3 ms·

Shameless self-plug: Three-factor authentication with ssh public key, Google Authenticator and password https://turquoiseliquorice.wordpress.com/2013/10/05/th

• ryan-c 11y ago
  That's still two factor authentication. The possible factors are "something you know", "something you have" and "something you are". Two "things you have" only count as a single factor between them.
  • CMCDragonkai 11y ago
    How do you authenticate something you are? Specifically across a medium like the internet? Fingerprint scans?
    • ryan-c 11y ago
      Generally, "something you are" is some sort of biometric. Fingerprint, iris, hand geometry, palm veins, face and voice are all possible. Some laptops have fingerprint readers, face/voice recognition would probably work fine through a cheap webcam. I'm not sure how you'd prevent replay attacks if you were running it over the internet.
      • zaroth 11y ago
        For single or small-n user systems, the best practice that's evolved around this is to not actually send the fingerprint image to the remote server. A trusted security module has a private key and the biometric sensor, and the remote server has the public key. The trusted security module locally validates the fingerprint, and then signs a message that can't be replayed to indicate the fingerprint was presented.