Verizon enabling QR codes, smart phones for two-factor authentication
26 August, 2014
category: Corporate, Digital ID, Financial
When it comes to online identity, the ultimate goal is to conduct secure authentication without having to make the user jump through more hoops. Security providers also want to do this in a way where it would be usable to the masses and easy for companies to deploy.
Verizon Enterprise Solutions is hoping to enable this with its latest update to the Universal Identity Service, says Tracy Hulver, chief identity strategist for the company. Using a second factor of authentication – be it a physical token or an app on a smart phone – has been a popular option but it adds a certain level of complexity to the logging on. Two-factor authentication can stop username and password breaches but voluntary adoption is in the single digits but users don’t want additional steps to gain access to their data.
This latest update from Verizon has a user scan a QR code on a Web site for access. The user downloads the app on to their smart device. When they visit the site on a laptop or computer a QR code appear along with the typical username and password boxes. But instead of entering the information the user opens the app on the handset, scans the code and is logged on to the site.
Depending on different variables – has the computer access the site before, IP address, transaction type etc. – the system might prompt for additional authentication. “The system has the ability for relying parties to determine how secure they want it to be,” Hulver says.
Verizon also has plans to put some levels of assurance behind the identities as well, Hulver says. Eventually the plan is to enroll everyone buying a Verizon phone into the Universal Identity System when they are at the store. Then consumers would be able to use that vetted identity with some assurance at sites that have deployed Universal Identity Systems.
For those without Verizon, relying parties that choose to use the system will use knowledge-based authentication to get some level of assurance about users. But since vetted by one relying party that identity would be able to be used at other sites that use Verizon’s system, Hulver says.
Some enterprise clients are using the system and Verizon expects it to roll out in the business-to-consumer market after the first of the year.
