<p>We are changing our remote log-in security process at my workplace, and we are concerned that the new system does not use <a href="http://en.wikipedia.org/wiki/Two-factor_authentication" rel="nofollow noreferrer">multi-factor authentication</a> as the old one did. (We had been using RSA key-fobs, but they are being replaced due to cost.) The new system is an anti-phishing image system which has been misunderstood to be a two-factor authentication system. We are now exploring ways to continue providing multi-factor security without issuing hardware devices to the users.</p>

<p>Is it possible to write a software-based token system to be installed on the user's PCs that would constitute a true second factor in a multi-factor authentication system? Would this be considered "something the user has", or would it simply be another form of "something the user knows"?</p>

<p>Edit: <em>phreakre</em> makes a good point about cookies. For the sake of this question, assume that cookies have been ruled out as they are not secure enough.</p>

[{'answer_id': 72642, 'author': 'phreakre', 'author_id': 12051, 'author_profile': 'https://Stackoverflow.com/users/12051', 'pm_score': 1, 'selected': False, 'text': '<p>While I am not sure it is a "valid" second factor, many websites have been using this type of process for a while: cookies. Hardly secure, but it is the type of item you are describing. </p>\n\n<p>Insofar as regarding "something the user has" vs "something the user knows", if it is something resident on the user PC [like a background app providing information when asked but not requiring the user to do anything], I would file it under "things the user has". If they are typing a password into some field and then typing another password to unlock the information you are storing on their PC, then it is "something the user knows".</p>\n\n<p>With regards to commercial solutions out there already in existence: We use a product for windows called BigFix. While it is primarily a remote configuration and compliance product, we have a module for it that works as part of our multi-factor system for remote/VPN situations.</p>\n'}, {'answer_id': 73138, 'author': 'Chris Upchurch', 'author_id': 2600, 'author_profile': 'https://Stackoverflow.com/users/2600', 'pm_score': 1, 'selected': False, 'text': "<p>A software token is a second factor, but it probably isn't as good choice a choice as a RSA fob.  If the user's computer is compromised the attacker could silently copy the software token without leaving any trace it's been stolen (unlike a RSA fob where they'd have to take the fob itself, so the user has a chance to notice it's missing).  </p>\n"}, {'answer_id': 74145, 'author': 'freespace', 'author_id': 8297, 'author_profile': 'https://Stackoverflow.com/users/8297', 'pm_score': 3, 'selected': True, 'text': '<p>I would say "no". I don\'t think you can really get the "something you have" part of multi-factor authentication without issuing something the end user can carry with them. If you "have" something, it implies it can be lost - not many users lose their entire desktop machines. The security of "something you have", after all, comes from the following:</p>\n\n<ul>\n<li>you would notice when you don\'t have it - a clear indication security has been compromised</li>\n<li>only 1 person can have it. So if you do, someone else doesn\'t</li>\n</ul>\n\n<p>Software tokens do not offer the same guarantees, and I would not in good conscience class it as something the user "has". </p>\n'}, {'answer_id': 74369, 'author': 'markus', 'author_id': 3498, 'author_profile': 'https://Stackoverflow.com/users/3498', 'pm_score': 0, 'selected': False, 'text': '<p>I agree with @freespace that the the image is not part of the multi-factor authentication for the user.  As you state the image is part of the anti-phishing scheme.  I think that the image is actually a weak authentication of the system to the user.  The image provides authentication to the user that the website is valid and not a fake phishing site.</p>\n\n<blockquote>\n  <p>Is it possible to write a software-based token system to be installed on the user\'s PCs that would constitute a true second factor in a multi-factor authentication system? </p>\n</blockquote>\n\n<p>The software based token system sounds like you may want to investigate the Kerberos protocol, <a href="http://en.wikipedia.org/wiki/Kerberos_(protocol)" rel="nofollow noreferrer">http://en.wikipedia.org/wiki/Kerberos_(protocol)</a>.  I am not sure if this would count as a multi-factor authentication, though.</p>\n'}, {'answer_id': 74793, 'author': 'AviD', 'author_id': 10080, 'author_profile': 'https://Stackoverflow.com/users/10080', 'pm_score': 0, 'selected': False, 'text': "<p>What you're describing is something the <em>computer</em> has, not the user. \nSo you can supposedly (depending on implementation) be assured that it is the computer, but no assurance regarding the user...</p>\n\n<p>Now, since we're talking about remote login, perhaps the situation is personal laptops? In which case, <em>the laptop</em> is the something you have, and of course the password to it as something you know... Then all that remains is secure implementation, and that can work fine.</p>\n"}, {'answer_id': 87583, 'author': 'Community', 'author_id': -1, 'author_profile': 'https://Stackoverflow.com/users/-1', 'pm_score': 0, 'selected': False, 'text': '<p>Security is always about trade-offs.  Hardware tokens may be harder to steal, but they offer no protection against network-based MITM attacks.  If this is a web-based solution (I assume it is, since you\'re using one of the image-based systems), you should consider something that offer mutual https authentication.  Then you get protection from the numerous DNS attacks and wi-fi based attacks.  </p>\n\n<p>You can find out more here:\n<a href="http://www.wikidsystems.com/learn-more/technology/mutual_authentication" rel="nofollow noreferrer">http://www.wikidsystems.com/learn-more/technology/mutual_authentication</a>\nand\n<a href="http://en.wikipedia.org/wiki/Mutual_authentication" rel="nofollow noreferrer">http://en.wikipedia.org/wiki/Mutual_authentication</a>\nand here is a tutorial on setting up mutual authentication to prevent phishing:\n<a href="http://www.howtoforge.net/prevent_phishing_with_mutual_authentication" rel="nofollow noreferrer">http://www.howtoforge.net/prevent_phishing_with_mutual_authentication</a>.</p>\n\n<p>The image-based system is pitched as mutual authentication, which I guess it is, but since it\'s not based on cryptographic principals, it\'s pretty weak.  What\'s to stop a MITM from presenting the image too?  It\'s less than user-friendly IMO too.</p>\n'}]
['https://Stackoverflow.com/questions/72540', 'https://Stackoverflow.com', 'https://Stackoverflow.com/users/8223/']