4 ms·

I remember hearing the idea years ago that reasonable security needs these 3 somethings: 1. you know - password 2. you have - device/usb/etc 3. you are - bio-me

I remember hearing the idea years ago that reasonable security needs these 3 somethings: 1. you know - password 2. you have - device/usb/etc 3. you are - bio-metrics Is this still a thing? It sounds decent to me. Most auth usually uses 1 or 2 from the list but rarely all 3.

cogman10 7y ago
bio-metrics is really just not a good security measure, it is an extension of number 2 (You have fingerprints, your face, etc). You'd be in just about the same place if instead of saying "you need biometrics" you said "You need 2 devices". Even number 2 can be done wrong. 2 Doesn't work if the thing you have is a knowledge based thing. 2 only works if in the case that it responds correctly to a stimulus. Think things like RSA.
- dwaite 7y ago
  Biometrics are not an extension of #2. You really are categorizing authentication factors by their weaknesses: - Knowledge factors can be discovered/guessed and duplicated - Possession factors should protect against guessing and duplication, but can be physically stolen - Inherence factors should protect against guessing, duplication and physical theft, but cannot be replaced Writing down a password doesn't make it an effective physical factor, just like embedding an NFC chip in your arm doesn't make it an effective biometric.
  - throwaheyy 7y ago
    Face print and fingerprint are definitely #2, something you have. Both can be easily copied. #3 would be your DNA sequence perhaps. Similarly, SMS authentication is not #2. The mapping of your phone number to your phone is not something you possess, it is sitting in some phone company system somewhere and it can be changed.
dllthomas 7y ago
Something you forgot, something you lost, something you were.
inetknght 7y ago
https://csrc.nist.gov/glossary/term/Multi_Factor-Authentication https://csrc.nist.gov/glossary/term/Multi_Factor-Authenticat... > MFA > Definition(s): > Authentication using two or more different factors to achieve authentication. Factors include: (i) something you know (e.g., password/PIN); (ii) something you have (e.g., cryptographic identification device, token); or (iii) something you are (e.g., biometric). See Authenticator. > Source(s): > NIST SP 800-53 Rev. 4 under Multifactor Authentication

cogman10 7y ago

bio-metrics is really just not a good security measure, it is an extension of number 2 (You have fingerprints, your face, etc). You'd be in just about the same place if instead of saying "you need biometrics" you said "You need 2 devices". Even number 2 can be done wrong. 2 Doesn't work if the thing you have is a knowledge based thing. 2 only works if in the case that it responds correctly to a stimulus. Think things like RSA.

dwaite 7y ago
Biometrics are not an extension of #2. You really are categorizing authentication factors by their weaknesses: - Knowledge factors can be discovered/guessed and duplicated - Possession factors should protect against guessing and duplication, but can be physically stolen - Inherence factors should protect against guessing, duplication and physical theft, but cannot be replaced Writing down a password doesn't make it an effective physical factor, just like embedding an NFC chip in your arm doesn't make it an effective biometric.
- throwaheyy 7y ago
  Face print and fingerprint are definitely #2, something you have. Both can be easily copied. #3 would be your DNA sequence perhaps. Similarly, SMS authentication is not #2. The mapping of your phone number to your phone is not something you possess, it is sitting in some phone company system somewhere and it can be changed.

dllthomas 7y ago

Something you forgot, something you lost, something you were.

inetknght 7y ago

https://csrc.nist.gov/glossary/term/Multi_Factor-Authentication https://csrc.nist.gov/glossary/term/Multi_Factor-Authenticat... > MFA > Definition(s): > Authentication using two or more different factors to achieve authentication. Factors include: (i) something you know (e.g., password/PIN); (ii) something you have (e.g., cryptographic identification device, token); or (iii) something you are (e.g., biometric). See Authenticator. > Source(s): > NIST SP 800-53 Rev. 4 under Multifactor Authentication