Authentication Factors and MFA

"We have had no reported or confirmed account takeovers since implementing security keys at Google." A Google spokesperson said that to the security journalist Brian Krebs in July 2018. Early in 2017 the company had begun requiring every one of its more than 85,000 employees to sign in to work accounts with a password and a security key, a small device that plugs into a computer or taps against a phone. Before that, employees had used a password and a six-digit code from a phone app.

A security key is one kind of proof that a person is who they claim to be, and a password is another. Security work sorts these proofs into a few kinds.

At the studio, the admin console is the staff-only page that can change any player's account and hand out anything in the game, so the studio wants more than a password in front of it. The IT lead lists what the studio's equipment can check.

Name the kind of factor each option checks.

Option 1 is a knowledge factor. Options 2 and 3 are possession factors: the phone and the key are objects the staff member has. Option 4 is biometric, and option 5 is a location factor.

Option 4, the fingerprint reader, checks something a staff member can't forget, the way a password gets forgotten, or leave at home, the way a key gets left behind.

Option 5 trusts a place, not a person: anyone on the studio's office network passes it.

Options 2 and 3 are the same kind of factor, but they aren't equally hard to get. One of the two objects can be taken from its owner without anyone touching it. Which one?

The phone can be taken that way, or at least its number can. A text message goes to a phone number, not to a particular phone, and a phone company can transfer a number to a new SIM card, the chip that ties a phone to its number. An adversary who tricks or bribes a phone company employee into transferring the number, called a SIM swap, receives the owner's texts on a phone of their own. A security key has no number to transfer. To use it, an adversary has to hold it. It also checks the address of the site asking for it, so a fake sign-in page gets no usable answer from it. A six-digit code, from a text or an app, can be typed into a fake page as easily as a password can, and the adversary can use it at once.

A group calling itself the Chuckling Squad did this to Jack Dorsey, Twitter's own chief executive, on August 30, 2019. Twitter said the phone number on his account had been taken over through a security oversight by his mobile carrier. With the number, the group didn't need his password. Twitter still let users post by sending a text message from the phone number on their account, and for 15 to 20 minutes racist and offensive posts went out from @jack to his more than four million followers. Five days later, Twitter switched off posting by text message, and the next day it turned the feature back on only in a few countries that depend on it.