3 ms·

I've always had trouble conceptually with two factor authentication conceived of in this way. If a phone is something you have, then it gives you a code, and yo

I've always had trouble conceptually with two factor authentication conceived of in this way. If a phone is something you have, then it gives you a code, and you put in that code, so it's really just a code. If it's something you have, well, probably a key right? A usb key? But it's a code on the USB key. If it's something about you (voice, fingerprint, etc), or a location, it's ultimately something represented as information. That's not to say it's a bad philosophy or less secure. It's better, not worse. But it seems to be conceived of and framed in a way as though it's appealing to something other than stuff that gets turned into computer-accessible information. The one "hard" category that seems to make sense to me has to do with hard-wired networks, and having to be in a physical place to access a system that is not online. That creates a real distinction that doesn't boil down to some form of computer-comprehensible information.

loteck 5y ago
But you yourself don't know the code on the hardware token, nor do you yourself know the information gathering, encoding or decoding for biometric information. Those are still pieces of information, but they aren't "something you know." To your later point, some later versions of these original authentication factors have added "somewhere you are" to the list.
- e12e 5y ago
  There's no reason a totp/otp needs to be read/typed in the clear - that's merely a convenient way to bridge trust from a phone to a desktop etc. The otp is proof that you "possess" the otp secret. Then again, it's a shared secret - so if the server side is compromised - all bets are off. Here client certificates/public key crypto does better.
  - loteck 5y ago
    Right, the new factor is working fine, but instead of providing authentication, it's being used to merely attest to the validity of an additionally provided randomized knowledge factor, which is what gets actually for used for authentication.
    - e12e 5y ago
      So a hash of an image of a fingerprint isn't "something you have"? Leaves few things in that category then?

loteck 5y ago

But you yourself don't know the code on the hardware token, nor do you yourself know the information gathering, encoding or decoding for biometric information. Those are still pieces of information, but they aren't "something you know." To your later point, some later versions of these original authentication factors have added "somewhere you are" to the list.

e12e 5y ago
There's no reason a totp/otp needs to be read/typed in the clear - that's merely a convenient way to bridge trust from a phone to a desktop etc. The otp is proof that you "possess" the otp secret. Then again, it's a shared secret - so if the server side is compromised - all bets are off. Here client certificates/public key crypto does better.
- loteck 5y ago
  Right, the new factor is working fine, but instead of providing authentication, it's being used to merely attest to the validity of an additionally provided randomized knowledge factor, which is what gets actually for used for authentication.
  - e12e 5y ago
    So a hash of an image of a fingerprint isn't "something you have"? Leaves few things in that category then?