Bredemarket helps identity/biometric firms.
- Finger, face, iris, voice, DNA, ID documents, geolocation, and even knowledge.
- Content-Proposal-Analysis. (Bredemarket’s “CPA.”)
Don’t miss the boat.
Augment your team with Bredemarket.
Tag Archives: geolocation
Do All 5 Identity Factors Apply to Non-Human Identities?
I’ve talked ad nauseam about the five factors of identity verification and authentication. In case you’ve forgotten, these factors are:
- Something you know.
- Something you have.
- Something you are.
- Something you do.
- Somewhere you are.
I’ll leave “somewhat you why” out of the discussion for now, but perhaps I’ll bring it back later.
These five (or six) factors are traditionally used to identify people.
Identifying “Non-Person Entities”
But what happens when the entity you want to identify is not a person? I’ll give two examples:
- Kwebbelkop AI, discussed in “Human Cloning Via Artificial Intelligence: It’s Starting,” is not a human. But is there a way to identify the “real” Kwebbelkop AI from a “fake” one?
- In “On Attribute-Based Access Control,” I noted that NIST defined a subject as “a human user or NPE (Non-Person Entity), such as a device that issues access requests to perform operations on objects.” Again, there’s a need to determine that the NPE has the right attributes, and is not a fake, deep or shallow.
There’s clearly a need to identify non-person entities. If I work for IBM and have a computer issued by IBM, the internal network needs to know that this is my computer, and not the computer of a North Korean hacker.
But I was curious. Can the five (or six) factors identify non-person entities?
Let’s consider factor applicability, going from the easiest to the hardest.
The easy factors
- Somewhere you are. Not only is this extremely applicable to non-person entities, but in truth this factor doesn’t identify persons, but non-person entities. Think about it: a standard geolocation application doesn’t identify where YOU are. It identities where YOUR SMARTPHONE is. Unless you have a chip implant, there is nothing on your body that can identify your location. So obviously “somewhere you are” applies to NPEs.
- Something you have. Another no brainer. If a person has “something,” that something is by definition an NPE. So “something you have” applies to NPEs.
- Something you do. NPEs can do things. My favorite example is Kraftwerk’s pocket calculator. You will recall that “by pressing down this special key it plays a little melody.” I actually had a Casio pocket calculator that did exactly that, playing a tune that is associated with Casio. Later, Brian Eno composed a startup sound for Windows 95. So “something you do” applies to NPEs. (Although I’m forced to admit that an illegal clone computer and operating system could reproduce the Eno sound.)
Those three were easy. Now it gets harder.
The hard factors
Something you know. This one is a conceptual challenge. What does an NPE “know”? For artificial intelligence creations such as Kwebbelkop AI, you can look at the training data used to create it and maintain it. For a German musician’s (or an Oregon college student’s) pocket calculator, you can look at the code used in the device, from the little melody itself to the action to take when the user enters a 1, a plus sign, and another 1. But is this knowledge? I lean toward saying yes—I can teach a bot my mother’s maiden name just as easily as I can teach myself my maiden name. But perhaps some would disagree.
Something you are. For simplicity’s sake, I’ll stick to physical objects here, ranging from pocket calculators to hand-made ceramic plates. The major reason that we like to use “something you are” as a factor is the promise of uniqueness. We believe that fingerprints are unique (well, most of us), and that irises are unique, and that DNA is unique except for identical twins. But is a pocket calculator truly unique, given that the same assembly line manufactures many pocket calculators? Perhaps ceramic plates exhibit uniqueness, perhaps not.
That’s all five factors, right?
Well, let’s look at the sixth one.
Somewhat you why
You know that I like the “why” question, and some time ago I tried to apply it to identity.
- Why is a person using a credit card at a McDonald’s in Atlantic City? (Link) Or, was the credit card stolen, or was it being used legitimately?
- Why is a person boarding a bus? (Link) Or, was the bus pass stolen, or was it being used legitimately?
- Why is a person standing outside a corporate office with a laptop and monitor? (Link) Or, is there a legitimate reason for an ex-employee to gain access to the corporate office?
The first example is fundamental from an identity standpoint. It’s taken from real life, because I had never used any credit card in Atlantic City before. However, there was data that indicated that someone with my name (but not my REAL ID; they didn’t exist yet) flew to Atlantic City, so a reasonable person (or identity verification system) could conclude that I might want to eat while I was there.
But can you measure intent for an NPE?
- Does Kwebbelkop AI have a reason to perform a particular activity?
- Does my pocket calculator have a reason to tell me that 1 plus 1 equals 3?
- Does my ceramic plate have a reason to stay intact when I drop it ten meters?
I’m not sure.
