Comparing PhoneFactor to Soft Tokens

Evaluating two-factor authentication solutions requires a look at three critical areas – the security and scalability of the technology, hurdles to user adoption, and the total cost (including internal costs) to deploy and support the system. Below is an analysis of soft token authentication systems and PhoneFactor’s phone authentication solution.

Soft Tokens

Like a hardware security token, soft tokens, soft tokens rely on a One Time Password as the second factor of authentication. A piece of software is installed on the end user’s desktop computer, laptop, PDA, or mobile phone, which generates an OTP. Software tokens do not require a physical device be deployed to users, so hard costs are less than hardware security tokens, but supporting installation and use of the soft token application on the end user’s device can result in significant internal support costs.

Soft tokens do not protect against emerging threats, such as man-in-the-middle attacks. As the sophistication of attacks continues to increase, out-of-band authentication, which utilizes a separate channel for the second factor of authentication, is becoming widely recognized as a best practice for two-factor authentication. Any method that requires an OTP be keyed into the original login interface, does not meet the criteria for out-of-band authentication and as such are vulnerable to attack.

If the software token is installed on a user’s PC, they must have access to the PC in order to retrieve the OTP. This might not be the case is a user was logging in from a kiosk, mobile phone or other device.

Technology	Two-factor, typically across a single channel Integrates with a wide range of applications
User Adoption	User must install a software on their PC or mobile phone Access to the device where the software is installed is required
Cost	Implementation costs, then relatively low per user cost Software set up and configuration High internal deployment and ongoing support costs

PhoneFactor Phone Authentication

PhoneFactor also leverages an existing device, a user’s phone, for two-factor authentication. However, it does so using an out-of-band architecture that protects against even the most sophisticated attacks. PhoneFactor provides three easy options for phone-based authentication (phone call, text message, and phone app) – all with the same level of out-of-band security.

By combining out-of-band authentication with real-time fraud alerts, PhoneFactor offers unparalleled protection from malware and man-in-the-middle attacks. PhoneFactor can also be used to verify specific high-risk transactions, so even if the user’s authenticated session has been hijacked, their transactions are protected. Not only does PhoneFactor prevent unauthorized logins and transactions, it notifies you instantly if a user’s credentials have been compromised and an attack is in progress. No other two-factor solution is capable of providing this level of real-time threat detection.

PhoneFactor does not require any changes to the user interface and no extra devices for users to carry and keep track of, so little end user training is required. The phone is an inherently user-friendly device and is accessible for users with disabilities.

PhoneFactor requires very little effort to implement and virtually no ongoing support. It offers instant integration with all leading business systems and synchronizes with AD and LDAP Servers for centralized user management. Easy, automated self-service options are available through the phone and web, which helps to significantly minimize overhead.

Technology	Out-of-band authentication with live fraud alerts Instant integration with leading enterprise systems Web plug-ins integrate with existing websites and online transaction processes User enrollment and self-service tools keep overhead low
User Adoption	Flexible authentication options – voice call, SMS text message, and phone app No changes to the user login experience No security tokens or extra devices to keep track of
Cost	Low annual fee per user or per auth No hardware to purchase or install High internal deployment and ongoing support costs

PhoneFactor’s phone-based two-factor authentication service offers a greater level of security and a better user experience than software and hardware security. And, it’s significantly less expensive to deploy and maintain. For more information try the PhoneFactor Demo or Download the Free Version.