two factor authentication : Java Glossary

TFA (Two Factor Authentication) is an additional wrinkle to improve security over ordinary passwords. An optional security feature for Yahoo mail or GMail web mail. In addition to asking your password it requires something else such as a mobile device, hardware token, or a smart card for something you have. Biometric data, such as fingerprints, for something you are, is also an option. One implementation gives a false sense of security from its James Bondian implementation. You have a fob on your keychain, sometimes called a token, with a number that changes every minute to a different random value. It is keyed off an internal clock and a pseudorandom number generator. When you login, you have to give both your password and the current number on the fob.

The advantage is, if someone guesses your password, or steals your fob, but not both, they cannot login.

Online services like Google, Facebook, LastPass, Amazon, Twitter, Apple… make the use of such a device optional. However, you mainly want the extra security primarily on financial sites like banks, credit unions, credit cards, PayPal most of which do not yet support them.

Digital Certificates

The solution is to use a scheme that does not require the server to guard any secrets. The US military has long been using such a certificate-based scheme they call CAC (Common Access Card) cards. It is not rocket science. It is immune to hacking since there are no secrets to hack. Industry persists in using password buggy whip-era authentication.

Certificates are amazing. A single card can act as ID, driver’s licence, passport, credit card, debit card, library card, all your passwords, emergency medical records… Perhaps that potential power is what scares people away from them.

Strategy

Until we have certificates:

• Use a password generator to generate unguessable passwords.
• If you have to carry your passwords around with you, keep them in an AES-encrypted flash fob.
• If you want to make it a tiny bit harder for some fiend to share Aunt Mary’s secret cookie recipe on Facebook under your name, get a token/timer fob. More seriously, people tend to put all their personal information into Facebook. Facebook is a gold mine for identity theft.
• Store your password on your desktop in encrypted form using a program like PWSafe.
• There are all manner of schemes besides tokens to pair up with passwords, retinal scans, voice recongition, finger print scan, remotely scanned ID tags… You can’t implement these as an individual, but you can implement them for corporate security.