Positioning, Messaging, and Your Facial Recognition Product Marketing
(Part of the biometric product marketing expert series)
When marketing your facial recognition product (or any product), you need to pay attention to your positioning and messaging. This includes developing the answers to why, how, and what questions. But your positioning and your resulting messaging are deeply influenced by the characteristics of your product.
If facial recognition is your only modality
There are hundreds of facial recognition products on the market that are used for identity verification, authentication, crime solving (but ONLY as an investigative lead), and other purposes.
Some of these solutions ONLY use face as a biometric modality. Others use additional biometric modalities.
Your positioning depends upon whether your solution only uses face, or uses other factors such as voice.
- If your solution is only a face solution and does not include voice, your company will spend a lot of time trashing voice biometrics because of the demonstrated spoofs against voices.
- Similarly, a face-only company will argue that facial recognition is a very fast, very secure, and completely frictionless method of verification and authentication. When opponents bring up the demonstrated spoofs against faces, you will argue that your iBeta-conformant presentation attack detection methodology guards against such spoofing attempts.
- On the other hand, a company that uses multiple biometric modalities will argue that ANY single biometric modality can be spoofed, but that it is much, much harder to spoof multiple biometric modalities at once.
Of course, if you initially only offer a face solution and then offer a second biometric, you’ll have to rewrite all your material. “You know how we said that face is great? Well, face and gait are even greater!”
If biometrics is your only factor
It’s no secret that I am NOT a fan of the “passwords are dead” movement.
It seems that many of the people that are waiting the long-delayed death of the password think that biometrics is the magic solution that will completely replace passwords.
For this reason, your company might have decided to use biometrics as your sole factor of identity verification and authentication.
Or perhaps your company took a different approach, and believes that multiple factors—perhaps all five factors—are required to truly verify and/or authenticate an individual. Use some combination of biometrics, secure documents such as driver’s licenses, geolocation, “something you do” such as a particular swiping pattern, and even (horrors!) knowledge-based authentication such as passwords or PINs.
This naturally shapes your positioning and messaging.
- The single factor companies will argue that their approach is very fast, very secure, and completely frictionless. (Sound familiar?) No need to drag out your passport or your key fob, or to turn off your VPN to accurately indicate your location. Biometrics does it all!
- The multiple factor companies will argue that ANY single factor can be spoofed, but that it is much, much harder to spoof multiple factors at once. (Sound familiar?)
So position yourself however you need to position yourself. Again, be prepared to change if your single factor solution adopts a second factor.
A final thought
Every company has its own way of approaching a problem, and your company is no different. As you prepare to market your products, survey your product, your customers, and your prospects and choose the correct positioning (and messaging) for your own circumstances.
And if you need help with biometric positioning and messaging, feel free to contact the biometric product marketing expert, John E. Bredehoft. (Full-time employment opportunities via LinkedIn, consulting opportunities via Bredemarket.)
In the meantime, take care of yourself, and each other.
Geolocation Identifies People (Who Don’t Want To Be Identified)
A person in Upland, California posted this on the local NextDoor. While anecdotal and not statistical, in this case the geolocation capabilities of a device (in this case AirPods) identified someone in possession of a stolen vehicle.
https://nextdoor.com/p/ks5wW5n_csJB?utm_source=share&extras=NDk4MjIxOTI%3D
The Secret to Beating Half of All Fortune 500 Marketers and Growing Your Business
(Updated blog post count 10/23/2023)
Always take advantage of your competitors’ weaknesses.
This post describes an easy way to take advantage of your competitors. If they’re not blogging, make sure your firm is blogging. And the post provides hard numbers that demonstrate why your firm should be blogging.
Who uses blogging?
According to an infographic using 2017 data, 50% of the top 200 Fortune 500 companies had a public corporate blog.
Which means that half of those companies don’t have a public corporate blog.
The same infographic also revealed the following:
- 86% of B2B companies are blogging. (Or, 14% are not.)
- 68% of social media marketers use blogs in their social media strategy. (Or, 32% don’t.)
- 45% of marketers saying blogging is the #1 most important piece of their content strategy.
- Small businesses under 10 employees allocate 42% of their marketing budget to content marketing.
So obviously some firms believe blogging is important, while others don’t.
What difference does this make for your firm?
What results do blogging companies receive?
In my view, the figures above are way too low. 100% of all Fortune 500 companies, 100% of B2B companies should be blogging, and 100% of social media marketers should incorporate blogging.
Why? Because blogging produces tangible results.
Blogging produces awareness
Blogging is an ideal way to promote awareness of your firm and its offerings. From the same infographic:
- 77% of internet users read blogs.
- Internet users in the US spend 3x more time on blogs than they do on email.
- Companies who blog receive 97% more links to their websites.
- 70% of consumers learn about a company through articles rather than ads.
- The average company that blogs generates 55% more website visitors.
Blogging produces leads
Awareness is nice, but does awareness convert into leads?
