Hacker Timesnew | past | comments | ask | show | jobs | submitlogin

Proper Security: Something you have and something you know.


Since they tell you the PIN at the point of use when you present the bar code, the PIN is not "something you know" from a security point of view.

Two factor authentication requires that you have two separate items of evidence to attest to your identity. The PIN in the Amazon system as described in the article is just evidence that you knew the bar code, not evidence as to who you are, so their system is just one factor.

A good way to think about it when considering a purported two factor system is to ask how many things a bad guy has to steal to impersonate you. In a two factor system, he should have to steal two things.




Guidelines | FAQ | Lists | API | Security | Legal | Apply to YC | Contact

Search: