Comments on: Extra tokens are convenient

By: Billy

Billy — Wed, 18 Jun 2008 01:24:35 +0000

One big upside to the phonefactor-type solution is the Out of Band component. It would be great if your solution didn’t essentially translate the “what you have” into a “what you know” and then require the user to feed it into the browser, where phishing can occur.

By: Ashwin

Ashwin — Sun, 15 Jun 2008 03:20:25 +0000

Thanks Brian, I’ve looked at a variety of these (i.e. PhoneFactor). Seems like (though I don’t fully understand this stuff) they focus on placing a call rather than establishing some sort of data session, which seems like it could be a common technical solution without regard for differences between telephone networks. Would love to stick with your stuf though…

By: Brian Kelly

Brian Kelly — Mon, 09 Jun 2008 13:01:27 +0000

We are considering a few alternative tokens from the traditional ones that we've supported in the past. This includes mobile phones and soft tokens. One of the challenges in the mobile phone space is a standard for communication between the host computer and the mobile phone, but we're getting there.

By: Ashwin

Ashwin — Sun, 08 Jun 2008 23:43:21 +0000

Word. Lots of benefits. First, no need to distribute or manage physical tokens. Second, 2nd factor authentication could occur out of band, which could protect against lots of man in the middle and phishing. Are there any non-token Trustbearer services on tap?

By: Sergey

Sergey — Sat, 07 Jun 2008 17:26:14 +0000

I’m wondering why you are sticking with the physical token concept. Why not evolve strong authentication towards usage of physical devices already in the hands of consumers, such as a mobile phone?