- Small businesses that blog get 126% more lead growth than those who don’t.
- B2B marketers that use blogs get 67% more leads than those who do not.
Blogging produces conversions
Getting leads from blogging is nice, but show me the money! What about conversions?
- Marketers who have prioritized blogging are 13x more likely to enjoy positive ROI.
- 92% of companies who blog multiple times per day have acquired a customer from their blog.
Take a look at those last two bullets related to conversion again. Blogging is correlated with positive ROI (I won’t claim causation, but anecdotally I believe it), and blogging helps firms acquire customers. So if your firm wants to make money, get blogging.
What should YOUR company do?
With numbers like this, shouldn’t all companies be blogging?
But don’t share these facts with your competitors. Keep them to yourself so that you gain a competitive advantage over them.
Now you just need to write those blog posts.
How can I help?
And if you need help with the actual writing, I, John E Bredehoft of Bredemarket, can help.
- I’ve written more than 500 business blog posts.
- I can create blog content that has an immediate business impact, is easy to reshare, and is easy to repurpose as other content.
- If you are in the identity/biometric industry, my identity blog post writing experience benefits firms who identify individuals via fingers, faces, irises, DNA, driver’s licenses, geolocation, and many other factors and modalities. I truly am a biometric content marketing expert and an identity content marketing expert.
- And if you’re not in the identity/biometric industry, my general content marketing expertise also applies to technology firms and general business firms.
- I ask you critical questions before I start blogging, to ensure you get the right content.
- I collaborate with you throughout the process to ensure the blog post is on target and meets your goals.
In most cases, I can provide your blog post via my standard package, the Bredemarket 400 Short Writing Service. I offer other packages and options if you have special needs.
Authorize Bredemarket, Ontario California’s content marketing expert, to help your firm produce words that return results.
- Email me at john.bredehoft@bredemarket.com.
- Book a meeting with me at calendly.com/bredemarket.
- Contact me at bredemarket.com/contact/.
- Subscribe to my mailing list at http://eepurl.com/hdHIaT.
There Are Just Five Factors of Authentication. (I want the job.)
As some of you know, I’m seeking full-time employment after my former employer let me go in late May. As part of my job search, I was recently invited to a second interview for a company in my industry. Before that interview, I made an important decision about how I was going to present myself.
If you’ve read any of Bredemarket’s content, there are times when it takes a light tone, in which wildebeests roam the earth while engaging in marketing activities such as elaborating the benefits of crossing the stream.
Some of that DOES NOT fly in the corporate world. (For most companies, anyway.) If you analyze a wide selection of corporate blogs, you won’t see the word “nothingburger.” But you do here.
So as I prepared for this important job interview, I made sure that I was ready to discuss the five factors of authentication, and my deep experience as an identity content marketing expert with many of those factors.
The five factors of authentication, of course, are:
- Something you know.
- Something you have.
- Something you are.
- Something you do.
- Somewhere you are.
“But wait a minute,” some of you are saying. “Didn’t you just say that there is a sixth factor of authentication, ‘Somewhat you why?'”
For the purposes of this job interview, there isn’t! I confined myself to the five factors only during the discussion, using examples such as passwords, driver’s licenses, faces, actions, and smartphone geolocation information.
But in the end, my caution was of no avail. I DIDN’T make it to the next stage of interviews.
Maybe I SHOULD have mentioned “Somewhat you why” after all.
Bredemarket’s Name for the Sixth Factor of Authentication
Depending upon whom you ask, there are either three or five factors of authentication.
Unless you ask me.
I say that there are six.
Let me explain.
First I’ll discuss what factors of authentication are, then I’ll talk about the three factor and five factor school, then I’ll briefly review my thoughts on the sixth factor—now that I know what I’ll call it.
What are factors of authentication?
Before proceeding to factors of authentication, let’s review TechTarget’s definition of authentication.
Authentication is the process of determining whether someone or something is, in fact, who or what it says it is.
From https://www.techtarget.com/searchsecurity/definition/authentication
For purposes of this post I’m going to stay away from the “something” part and concentrate on the “someone” part.
For example, if Warren Buffett has a bank account, and I claim that I am Warren Buffett and am entitled to take money from that bank account, I must complete an authentication process to determine whether I am entitled to Warren Buffett’s money. (Spoiler alert: I’m not.)
So how do I authenticate? There are many different ways to authenticate, which can be grouped into several authentication factors. Here’s how Sumo Logic defines “authentication factor.”
An authentication factor is a special category of security credential that is used to verify the identity and authorization of a user attempting to gain access, send communications, or request data from a secured network, system or application….Each authentication factor represents a category of security controls of the same type.
