Duo idpv3.1

[Cantor, Scott]

On 3/18/15, 12:50 PM, "Randy Wiemer" <wiemerr at hotmail.com> wrote:

>Help me understand why you distinguish a series of dependent sequential authentications from multi-factor authentication.

Because the only thing connecting those sequential steps is a separate piece of code unrelated to the actual solutions that is imposing an association around the steps. By themselves, they are not sequential anything, they're discrete.

> 
>I think DUO and Microsoft's MFA solutions are better than RSA SecureID and similar products because they use a separate communication channel.

I think neither is itself such a solution. They have one channel. The application is turning them into two or three. Whether that's better or worse given the need to keep supporting passwords, for example, is a subjective question, but my point wasn't whether a deployment of the whole mess would be MFA, it's whether the single technology is by itself. I just think it's apples and oranges, and I think it's done for marketing and FUD reasons, not technical accuracy.

> 
>I think all three approaches qualify as strong, multi-factor authentication technologies but you seem to disagree.

I think only SecurID is itself such a technology in its own right. The others are SFA building blocks. I think it's relevant that SecurID works with zero extra effort with just about any IdP-like thing, and the others don't. That has value to me, particularly when I'm not the only one who's going to end up doing the integration. It's fine for me to cobble together separate solutions, but asking lots of people on my campus to is a different thing.

-- Scott