4 ms·
But you yourself don't know the code on the hardware token, nor do you yourself know the information gathering, encoding or decoding for biometric information.
by loteck 5y ago
But you yourself don't know the code on the hardware token, nor do you yourself know the information gathering, encoding or decoding for biometric information. Those are still pieces of information, but they aren't "something you know."
To your later point, some later versions of these original authentication factors have added "somewhere you are" to the list.
- e12e 5y agoThere's no reason a totp/otp needs to be read/typed in the clear - that's merely a convenient way to bridge trust from a phone to a desktop etc. The otp is proof that you "possess" the otp secret. Then again, it's a shared secret - so if the server side is compromised - all bets are off. Here client certificates/public key crypto does better.
- loteck 5y agoRight, the new factor is working fine, but instead of providing authentication, it's being used to merely attest to the validity of an additionally provided randomized knowledge factor, which is what gets actually for used for authentication.
- e12e 5y agoSo a hash of an image of a fingerprint isn't "something you have"? Leaves few things in that category then?