From https://www.sumologic.com/glossary/authentication-factor/
When considering authentication factors, the whole group/category/type definition is important. For example, while a certain system may require both a 12-character password and a 4-digit personal identification number (PIN), these are pretty much the same type of authentication. It’s just that the password is longer than the PIN. From a security perspective, you don’t gain a lot by requiring both a password and a PIN. You would gain more by choosing a type of authentication that is substantially different from passwords and PIN.
How many factors of authentication are there?
So how do we define the factors of authentication? Different people have different definitions.
Three factors of authentication
For the most part, I believe that everyone agrees on at least three factors of authentication. As I noted in a prior post on factors of authentication, NIST defines the following three factors:
Factors include: (i) something you know (e.g. password/personal identification number (PIN)); (ii) something you have (e.g., cryptographic identification device, token); or (iii) something you are (e.g., biometric).
From https://csrc.nist.gov/glossary/term/Multi_Factor_Authentication, cited in https://bredemarket.com/2022/03/19/remember-the-newer-factors-of-authentication/
Note that NIST’s three factors are very different from one another. Knowing something (such as a password or a PIN) differs from having something (such as a driver’s license) or being something (a fingerprint or a face).
But some people believe that there are more than three factors of authentication.
Five factors of authentication
Let’s add two factors to the definition trumpeted by NIST. People such as The Cybersecurity Man have included all five in their definition.
- Something you know.
- Something you have.
- Something you are.
- Something you do.
- Somewhere you are.
For more information, see my March 2021 post on the five factors of authentication.
But are there only five?
Six factors of authentication
In April 2022, I began wondering if there is a sixth authentication factor. While I struggled to put it into the “some xxx you xxx” format, I was able to encapsulate what this sixth factor was.
What about the authentication factor “why”?
This proposed factor, separate from the other factors, applies a test of intent or reasonableness to any identification request.
From https://bredemarket.com/2022/04/12/the-sixth-factor-of-multi-factor-authentication-you-heard-it-here-first/
Over the months, I struggled through some examples of the “why” factor.
- Why is a person using a credit card at a McDonald’s in Atlantic City? (Link) Or, was the credit card stolen, or was it being used legitimately?
- Why is a person boarding a bus? (Link) Or, was the bus pass stolen, or was it being used legitimately?
- Why is a person standing outside a corporate office with a laptop and monitor? (Link) Or, is there a legitimate reason for an ex-employee to gain access to the corporate office?
As I refined my thinking, I came to the conclusion that “why” is a reasonable factor of authentication, and that this was separate from the other authentication factors (such as “something you do”).
And the sixth factor of authentication is called…
You’ll recall that I wanted to cast this sixth authentication factor into the “some xxx you xxx” format.
So, as of today, here is the official Bredemarket list of the six factors of authentication:
- Something you know.
- Something you have.
- Something you are.
- Something you do.
- Somewhere you are.
(Drumroll…)
- Somewhat you why.
Yes, the name of this factor stands out from the others like a sore thumb (probably a loop).
However, the performance of this factor stands out from the others. If we can develop algorithms that accurately measure the “why” reasonableness of something as a way to authenticate identity, then our authentication capabilities will become much more powerful.
Testing My Sixth Authentication Factor on One Real and Two Imagined Corporate Office Visits
This is the third post in a series on my proposed sixth factor of authentication.
Perhaps you’ve heard people say there are three factors of authentication, or four factors of authentication, or five factors of authentication.
But what if there are six?
I know what you’re thinking, punk. You’re thinking: did he define 6 factors of authentication, or only 5? (Repurposing Dirty Harry, whose sixth bullet must have 404’ed.)
Introduction: what are factors of authentication, anyway?
Authentication is the process of determining whether a person is truly THE person who is associated with a particular account, such as a computer login or a bank account.
Five authentication factors
There are many ways in which you can authenticate yourself, but (as I previously noted before starting the “6fa” series) all of these methods fall into up to five general categories, or “factors.”
- Something you know.
- Something you have.
- Something you are.
- Something you do.
- Somewhere you are.
By the way, if you provide a password, a PIN, your mother’s maiden name, and the name of your favorite pet, that is not four authentication factors, but four instances of the same authentication factor (something you know). And this is not a recipe for robust security.
For another example of multiple uses of the same factor, see kao’s post in Life in Hex.
What if there is a sixth authentication factor?
In April 2022, while I was consulting for the identity industry but not employed by it, I proposed a sixth authentication factor.
I’d like to propose a sixth authentication factor.
What about the authentication factor “why”?
This proposed factor, separate from the other factors, applies a test of intent or reasonableness to any identification request.
From https://bredemarket.com/2022/04/12/the-sixth-factor-of-multi-factor-authentication-you-heard-it-here-first/
Testing my theory
Two months later, I was employed in the identity industry, and therefore Bredemarket was pivoting away from identity consulting. But I was still musing about identity topics that had nothing to do with my employment, and decided to test my sixth authentication factor theory on a case in which a person, or possibly multiple persons, were boarding buses.
