I ran into this site today and am happy to see how Josh has offered a listing of sites, across multiple verticals, who have and have not embraced Multi-Factor Authentication.
What the primary factor is, is the key to the strength of authentication.
“What You Know” could be extremely secure, except we depend on the human to make sure they protect it, make it unique and complex.
“What You Are” can only be as secure as the quality and accuracy of the sensors and the algorithms used to match what is sensed now to what was registered then.
For me a “Restricted Operating Environment” capable of securing secret and private KEYS and use them to securely performing cryptographic functions, be they Symmetric and / or Asymmetric is the primary factor. The DEVICE(s) we use to access the service provided by the relying party simply needs to be registered, recognized and therefore the UNIQUE “What We Have” factor.
If we know the device is UNIQUE. Then the only outstanding question is, is the registered user using it, while not under duress. If the relying party is not comfortable with the presence of the registered user, then the Relying Party needs an additional factor to assure presence. Be it the “What You Know” and / or “What You Are” one adds to assure presence during the transaction or the authentication dialogue.
If the Relying party is comfortable the registered user is using their registered device, why add friction?
Prevention is what we need to focus on. Lock the door with strong keys . Detection is after the fact and necessary. Investigation helps to punish the evil doer and improve the quality of security.
We need to focus on making sure the methods used to allow someone onto the relying parties website or when they execute a transaction. Like in the physical world, it is about making sure the user’s KEY is unique and the right individual is in possession of the the key.
In other words. The user is present using a registered and recognized device.