It appears that the benefit of 2-factor
authentication is broadly recognized, not the least because Onetime Passwords (OTP)
can now be sent to smart phones by SMS at very low costs. The benefit is indeed remarkable when the
users are in the indoor environment. Is
the benefit the same when the users are in the outdoor environment?
What can be relied upon in a dangerous
environment can be relied upon in a safe environment, but we cannot say that
the reverse is also true. I mean that
the indoor environment is relatively much safer than the outdoor.
Some banks tell us that it is a “mistake”
to carry a bank card together with a paper with the PIN on it. Then it should
also be a mistake to carry a mobile computer, tablet or phone together with a
paper with the password on it. Replace
such a paper with a token generating OTP or a phone receiving OTP, and what
conclusion do you think you would reach?
The PIN/password on a paper proves the
identity of the paper, not the identity of the person who holds the paper. OTP
generated on a token proves the identity of the token, not the identity of the
person who holds the token. OTP received
on a phone proves the identity of the phone, not the identity of the person who
holds the phone. The structure is the
same in all of them.
Those banks abovementioned may be wrong in
using the word “mistake”,, but we could at least learn that the 2-factor
authentication in the outdoor environment is not as beneficial as in the indoor
environment, and that, in the outdoor environment, what matters most is the
security of remembered PIN/password rather than the reliability of a
PIN/password written on a paper or a OTP generated on a token or a OTP received
on a phone.
Whether or not we use
OTP-generating/receiving tokens/phones, it should be imperative to enhance the
remembered password itself if we want the safe cyber-life in the outdoor
environment.
Making use of episodic/autobiographic image
memory will help. Sharing many of the
drawbacks with textual passwords, simple pictorial password systems had been a
disappointment, but those drawbacks can be overcome by the use of
episodic/autobiographic memories and by offering shoulder-surfing proof
functions.
Incidentally, ehancing the remembered
password is not exclusive to using OTP.
It is possible to regenerate OTP from the texts randomly allocated to
the pictures of episodic/autobiographic memories, and one of our alliances has
already started to market such a 2-factor authentication system incorporated in
a Single-Sign-On solution.