After I laid out the whole story, which involved capturing the times at which a person (or persons) boarded a bus, I wondered if there were really just five authentication factors after all.
Now I’ll grant that “why?” might not be a sixth factor of authentication at all, but may fall under the existing “something you do” category. This factor is normally reserved for gestures or touches. For example, some facial liveness detection methods require you to move your head up, down, right, or left on command to prove that you are a real person. But you could probably classify boarding a bus as “something you do.”
From https://bredemarket.com/2022/07/24/testing-my-sixth-authentication-factor-on-omnitrans-bus-passes/
So I tried to think of a “why” action that couldn’t be classified as “something you do.” But I didn’t think that hard, because I was busy in my day job, and I didn’t really need 6fa in my non-identity consulting work.
Well, that changed. So I’m revisiting the 6fa issue again, and this time I’ve devised a new test in which I visit two buildings over the course of three months. Can the sixth authentication factor truly confirm or deny my identity?
Why am I visiting a corporate office?
For this test, I will examine three instances—one real, two imagined—in which I visited a corporate office associated with a well-known identity verification firm.
As I consider whether I should be authenticated to enter the facility in question, I will use my proposed “why?” factor to measure whether there is a reasonable intent for me to be present, which could determine whether I pass or fail authentication.
Visit number one, April 2023
This visit really happened. One day I presented myself at a corporate office to be authenticated for entry.
If we use my six factors of authentication, should I be allowed in?
Let’s start with the first five factors:
- Something you know, have, and are. Without disclosing confidential information about the corporate office’s security procedures, I can simply say that I satisfied all three of these factors.
- Something you do. It is a matter of public record that the corporation that controls this corporate office does not employ active liveness, but instead employs passive liveness. Therefore I can disclose that when visiting this corporate office, I didn’t have to shake my head in one hundred different directions to prove that I was a live person.
- Somewhere you are. It sounds silly, but let’s ask the question anyway. If I want to physically enter a corporate office, am I at that corporate office? It is possible to detect that my phone is there (something you have), but does that necessarily mean that I am there (something you are)? To simplify things, let’s assert that I passed the “somewhere you are” test, and that I was truly outside of the corporate office, waiting to get in.
Now let’s apply the sixth factor, why/intent/reasonableness. Was there a reason why I was standing outside the office door?
In this case, there was a reason why I was there. I was a member of the Marketing Department, and the entire Marketing Department was gathering for a week-long meeting at the corporate office. So my presence there was legitimate.
Authentication: PASSED.
Visit number two, June 2023
This visit never happened except in my imagination. But would would have occurred if I had presented myself at the corporate office this month?
Let’s start by going through the five authentication factors again.
- Something you know, have, and are. Without disclosing confidential information, I can simply say that in this instance I would have failed at least one of the three authentication factors. Obviously not the “something you are” factor, since I was still the same person that I was two months previously, but I would have failed at least one of the other two.
- Something you do. Again, no liveness testing, so “something you do” would not apply.
- Somewhere you are. Let’s assert that I would have again passed the “somewhere you are” test, and that I was truly outside of the corporate office, waiting to get in.
So I’ve already failed one or two of the five authetication factors, but would I fail the sixth?
Yes, because there was no valid reason for me to enter the corporate office.
Why not?
Because by June 2023 I was no longer an employee, and therefore had no intent or reason to visit the corporate office. I didn’t work there, after all.
(And incidentally, this is why I would have failed one or two of the other authentication factors. Because I was no longer an employee, I no longer knew something and/or had something I needed to enter the office.)
Authentication: FAILED.
Visit number three, June 2023
This visit never happened either, except in my imagionation. Let’s assume all of the facts from visit number two, with one critical exception: I arrived at the corporate office carrying computer equipment.
So how does the authentication process unfold now?
- Something you know, have, and are. The presence of computer equipment would not have changed these three authentication factors. I still would have passed the “something you are” factor and failed one or both of the other two. (In this instance, computer equipment does not count as “something you have.”)
- Something you do. Again, no liveness testing, so “something you do” would not apply.
- Somewhere you are. Let’s assert that I would have again passed the “somewhere you are” test, and that I was truly outside of the corporate office, waiting to get in.
Now let’s turn to the sixth authentication factor. No, I am not a current employee who is usually entitled to visit the corporate office, but my possession of computing equipment introduces a new variable into the why/intent/reasonableness factor.
Why? Because the computer equipment belonged to the company, and in this instance I would have been visiting the corporate office to return the computer equipment to the company.
Authentication: PASSED.
So I guess there IS a sixth authentication factor
And there you have it.
In visits number two and three, all of the standard five authentication factors provided identical results. In both instances:
- I passed the something you are test.
