www.BrettDaniel.com

Two-Factor Authentication using OpenID and a Mobile Device

Two-factor authentication is a security procedure that verifies a user's identity using two pieces of information: one that a person knows (such as a secret password) and another provided by something he or she has (such as an ID card). Recently, VeriSign released an an iPhone application that provides a one-time password, enabling two-factor authentication on "40 web sites that are part of the VIP Network, including eBay, PayPal and AOL".

Two-factor authentication using a mobile device is an excellent idea. People rarely leave the house without their mobile phone, and as smart phones become more widespread, such an application could remove the need for easily-misplaced security tokens. But why just 40 websites? What the press release does not mention is that since VeriSign is an OpenID identity provider, the iPhone application can provide two-factor authentication for any site that accepts an OpenID login.

Fortunately, there is no reason why this kind of two-factor authentication must be tied to VeriSign. MyOpenID provides a service called CallVerifID that verifies identity with a call to one's mobile phone. The only thing still missing (as far as I am aware) is an open-source implementation independent of any third-party service.

Therefore, I make the following request to the LazyWeb. I use phpMyID on this website, making it my OpenID identity provider. It should be possible to make this simple application accept a second authentication factor provided by a mobile phone application. Any takers?

No Comments

Comments are closed.











He will find business process software on this site. | ear is ringing