued guidance for financial institutions recommending financial institutions conduct risk-based assessments, evaluate customer awareness programs, and develop security measures to reliably authenticate customers remotely accessing online financial services, officially recommending the use of authentication methods that depend on more than one factor (specifically, what a user knows, has, and is) to determine the user's identity.[12] In response to the publication, numerous authentication vendors began improperly promoting challenge-questions, secret images, and other knowledge-based methods as "multi-factor" authentication. Due to the resulting confusion and widespread adoption of such methods, on August 15, 2006, the FFIEC published supplemental guidelines—which states that by definition, a "true" multi-factor authentication system must use distinct instances of the three factors of authentication it had defined, and not just use multiple instances of a single factor.[13]
Security
According to proponents, multi-factor authentication could drastically reduce the incidence of online identity theft, and other online fraud, because the victim's password would no longer be enough to give a thief permanent access to their information. However, many multi-factor authentication approaches remain vulnerable to phishing,[14] man-in-the-browser, and man-in-the-middle attacks.[15]
Implementation considerations
Many multi-factor authentication products require users to deploy client software to make multi-factor authentication systems work. Some vendors have created separate installation packages for network login, Web access credentials and VPN connection credentials. For such products, there may be four or five different software packages to push down to the client PC in order to make use of the token or smart card. This translates to four or five packages on which version control has to be performed, and four or five packages to check for conflicts with business applications. If access can be operated using web pages, it is possible to limit the overheads outlined above to a single application. With other multi-factor authentication solutions, such as "virtual" tokens and some hardware token products, no software must be installed by end users.
There are drawbacks to multi-factor authentication that are keeping many approaches from becoming widespread. Some consumers have difficulty keeping track of a hardware token or USB plug. Many consumers do not have the technical skills needed to install a client-side software certificate by themselves. Generally, multi-factor solutions require additional investment for implementation and costs for maintenance. Most hardware token-based systems are proprietary and some vendors charge an annual fee per user. Deployment of hardware tokens is logistically challenging. Hardware tokens may get damaged or lost and issuance of tokens in large industries such as banking or even within large enterprises needs to be managed. In addition to deployment costs, multi-factor authentication often carries significant additional support costs. A 2008 survey of over 120 U.S. credit unions by the Credit Union Journal reported on the support costs associated with two-factor authentication. In their report, software certificates and software toolbar approaches were reported to have the highest support costs.
Examples
Several popular web services employ multi-factor authentication, usually as an optional feature that is deactivated by default.[16]
- Two-factor authentication
- Many Internet services (among them: Google, Amazon AWS) use open Time-based One-time Password Algorithm (TOTP) to support multi-factor or two-factor authentication
See also
References
- ^ Schneier, Bruce (15 March 2005)."The Failure of Two-Factor Authentication". schneier.com.
- ^ "Two-factor authentication: What you need to know (FAQ) - CNET". CNET. Retrieved 2015-10-31.
- ^ "Securenvoy - what is 2 factor authentication?". Retrieved April 3, 2015.
- ^ de Borde, Duncan. "Two-factor authentication" (PDF). Archived from the original (PDF) on January 12, 2012.
- ^ a b van Tilborg, Henk C.A.; Jajodia, Sushil, eds. (2011). Encyclopedia of Cryptography and Security, Volume 1. Springer Science & Business Media. p. 1305. ISBN 9781441959058.
- ^ Biometrics for Identification and Authentication - Advice on Product Selection
- ^ US Security Directive as issued on August 12, 2007 Template:Wayback
- ^ "Frequently Asked Questions on FFIEC Guidance on Authentication in an Internet Banking Environment", August 15, 2006 [dead link]
- ^ "SANS Institute, Critical Control 10: Secure Configurations for Network Devices such as Firewalls, Routers, and Switches".
- ^ "SANS Institute, Critical Control 12: Controlled Use of Administrative Privileges".
- ^ "Electronic Authentication Guide" (PDF). Special Publication 800-63-2. NIST. 2013. Retrieved 2014-11-06.
- ^ "FFIEC Press Release". 2005-10-12. Retrieved 2011-05-13.
- ^ FFIEC (2006-08-15). "Frequently Asked Questions on FFIEC Guidance on Authentication in an Internet Banking Environment" (PDF). Retrieved 2012-01-14.
- ^ Citibank Phish Spoofs 2-Factor Authentication (Brian Krebs, July 10, 2006)
- ^ The Failure of Two-Factor Authentication (Bruce Schneier, March 2005)
- ^ GORDON, WHITSON (3 September 2012). "Two-Factor Authentication: The Big List Of Everywhere You Should Enable It Right Now". LifeHacker. Australia. Retrieved 1 November 2012.
External links
- Attackers breached the servers of RSA and stole information that could be used to compromise the security of two-factor authentication tokens used by 40 million employees (register.com, 18 Mar 2011)
- Banks to Use Two-factor Authentication by End of 2006, (slashdot.org, 20 Oct 2005)
- List of commonly used websites and whether or not they support Two-Factor Authentication
- Microsoft to abandon passwords, Microsoft preparing to dump passwords in favour of two-factor authentication in forthcoming versions of Windows (vnunet.com, 14 Mar 2005)