- I failed the something you know and/or the something you have test.
- Something you do was never tested.
- I passed the somewhere you are test.
But for visit number two authentication failed, while for visit number three authentication passed, solely on the basis of the sixth authentication factor. I had no valid reason to be at the corporate office…except to return the company’s equipment.
So the sixth authentication factor exists in theory, but it will take some work to make it a reality.
So now how do I make a ton of money by bringing this sixth authentication factor to market?
As I said over a year ago…
Maybe I should speak to a patent attorney.
From https://bredemarket.com/2022/04/12/the-sixth-factor-of-multi-factor-authentication-you-heard-it-here-first/
The sixth factor of multi factor authentication (you heard it here first!)
As many of my readers know, there are a variety of ways for people to individually identify themselves.
The National Institute of Standards and Technology recognizes three of these authentication factors:
- The most commonly known authentication factor is “something you know.” This includes such items as passwords, personal identification numbers (PINs), and the name of your childhood pet. This authentication factor is very common and very controversial, to the point where some want to eliminate it altogether. (I don’t.)
- Another authentication factor that I know very well is “something you are.” Biometrics such as fingerprint identification and facial recognition falls into this category, as well as gait recognition, “behavioral biometrics,” and other biometric identifiers.
- The third authentication factor that NIST recognizes is “something you have.” This could be a driver’s license, a passport, a key fob, a smartphone, or perhaps a digital identity application.
But those aren’t the only authentication factors. Two others have been identified, as I have previously noted.
- “Something you do” differs from both gait recognition and behavioral biometrics, because this is not an inherent property of your being, but is a deliberate set of actions on your part. For example, you could gain access to a nuclear facility by putting your left foot in, putting your left foot out, putting your left foot, in and shaking it all about. Note, however, that this particular “something you do” is as common as the password “12345” and should be avoided.
- And the fifth factor is “somewhere you are.” For example, if I am buying something at a a store in Virginia, but I am physically in California, something appears to be wrong.
OK, that’s it. End of post. Those are the five authentication factors. There aren’t any more, and there never will be any more. Oh sure, you could come up with a sixth authentication factor, but chances are that it would map into one of the five existing authentication factors.
Or maybe not.
Why?
I’d like to propose a sixth authentication factor.
What about the authentication factor “why”?
This proposed factor, separate from the other factors, applies a test of intent or reasonableness to any identification request.
Let me give you an example. Assume for the moment that I am at a McDonald’s in Atlantic City and want to use my brand new credit card to buy some healthy Irish cuisine.
You could, of course, apply the existing authentication factors to this transaction:
- I physically have the credit card.
- I know the PIN that is associated with the credit card.
- My face matches the face of the person who owns the credit card.
- I am physically at the McDonald’s where the food is for sale, and I physically have a hotel key associated with a nearby hotel, and I physically have a badge associated with a trade show in the city. (The latter two facts are actually a combination of “something you have” and “somewhere you are,” but I threw them here for the fun of it.)
- If my credit card company has implemented it, I can perform the super secret finger pattern (or hokey pokey dance) associated with this account.
But even if all of these factors are authenticated, or even if some of them are not, does it make sense that I would be purchasing a meal at a McDonald’s in Atlantic City?
- Did I recently book a flight and fly from my California home to Atlantic City? This could explain “why” I was there.
- Is it lunchtime? This could explain “why” I was making this transaction.
- Is my stomach growling? This could indicate that I am hungry, and could explain “why” I was at such a fine food establishment.
Admittedly, employing data warehousing and artificial intelligence to use the “why” factor to authenticate a small fast food purchase is overkill, just like it’s overkill to require three biometric identifiers and a passport to open a physical mailbox.
But perhaps use of such an authentication factor would be appropriate at a critical infrastructure facility such as a nuclear power plant.
Assume for the moment that I am a double agent, employed the the U.S. Department of Energy but secretly a spy for an enemy country. All of the five authentication factors check out, and I am the person who is authorized to visit a particular nuclear power plant.
But why am I there?
Am I there for some regular U.S. Department of Energy business that is totally above board?
Or am I there for some other unknown reason, such as theft of secrets or even sabotage?
How to implement the “why?” authentication factor
I believe that a “why?” authentication factor could be very powerful, but it would take some effort to implement it.
First, the authentication system would have to access all the relevant data. In the McDonald’s example above, that includes (a) my flight data, (b) the time of day, and (c) my health data (“biometrics” in the broader sense). In the nuclear power plant example, the authentication system would have to know things such as nuclear power plant inspection schedules, trip authorizations from my supervisor, and other data that would indicate a reason for me to be at the plant. That’s a lot of data.
Second, the authentication system would have to process all the relevant data to glean knowledge from it. By itself, the data points “United Flight 123 from Ontario to Atlantic City yesterday,” “1:30 pm,” and “haven’t eaten in six hours” do not allow the system to make an authentication decision.
