Stop Counting Factors... Start Describing Authentication Events
summary
Argues that counting “factors” is misleading and proposes describing authentication as events using seven credential-management properties (boundary, recovery, containment/unlock, reuse, enrollment, provider provenance, compliance) embodied in a draft v0.1 and example taxonomy. Traces tools and history from the 1966 ATM patent through HOTP/TOTP, SMS OTP, WebAuthn and synced passkeys; shows hardware roots (TPM/SE) and attestation/MDS for provider provenance. Highlights four boundary attributes—transference, exportability, binding, boundary enforcement—and notes a working draft exists but the model is not finalized.
AI-written summary · about
chapters (7)
- 0:00Introductions and thesis
- 1:30Critique of authentication
- 5:23History of multi-factor
- 11:14A call to action
- 11:27Defining credential properties
- 25:07Future directions and goals
- 27:00Q&A session
related talks
27mSecure Authentication without the Need for Passwords
47mThe Psychology of Multi-Factor Authentication
19mAdvanced Authentication Framework
47mPatterns of Authentication and Self-Announcement in IoT
30mInsecurity protocols: an overview of modern authentication
27mManaging a State of Distrust
26mHolistic Authentication
31mAuthentication/Authorization Starters Battle