Identity and Factors: Part 2
Hey friends, let's talk about secure lifestyle. In my last post I discussed identifying yourself for access to things (authentication) and the three types of factors presented as identity. This post is going to cover how those factors differ and why it matters. For the purpose of this post, I'm only going to consider systems that require a single factor as identification: Logging into a forum with your password or getting into your house with your key, for instance. Combining factors will be covered in the next post.
First, consider something you know. This is usually a password of some kind, and these factors have many advantages. When used correctly (i.e. not written down), they're impossible to steal since they're only in your head. If for some reason your password becomes insecure (maybe you shared it with someone who doesn't like you anymore), it's easily changed as long as you control that account. The major disadvantage of something you know is that if it's discovered, it's very easy to spread, and anyone from anywhere can use it. For that reason, you want to make your passwords as secure as possible, though that's a topic for another time.
Second, consider something you have. This is usually a key or your phone, and it's a bit more difficult to see the utility of using this factor online. If you've had to log into a service that sent a code to your phone in order to log in, then you've used this factor: Unless someone has your phone, they're not getting into your account. That seems inherently less secure since your phone can be stolen or misplaced, but there's a major advantage -- Things you have are physical objects that can only be used where they are. Someone in Russia can't use your key to open a door since your key is safe in your pocket. Things you have can also be replaced if compromised (e.g. if someone copies your key), though not as easily as with something you know.
Third, consider something you are. This is usually your fingerprint, though sci-fi has entertained the idea of retinal scans for decades. This factor is deceptive: It seems like the ultimate form of security, since no-one else has your features. However, this simply isn't true. Most people have many pictures of themselves online, your fingerprints are likely in government databases, and lots of personal information is collected by your employer. Most importantly, if your personal data is compromised (e.g. someone swipes your fingerprint data), it can't be replaced -- That data is permanently insecure.
It's also important to consider the legal implications of these three types of factors. Legally, something you know is the most secure since the 5th Amendment protects you from self-incrimination. If someone is accusing you of a crime and is suing you to get access to your phone for evidence, they're out of luck if your phone is password protected since you don't have to divulge your password. Something you have can be seized with the right search warrant, so they may not give you much protection in that situation. Legally, anything you are is public, so you can be compelled to provide your fingerprint to unlock a phone. You might say this is paranoid since you trust the government and don't have anything to hide, but remember that companies and private citizens can bring lawsuits against you too, so there's no reason not to use the best security practices.
If you only take away one thing from this discussion, it should be this: Never use something you are as the only factor protecting anything. Don't lock your phone with your fingerprint! Also, a quick disclaimer that I am not a lawyer, and the brief discussion of legal implications isn't legal advice. If you're curious about the legal implications, then the ACLU and EFF are great places to start for that information. If you actually need legal advice on these matters, get a lawyer!
