Third, the authentication system would have to collect and protect that mass of data in a way that protects my privacy and the privacy of others. In the United States at present, this is where the whole system would probably fall apart. While a whole bunch of data is collected about us and placed in silos (the TSA-airline silo, for example), putting it all together could be pretty scary to some. Although certain lawyers in Illinois would love the moneymaking opportunities that such a system could provide via Illinois Biometric Information Privacy Act lawsuits.
So a complete implementation of the “why” authentication factor is probably impossible for now, due to both technical and societal constraints.
But is it possible to implement a subset of the “why” authentication factor? For example, since a company presumably has access to employee corporate travel schedules, could the company use the knowledge of an employee’s flight from Chicago to Los Angeles on Sunday to provide the employee with physical access to the firm’s Southern California office on Monday?
Something to think about.
Maybe I should speak to a patent attorney.
Remember the newer factors of authentication
Sometimes our mental horizons are limited, and we fail to notice things just outside of our sphere of vision. And when we ignore these things, we may receive nasty surprises.
The first step in competitive analysis is to identify your competitors. Some companies utterly fail at this by declaring, “We have no competitors.” (Voiceover: “You do.”) But even those companies that successfully identify their competitors do not always identify ALL of them.
For example, if you owned a taxicab company circa 2008, you might count other taxicab companies and buses as competitors, but you might not include the possibility of a competitor raising over $25 billion to create an infrastructure that allowed people to use their own cars to pick up people who needed rides. Of course, Uber and other companies did just that, while at the same time dodging taxicab industry regulations that mandated purchase of medallions. The rideshare companies weren’t always successful at dodging these regulations, but sometimes they were. As a result, by 2015 the taxicab industry was dying.
This is just one of many examples of competitors that seemingly arise out of nowhere and decimate existing businesses.
One biometric modality for authentication
When considering authentication of individuals, we sometimes fail to, um, identify ALL the ways in which individuals can be identified.
When I entered the biometric industry in the mid-1990s, people were individually identified by something they had (such as a credit card), something they knew (such as a personal identification number or PIN associated with the credit card), and with a rudimentary form of something they were (a signature that matched the signature on the back of the credit card).
My employer and two other companies thought that we had a better solution than the rudimentary signature verification check—fingerprints. All three companies proposed solutions in which welfare benefit recipients would use fingerprints to authenticate themselves as the persons entitled to the welfare benefits. (Another ramification: the fingerprints could also be used to confirm that people weren’t receiving benefits under multiple names.) But in those pre-iPhone days signatures were associated with law enforcement, and benefit recipients feared that the benefit agencies would forward their fingerprints to the cops, and the use of fingerprints by welfare benefits agencies decreased.
But many people still felt that fingerprints could be used to identify individuals, and therefore people began to look at the fingerprint industry and identify competitors in that industry. Around 2000, those competitors included Cogent, Morpho, NEC, Printrak, livescan companies such as Digital Biometrics and Identix, and a few others.
But fingerprints aren’t the only biometric modality, and there were other competitors outside of the fingerprint companies.
Multiple biometric modalities for authentication
By the early 2000s, other biometric modalities matured enough to be used for authentication purposes. Faces were tested for identification of people at Super Bowl XXXV. Irises began to be used for authentication at airports in Amsterdam (and elsewhere) in 2001, although they were cumbersome to capture. Individuals could eventually be identified via their voices.
All of these different biometric modalities got people excited. Some people, um, “advanced” the notion that biometrics (something you are) was THE way to identify people, and that passwords were of necessity going to die. Bill Gates predicted the death of the password in 2004, but he wasn’t (and isn’t) the only one to assert this view. Some assert that biometrics are clearly better than passwords. Opponents, however, objected to a reliance on only biometrics because of the ability to spoof biometrics, and because of perceived and actual racial disparities. (See my comments on faulty conclusions, and on the racist methods that people use when they DON’T use computerized facial recognition.)
Multiple factors of authentication
The solution, as many people recognized, was to use multiple factors of authentication, not just “something you are” (biometrics).
Why multiple factors? Because if you use multiple methods to identify an individual, the ability to fraudulently impersonate an individual decreases rapidly.
Even if someone spoofed your fingerprint or face, it would be much harder for them to spoof your fingerprint/face and your driver’s license, or your fingerprint/face and your driver’s license and your password.
The National Institute of Standards and Technology (NIST) has helpfully defined the term multi-factor authentication, or MFA, for standardized U.S. government use.
Authentication using two or more factors to achieve authentication. Factors include: (i) something you know (e.g. password/personal identification number (PIN)); (ii) something you have (e.g., cryptographic identification device, token); or (iii) something you are (e.g., biometric). See authenticator.
