Innovation in authentication

BYOD and off-premise access to on-prem and/or behind-the-firewall resources is a huge problem for IT security.

Don't feed the phish. Image credits to the University of Idaho.

Don’t feed the phish. Image credits to the University of Idaho.

Google has been testing new/different/alternative ways for their customers to authenticate (i.e., identify themselves).  The addition of your phone into multi-factor authentication (MFA) is not new.  What is slightly new is how the phone is used.  Google authenticator (the “standard” way of adding your phone to MFA) is a pain – who wants to type in a number?  There’s no password on Google Authenticator.

This new experiment relies on possession of the phone to enable access.  An interesting concession to convenience.

Here’s my (free to use) suggestion for phone-based MFA:

  1. authentication request pushes notification to phone
  2. open alert takes you to the New and Improved Google Authenticator
  3. Fingerprint authentication required for the Google Authenticator app
  4. BIG BUTTON that reads “Do you want to login to Application X?”
  5. Tap yes

Dear Google – off you go to implement please.

This entry was posted in Personal Technology. Bookmark the permalink.

Leave a Reply

Fill in your details below or click an icon to log in:

WordPress.com Logo

You are commenting using your WordPress.com account. Log Out /  Change )

Google+ photo

You are commenting using your Google+ account. Log Out /  Change )

Twitter picture

You are commenting using your Twitter account. Log Out /  Change )

Facebook photo

You are commenting using your Facebook account. Log Out /  Change )

w

Connecting to %s