Two-factor authentication: Difference between revisions

Revision as of 18:19, 2 December 2015

Revision as of 10:33, 11 December 2015

Line 20:

The major drawback of authentication performed using something that the user possesses and one other factor is that the plastic token used (the USB stick, the bank card, the key or similar) must be carried around by the user at all times. And if this is stolen or lost, or if the user simply does not have it with him or her, access is impossible. There are also costs involved in procuring and subsequently replacing tokens of this kind. In addition, there are inherent conflicts and unavoidable [http://eprint.iacr.org/2014/135.pdf trade-offs] between usability and security.

Mobile phone two-factor authentication was developed to provide an alternative method that would avoid such issues. This approach uses mobile devices such as mobile phones and smartphones to serve as "something that the user possesses". If users want to authenticate themselves, they can use their personal access license (i.e. something that only the individual user knows) plus a one-time-valid, dynamic passcode consisting of digits. The code can be sent to their mobile device by [[SMS]] or via a special app. An alternative method for authentication developed by [[Bookit (Finnish company)]], [[2-way iSMS|iSMS]], embeds the authentication code into the headers (e.g. originating address) so that the user only needs to reply to the message in order to authorize and authenticate. The advantage of boththis of these methodsmethod is that there is no need for an additional, dedicated token, as users tend to carry their mobile devices around at all times anyway. Some professional two-factor authentication solutions also ensure that there is always a valid passcode available for users. If the user has already used a sequence of digits (passcode), this is automatically deleted and the system sends a new code to the mobile device. And if the new code is not entered within a specified time limit, the system automatically replaces it. This ensures that no old, already used codes are left on mobile devices. For added security, it is possible to specify how many incorrect entries are permitted before the system blocks access.

'''Advantages of mobile phone two-factor authentication:'''