1.5 Factor authentication


Some of us were discussing SSL over the internet access to a web resource.  We discussed complex passwords for auth worst case and RSA best case.  One of the guys brought up 1.5 factor authentication.  I assumed this meant password plus something (maybe a cert) ?  I had never heard of this term.  Googled it and even binged it, and neither one had any results.  Does anyone have experience with this term ?

Who is Participating?

[Product update] Infrastructure Analysis Tool is now available with Business Accounts.Learn More

I wear a lot of hats...

"The solutions and answers provided on Experts Exchange have been extremely helpful to me over the last few years. I wear a lot of hats - Developer, Database Administrator, Help Desk, etc., so I know a lot of things but not a lot about one thing. Experts Exchange gives me answers from people who do know a lot about one thing, in a easy to use platform." -Todd S.

Dave HoweSoftware and Hardware EngineerCommented:
Sure. it exists for solutions where the secondary factor can be derived from the traffic - One example would be this:


With this method, the user selects digits from the image based on a known secret (a pin, effectively) and enters them, along with their regular username/password pair.

Assuming an attacker could intercept and decode the traffic (difficult; this is ssl encrypted; a screenshot and keylogger combo would work though) they could derive the secret used to select digits from the choice of digits made; however, just a straight keylogger or straight screenshot would not do, as you would need both the image and the entered (selected) digits.

Hence, this is *almost* two factor; not quite a one-shot password, but more secure than a static password that a keylogger could capture.

Experts Exchange Solution brought to you by

Your issues matter to us.

Facing a tech roadblock? Get the help and guidance you need from experienced professionals who care. Ask your question anytime, anywhere, with no hassle.

Start your 7-day free trial
Elemental12Author Commented:
Perfect answer and example, thank you so much.
It's more than this solution.Get answers and train to solve all your tech problems - anytime, anywhere.Try it for free Edge Out The Competitionfor your dream job with proven skills and certifications.Get started today Stand Outas the employee with proven skills.Start learning today for free Move Your Career Forwardwith certification training in the latest technologies.Start your trial today
Printers and Scanners

From novice to tech pro — start learning today.