Secure remote access and web applications with two-factor authentication

Ticket Control

Article from ADMIN 14/2013

By Thomas Zeller

Making your systems really secure can be a bit more complicated than resorting to the use of regular passwords. In this article, we provide an overview of authentication solutions and present potential approaches for common use cases.

User authentication is all about finding out whether users really are who they claim to be. Given that unsuspecting users can fall into the trap of confusing a smartphone with an Internet hotspot, giving the hacker an easy vector for stealing their passwords, relying on usernames and passwords to access confidential information alone, is basically irresponsible. The remedy could lie in the use of additional authentication factors.

Authentication Methods

Various authentication methods can be categorized into the groups "knowledge," "possession," and "biometrics" (Table 1). These groups, also called factors, constitute the basis of any authentication method.

Table 1

Authentication Methods

Factor	Examples	Advantages	Disadvantages
Knowledge	Password, PIN, response to security question	Low costs, easy to manage	Security depends on quality; can be guessed, sniffed, forgotten, or disclosed
Possession	Certificate, TAN list, chip card, one-time password token	Usually unique and therefore cannot be copied	High cost of acquisition and management; can be passed on