4

The three classes that we all know and love:

  1. Something you know.
  2. Something you have.
  3. Something you are.

I've also seen references to "somewhere you are". Is this really a fourth factor? How many factors are there?

At some point some of the factors might start to resemble others such as the blurring of the "something you have" as described in this sec.SO question.

Community
  • 1
logicalscope
  • 6,344
  • 3
  • 25
  • 38

1 Answers1

7

“Somewhere you are” seems to be a very reasonable authentication factor in 2012. A few weeks ago my Android’s Google Maps app prompted me to turn on my Wi-Fi to better locate me. My GPS was on and had a good location but Google was going the extra mile (or better stated – extra meters) by triangulating local Wi-Fi signals (Street View collected that for a reason).

So if Google wants to authenticate me based on my location compared to my typical routine they probably will have a valid factor for 90% of my trekking around this planet.

My gasoline pump asks for my Zip Code to process my credit card. My Zip Code is the same as that of the querying pump so it seems potential exists in that use case too. I know that typically the Zip Code question is "Something you know" but think about the actual location and likelihood it is me especially considering we are collocated in the same Zip Code and I have been there many times before.

Other factors will probably similarly be added with the changes in technology and virtual presence. “Something you do” might be one for example. My typing rhythm and keyboarding differs from many (e.g. lots of backspaces).

I am sure there will be some opportunities for factors in 10 years that we cannot conceive of today just as my Google Maps Android tracking was unconceivable to me 10 years ago.

zedman9991
  • 3,377
  • 15
  • 22
  • 2
    GPS is definitely allowing somewhere you are to be a new form of factor. Note that typing patterns are already considered a form of biometrics and thus something you are. – logicalscope Jan 06 '12 at 20:51
  • 1
    Your statement about typing patterns also hints to the other side to my question: how many orthogonal factors can be defined? – logicalscope Jan 06 '12 at 21:13
  • 2
    @logicalscope: Maybe you should post that question. It is an interesting security question and of great importance nowadays. – Count Zero Jan 07 '12 at 10:24
  • @zedman9991 Realize this is an old question but just wanting to point out that the typing rhythm is considered a biometric ("something you are"). See http://en.wikipedia.org/wiki/Keystroke_dynamics. – Lan Dec 11 '14 at 17:33