Comparing PhoneFactor to Smart Cards

Evaluating two-factor authentication solutions requires a look at three critical areas – the security and scalability of the technology, hurdles to user adoption, and the total cost (including internal costs) to deploy and support the system. Below is an analysis of smart card authentication systems and PhoneFactor’s phone authentication solution.

Smart Cards

Another common two-factor authentication solution involves the use of smart cards. Smart cards are credit card-sized tokens that have an embedded private key that is protected by a PIN or password. This private key positively identifies the user to the system. Like security tokens, users are required to carry around a new object that they didn’t have before. Cards must be provisioned, mailed, inventoried, replaced, and so on, creating similar logistical problems. And, since very few computers have built-in smartcard readers, an additional piece of hardware, together with drivers (and associated platform dependencies), must be distributed to users. This creates a single channel of communication, making it vulnerable to emerging threats, such as man-in-the-middle attacks.

Smart cards present lockout risks – most cards deactivate themselves after a certain number of failed attempts, and require physical replacement – leading to increased IT management time – and in most cases require regular updating to stay current. Finally, few applications have native support for smartcard technology, and those that do often have narrow support for operating system versions, card reader models, and so on. Adding smart card support to applications is often difficult.

PhoneFactor Phone Authentication

PhoneFactor’s phone-based two-factor authentication service offers a greater level of security and a better user experience than soft tokens. And, it’s significantly less expensive to deploy and maintain. For more information try the PhoneFactor Demo or Download the Free Version.