I was actually pleasantly surprised to find that Google has somewhat of a control to address this. Services like POP/IMAP that do not support the 2-factor authentication cannot be used with your regular password. They allow you to setup an “application password” that is a nice long, strong, password, that you use only with that one service. Obviously it could still be compromised, but it is less likely to be compromised if you never type it in (safe from keyloggers) and you use it only for one service (less likely to escalate a compromise across services). Google lets you have as many of these as you want.

-Dave

You are right to be circumspect to be dubious about such claims. However ours are not made lightly.

If you take a bit of time to investigate the solution ( lots of information on the website ) – you will find that :

It’s not just the device, it’s the session/user context for that factor, and we support third party factors as well – creating our “N-Factor” synthesis ( as opposed to a sequential exchange of credentials over the browser – used by most solutions today ) which generates a one time signature at the device and at our stack – which are then compared over a separate communication path ( not the browser).

So yes – it is not just the device and no a device on its own is not multi-factor authentication.

Please test it for yourself. Download the code / mash it up and use it on your own site. You will be surprised. It has been through pen tests with some of the biggest names in the industry.

Device Fingerprinting is not multi factor authentication, no matter how much vendors like yourselves want to call it that. It is generally considered a part of any authentication solution, usually as a mechanism for profiling a user’s session to identify when it is necessary to request a higher level of authentication. To claim that it is “orders of magnitude” stronger than a proper 2 factor system is laughable.

1. Cost – who carries the cost of the text messages ( especially cross border )
2. Reliability – SMS is a store and forward protocol. Fire and forget. There are a number of reasons why it may not be delivered. a) Network congestion; b) Bad network coverage ( in building ) c) Good old security – who is monitoring those text messages to make sure that no one from the network isn’t actually ‘skimming’ them?

All is not lost. There is a solution that addresses all of the above. Check out http://www.liveensure.com. This is a multi-factor authentication solution that is orders of magnitude stronger than this proposed solution.

I was sure I read of a second factor phone jacking session on web security somewhere recently. However this is definitely better than 99.9999% of what most banks are doing, which is nearly nothing! Add a third factor, and you got a pretty tight system. Cell cameras should be a good source for something along this line!

Bear in mind I have no axe to grind and there may be better free managers out there. I picked LastPass because it was free, open source, stored all passwords and sensitive information in the cloud, came highly recommended by the IT community, communicated over SSL (of course) and stored no information on the client side hard drive. You only need one password to gain access to the console, so that one should be authored like xAdmin’s guidelines. Changing it every three months or earlier isn’t a bad idea either.

I read an article by Michael Kassner on TechRepublic where he worked with the developers at LastPass; and he did a remote session into his account and couldn’t see any of the information himself without using his console! LastPass claims even local technicians have no access to the data. I must admit I don’t understand their special host intrusion system, so I defer making comments on it.

All cautions about keyloggers and screen capture apply here, using a utility that works at the kernel level while you are infected is the best practice in preventing such attacks.

While password managers use some type of encryption, the information is a: stored on the computer and b: is software that can be hacked on that computer. If your computer is compromised or stolen, that password information is included with it for the bad guys to hack into and use at will. That’s also why I always turn off the browsers built-in autocomplete function that stores usernames and passwords and don’t like password managers.

I know it’s difficult to remember multiple passwords, but it is easier if you use passphrases of something you’ll easily remember, but at the same time are complex enough to be difficult to hack. I use a few different ones and will use them randomly across a few non-critical accounts while anything critical such as online banking gets its own unique one for maximum security.

Besides, using your brain this way gives it exercise and helps your memory retention.