Hi Eve, great topic.  On the biometric front, these are usually additional factors and biometrics alone does really support 2F.  Most often its combined with possession (e.g. a smart card, secure element, device (phone or computer).

If you are going to talk about Fingerprint authentication, you should cover some mention of privacy aspects. For example, there are certain birth defects that can show up in a fingerprint.

Jumping beyond the methods, there are more secure ways of handling fingerprints and less secure ways that are important for people to understand. So a deeper dive in terms of published research would be beneficial.

I hope that you will take this discussion into some new territory.

For example, not all forms of out-of-bound authentication are created equal.  Consider SMS and dial-back. The security of SMS is based on the security of the carrier's network and the security of their user's accounts, both of which are very questionable.  In fact, carriers are disincented to increase the security of their user's acounts.  The cost for password resets would sky rocket.  A dial-back system from an authentication provider would have it's incentives aligned.  However, the vendor is still in the middle and should be part of the risk landscape.  This may be fine for most companies, but many were surprised to find RSA in the middle of their authentication systems.

I would also like to see the issues with biometrics addressed.  Secrets are only useful for authentication if they can be changed.  Biometrics can't be changed. If my fingerprint is compromised (and it is because it is everywhere) and you use a fingerprint system, how will you accomodate me?  Once a database with my iris scan is compromised, how will you accomadate those users? Biometrics may have their place, but I find it hard to see where they could not be replaced by something simpler and less expensive.

HTH,

Nick

Under the category of out-of-band, dynamic secret 2FA, I would like to propose the following type of image-based approach be included:

As a second layer of authentication, it requires the user to apply a shared secret on the second factor device itself (the user must identify which pictures match their secret categories by tapping the appropriate pictures on the smartphone display). Therefore, it is a multi-layered, multifactor solution (requiring something the user knows on something the user has). As the user identifies the correct pictures on the mobile device, the mobile application communicates directly back to the business’ servers, thus it remains completely out-of-band from the web session.

Because the user must have knowledge of their secret categories, it is more secure than sending an authentication code in plain text as an SMS message (which someone else could read and use to fraudulently authenticationif they stole your phone or if they use a Zeus-in-the-mobile attack to intercept authentication text messages). Even if someone else has possession of your phone (through loss or theft) or if they were using Zeus malware to intercept communication and steal data, they would not be able to complete the authentication because they would see the image grid but they would not know which images to select. The images are different every time and generate a one-time authentication code (OTP) but the user only has to remember their few secret categories and look for the pictures that match their categories.

Here's an example on an iPhone:

As a side note, are you considering covering how one would provide strong, multifactor authentication to a user who is browsing to the website from their mobile phone? In this scenario, common two-factor solutions (such as sending an OTP to the phone by SMS) would no longer be considered an out-of-band, two-factor approach. As people increasingly use their smartphones as their primary devices for browsing the web, websites will need to have a mutilayered, multifactor solution to provide strong security.