In a computer based system, the most common form of authentication is a password. A secret combination of letters, numbers, and special characters that is known only to the person who is the owner of the account. If the correct password is entered, access is granted. If the password entered is incorrect, access is not provided.
What if the password gets stolen? How do we stop the thief? That way is known as two factor authentication. In this method, along with the password, something more needs to be entered. The most common methods are :
OTP (one time password) provided to a mobile phone
These days everbody has a mobile phone. A four digit or six digit number is generated and sent to the user's mobile phone via a SMS (Short Messaging Service). It is valid for a certain duration of time, say five minutes. The user looks at the number received in their mobile phone and enters the number along with the password. For this method to be used, every user must posess a mobile phone, and the mobile phone must be in the vicinity of a valid mobile network.
Using a hardware or software token
A small device is given to each user of the system. The device dispays a token, typically a six digit number, which keeps on changing after a certain time duration. The person enters the token along with the password. The risk here is of losing the device. And what if the device gets stolen by a thief who has stolen the password of that user.
A software token is generated via an app in the mobile phone of the user.
A device is required for the schemes of OTP via SMS and the token via hardware or software. If two factor authentication needs to be implemented without an additional device, here is how.
Image based two factor authentication
A image is generated with a few characters, numbers, or a combination of characters and numbers is embedded in various colours, fonts, and sizes. The user has to visually look at the image, identify the text embedded in it, and enter it along with the password. Way back in 2020 when I was learning the Python programming language, I wrote a Python program to generate CAPTCHA. Here it is.
Sound based two factor authentication
A sound file is generated and presented to the user. When user plays the sound file, whatever they hear is the password.
Before the advent of Artificial Intelligence (AI), the image based and sound based methods were good enough. Now in the world with AI, the agents or robots may read the image and may hear the sounds. They may identify what input needs to be entered.
So how could we implement a non-device based two factor authentication which could not be hacked by the AI agents. What if we make an image that shows "2 + 5 =" and the user is expected to solve the mathematical question and enter the answer. This way we could avoid the AI agent today but one day the AI agents would figure out the trick.
Is there a method that the AI agents can't break? And cost-effective, and device-free? Here is one.
When a new user is registered in the system, they are asked to set a password. At the same time the user is asked to choose a theme out of the themes presented. The themes could be :
- numeric day of the month
- numeric day of the week
- first alphabet of the day of the month
- first alphabet of the day of the week
- a combination of numeric day of the month and first alphabet of the day of the week
Let's say a user chooses the theme of "numeric day of the month". Then at the time of entering the password for authentication, the numeric day of the month has to be entered after the password. The user must remember the chosen theme and follow it. Apart from the five themes listed above, some more themes could be implemented as well, depending on the level of complexity that we need to have.
Another choice presented to the user could be:
- Whether the chosen theme should be input after the password
- Whether the chosen theme should be input before the password
So, the level of complexity could be as per the requirements of the system.
The merits of this scheme are :
- Easy to implement
- No need of app or device or mobile
- AI agents can't break this scheme, unless the user publicly announces what theme they are using and the AI agents read that
The drawbacks of this theme are :
- User must remember the chosen theme
- External factors such as change of time-zone or in-travel users may affect the result
- Given enough resources, a brute force attack may eventually break the password
What do you think of this proposition? Would you use a theme-based two factor authentication? Let me know your thoughts and opinions.
No comments:
Post a Comment