Personal tools
You are here: Home WiKIDBlog two-factor-authentication-hysteria-continues

two-factor-authentication-hysteria-continues

by admin posted on Jan 21, 2009 03:46 PM last modified Apr 03, 2009 11:56 AM —

As I predicted, the hysteria around the , well, hysteria in the information security blogosphere, which is a pretty small par...


As I predicted, the hysteria around the , well, hysteria in the information security blogosphere, which is a pretty small part of the blogosphere.

As I discussed before, this is a failure of mutual authentication not two-factor authentication. Here are some the headlines:

On the other hand, and sadly in the minority, zencoder has it right: Pundits Blaming 2-Factor Authentication…Again

you can’t use 2-factor authentication to protect a telnet session and expect it to be valid hosts guaranteed on both ends…telnet doesn’t have that sort of capability built into the protocol; but that’s not a problem with the 2-factor auth.

Security Curve, is also on the right track transaction authentication to make financial services acceptably secure online.

I think we do as much of a disservice to the Internet community when we inaccurately blame technology as when we inaccurately promote it as a silver bullet.

Document Actions

two-factor-authentication-hysteria-continues

Posted by zencoder at Jan 23, 2009 12:29 PM

Sorry, should have put a xD ;) grin (or insert your emoticon of choice here) after my crack-smoking statement. Was meant as a humrous/jibe reply. In re-reading, it comes across much harsher than I intended. My bad.


two-factor-authentication-hysteria-continues

Posted by Joel at Jan 23, 2009 12:29 PM

Bottomline: 2-factor authentication doesn't accomplish the purpose for which it is being promoted--stopping identity theft and online fraud. You can argue the merits of the protocol, and whether it's the fault of the protocol itself or the people writing the specs, ultimately if it doesn't accomplish what needs to be accomplished, what good is it?

The only people I have seen arguing in favor of 2-factor authentication are the people trying to sell it to someone, and it is mistakenly (whether innocently or not I can't say) being sold as the end-all solution to online fraud and identity theft, which it definitely is not.


two-factor-authentication-hysteria-continues

Posted by Anonymously Authenticated User at Jan 23, 2009 12:29 PM

2-factor authentication also won't save you money on car insurance.


two-factor-authentication-hysteria-continues

Posted by Anonymous User at Jan 23, 2009 12:29 PM

more testing