From https://csrc.nist.gov/glossary/term/Multi_Factor_Authentication
Source(s):
CNSSI 4009-2015 under multifactor authentication from NIST SP 800-53 Rev. 4
But are three factors of authentication enough?
Sometimes the government moves more slowly than the industry. This is one of those times.
While NIST only discusses the three factors of something you know, have, and are as factors of authentication, other sources identify two additional factors. I personally use a model which includes five authentication factors, in which the other two factors are “something you do” and “somewhere you are.”
Let me illustrate how the fifth authentication factor could have helped me out several years ago.
In mid-2009, roughly fifteen years after joining the biometric industry, I had just become an employee of the new company MorphoTrak, but had not yet shifted from product management to proposals. MorphoTrak still operated as two separate divisions, and an opportunity arose for me to demonstrate a product from the Printrak division to customers of the Morpho division.
So I, along with a Metro ID demonstration system, flew to Atlantic City, New Jersey to attend a trade show which would have many attendees from New Jersey, a Morpho customer. Theoretically, local New Jersey agencies could buy Metro ID and submit results from that system to the New Jersey MetaMorpho system.
I had just acquired a new credit card for business purposes, which I would use for the first time at the trade show.
When I first tried to use the card, it was declined.
Look at it from the credit card issuer’s perspective:
- Someone had just received a credit card, which had never been used.
- The first time that someone tried to use the credit card, it was used thousands of miles from the California location where the customer lived and worked.
- Sure the transaction was for a low dollar amount (I think I was at a McDonald’s), but there’s always the danger that if that transaction were approved, the user would next walk a few blocks to a casino and withdraw thousands of dollars.
- Because this seems suspicious, we’d better check it out before approving any transactions. Maybe the card was stolen.
So the credit card company had to verify that the use in Atlantic City was legitimate. To do so, they called my house in California.
Which ordinarily would be fine, but I was not at my house in California. I was in Atlantic City.
Eventually, everything worked out, but wouldn’t it be nice if the credit card company realized that not only did
- the person using John Bredehoft’s credit card actually have possession of the card, and that
- the person using John Bredehoft’s credit card knew the PIN associated with the card, but also that
- John Bredehoft was physically in Atlantic City, New Jersey, where the card was being used?
Now you can see how “somewhere you are,” or geolocation, could be used as an identifier. Of course this would be very hard to authenticate in 1994, and wasn’t even a common authenticator in 2009, but clearly in 2022 everyone can figure out where you are.
Incognia and (not) zero factor authentication
Enter Incognia, a company that states that is offers an identification solution that uses what they call “zero factor authentication.” Tyler Choi of Biometric Update explains why Incognia’s solution is important:
Incognia points to an increase in revenue and activity across apps in financial services, crypto, social networks, and online gaming, which accentuates the need for fraud prevention.
From https://www.biometricupdate.com/202203/incognia-adds-location-fraud-detection-to-mobile-onboarding-and-authentication
While I have a problem with the “zero authentication factor” / “0FA” semantics Incognia uses (location IS an authentication factor, at least in my model), I can appreciate what the company does.
Incognia’s award-winning location identity technology is highly resistant to location spoofing and offers superior location precision for accurate fraud detection on mobile with very low false-positive rates. Incognia uses network, location, and device intelligence data to silently recognize trusted users based on their unique behavior patterns….
Incognia’s location technology uses data from not only GPS, but also WiFi, cellular and Bluetooth sensors, which makes it highly effective at detecting location spoofing, unlike fraud detection based on IP and GPS alone.
From https://www.incognia.com/location-behavioral-analytics?hsLang=en
Incognia asserts that the vast majority of transactions can be authenticated based on location alone. For example, if I perform a transaction when at my house, the chance is high that I am truly the person performing the transaction.
But what if I perform a transaction on the other side of the country, in a location that I have never visited before? Then Incognia uses additional factors of authentication to verify my identity.
For example, I could provide the password or a biometric identifier. The very fact that I possess a phone that was previously associated with me is another indicator that I may be who I say I am.
But we’re not really using geolocation yet
However, geolocation is not commonly used as an authentication factor, something that I subsequently discovered several years after my trip to Atlantic City.
By this time I had acquired another credit card for business purposes, and my credit card provider noticed some strange behavior. Not a single attempt to purchase food across the country at a restaurant in New Jersey, but multiple repeated purchases across the country at a store in Virginia.
The credit card provider got suspicious when the person made repeated small balance purchases at the same store, and froze the account until it could check with me to see if those purchases were legitimate. This time I was home in California and was able to confirm that the purchases were fraudulent.
Of course, the credit card provider could have detected this much more quickly if it knew that I was not in Virginia, but California.
So when you perform competitive analysis on authentication companies, don’t forget about competitors that use geolocation.
Bredemarket 
