Seriously.

The more secure you make things, the more calls you get from users who can’t get into their systems. You add “random” anything to a login process and you will see lockouts skyrocket and calls to support will jump along with it. It’s always a balance between security and usability. They can only give you the level of security the dumbest users can handle.

http://www.notsocleverbot.com

My personal favorite:

User: Hey there!
Cleverbot: How are you?
User: Pretty good.
Cleverbot: That’s good.
User: You see the new Twilight Movie?
Cleverbot: I’m not interested in any of the twilight movies or books.
User: You’re not into vampires?
Cleverbot: I’m not into humans

Disagree. Nobody says that a factor of authentication has to be foolproof, only identifying one person. In fact, if it did, we would never need two-factor authentication! By the same argument, “something you know” isn’t good because someone could torture it out of you, and “something you have” isn’t sufficient since it could be stolen or duplicated.

“Where you are” can also be important in situations like IFF devices, since not only do we want to know that the responder is friendly, we want to know that the challenge-response is not being proxied to a friendly at a distant location (though they don’t necessarily use that in IFF devices).

I’m actually getting a fair number of hits from this site, so I figured I’d share an updated URL:

http://www.subspacefield.org/security/security_concepts.html

Search for “Authentication Factors” to find the section on five-factor authentication; right now it is S11.8.

I don’t discuss this, but it’s worth noting that some of these authentication factors are only useful in certain circumstances. For example, the biometric authentication isn’t always useful in network security, because the adversary could simply replay a recorded biometric signature; one has no proof that one is actually getting a reading from trusted biometric equipment, unless one engages in what TCPA calls “Remote Attestation”. If one isn’t sure where one is getting the reading from, then it’s just a string of bits, and so it’s effectively “something you know”.

For example, if I walk up to a coworker’s computer while they are away, a “where you are” auth mechanism would let me log in by simply entering their login name. This is obviously not secure. Any location can hold more than one person at different times. The type of place that “where you are” authentication would be valid is something like a prison cell, where you know for a fact that only a certain person can be in that place at the time of authentication.

Another reason most (is not all) forms of “where you are” authentication don’t qualify as factors, is because they tend to depend on one of the other factors. This also disqualifies it. An example would be ordering room service from your hotel room. Although the front desk can tell exactly where the phone call is coming from, the room itself is only secured by a key (something you have). So if someone compromises your room key, they have also compromised your location. The mechanisms need to be independent of each other.

There are still only “three” factors for authentication. Four is just marketing.