There are generally four factors of authentication that are available for us to use today:
- Something you have (i.e a number generator like Google Authenticator)
- Something you know (i.e. a password or passphrase)
- Something you are (i.e. biometrics like fingerprint or facial geometry)
- Where you are (i.e. GPS location tracked by your phone or IP address location)
Below, I’ll explain some options that fit into each of these categories.
- Hardware Token: Something you have
A hardware token can come in many forms. Back in the 90s, you could always tell the IT people in a company because they had little fobs on their keychains that had a small display with numbers changing every 30 seconds. This is known as a Time-based One Time Password (TOTP). While this is still an option today, most implementations of TOTP are executed using a mobile app or SMS message (see below). Another popular hardware token is the Yubikey. This is a hardware token that typically is plugged into a computer via USB however some Yubikeys support near field communication which supports devices without USB ports, like an iPhone. To use this token, you log in with your username and password, then, a field appears on the page that asks for the Yubikey authentication. Instead of typing into that field, the user plugs in the Yubikey and touches the sensor. With this physical connection, the key is entered by the Yubikey.
- TOTP SMS: Something you have
The SMS Time-based One Time Password (TOTP) is a text message or email with a numeric code, called a one-time password (OTP) because it is only good for one use. This method is less popular with cybersecurity professionals since it’s been shown to be weak compared to other options but it’s still MUCH better than only using a username and password.
- Time-based One Time Password (TOTP) Token: Something you have
Another popular method is the use of a TOTP generator such as those found on the old hardware RSA keychain tokens or a smartphone app like Google Authenticator, LastPass, FreeOTP and others. These numbers change every 30 seconds based on a shared algorithm that the software token and the authentication server both know. There is no network or Internet communication needed to use the soft token. The image below shows the time-based token on a mobile phone and where it is entered into the webpage after the username and password are entered into Google.
- Phone/e-mail: Something you have
Two other TOTP MFA options are to receive a phone call or an email with the MFA code. While this is better than no MFA, it has been shown many times how easy it is for a threat actor to intercept or use this option without the knowledge of the user who owns the account.
- Backup Codes: Something you have
Backup codes are provided to you when you set up MFA on many sites. The idea behind the backup codes is that you secure them in a safe locked desk/office, safe deposit box, or an encrypted vault, like your password manager. They are used only if you lose or do not have access to your regularly used MFA. For example, if your phone is stolen, you can no longer use the Google Authenticator. In this case, you could pull out your backup codes and login to your account.
- Biometrics: Something you are
Biometrics became mainstream with fingerprint readers and facial recognition technology embedded in the mobile devices and laptops that we use every day. However in those implementations, biometrics is used as an alternative to the username and password rather than as another factor. We don’t see biometrics used much in MFA online these days, but the possibility is there to use it.
GPS location is another factor that isn’t used much for MFA today, but is frequently tracked to find if accounts have been breached. Let’s say that Sally logs in to her company’s VPN from New York City at 8 a.m. on Monday and then logs in to the VPN server again at 10 a.m. from Paris. Obviously, she was not able to get from NYC to Paris in two hours, so the VPN server would deny that second connection and alert the cybersecurity team to investigate.
QR Codes are growing in popularity as a method of authentication and in some cases, replacing username and passwords altogether. While this is currently not that common for most Internet users, there is technology in the works today that could make QR codes and cameras in phones and computers the replacement for username and passwords.