Different techniques to secure digital devices and networks have been implemented by stakeholders in the digital world. To avoid unauthorized cyber access users can be exposed to, authentication forms such as username and password to verify a user’s claim of identity are used, which is the most common form of authentication according to the European Union Agency for Cybersecurity (ENISA).
Authentication of users can be online or offline; however, factors such as availability of internet access and level of security determine whether online or offline, or a combination of both, can effectively serve users.
Offline authentication validates identity without the need for internet access, with common examples such as offline POS terminals and USSD transactions. This can take the form of a username and password, offline biometrics, Short Message Service (SMS)/Voice One-Time Password (OTP) and Time-Based One-Time Password (TOTP) for authentication.
Despite an increase in global access to the internet, offline authentication usage is still dominant and will continue to develop in the future. This stems from the fact that internet connectivity is not available in all places, and its poor condition or outages cannot be avoided in some cases. Beneficiaries of offline authentication are not limited to travellers, tourists, or people in remote locations.
On the other hand, authentication requiring internet access is more common nowadays, which cuts across email and social media OTP, online biometric authentication, push notifications, and Quick Response (QR) codes. Secure protocols and algorithms to validate users, more reliability, sophisticated policies, and multiple ways of validation are grounds that make online-based authentication preferable. The users in this category are web surfers, especially those requiring access to their financial institutions through Internet banking, with a study from Juniper Research stating that digital banking service access will rise to 53% of the world population in 2026.
Requiring at least two different identity verification methods from a user can reduce the potential risk of security breaches. Digital identities verified in one way are technically referred to as Single-Factor Authentication (SFA). SFA uses only one verifiable proof of identity to secure access to a digital system or network, which does not mean it is less secure, but a single compromise in it can be dangerous in cases where a high level of security is important.
Increasing the level of security is why a Two-Factor Authentication (2FA) is in place. It relies on the combination of two independent elements to confirm the user’s identity. To satisfy a higher level of security, the implementation of Multi-Factor Authentication (MFA) is needed, which successfully employs multiple ways, with the minimum being two, as a subset of “multi”.
Multi-factor authentication can take the form of a combination of at least two of the following elements:
- knowledge: what you know, such as password, security questions, and Personal Identification Number (PIN).
- Possession: what you have. An example is your smartphone.
- Inherence: what you are or what is specific to you, which includes your biometrics and typing speed.
- Location: where you are at a point in time, such as workplace premises.
Accessing financial institutions through credit or debit cards requires possession and knowledge. The first is the possession of the card as the first factor, while the second factor is the card pin. The absence of any of these two invalidates the proof of identity of a user attempting to access his or her financial institution. This implies that on several occasions in a day, multi-level digital identity validation occurs for an individual. Social media platforms and other internet communication tools also have Multi-Factor Authentication to protect their users from cyberattacks. This works in favour of internet users today, protecting their digital identities while allowing them to securely log in and out of different devices with configurable synchronization of their activities.
The purpose of authentication in cyberspace is to prevent unauthorized access, protect sensitive information, and defend against identity theft, while multi-factor authentication in particular adds extra thrust through multiple layers of security and improves users’ trust.
In the face of the realistic benefits of authentication in general, there are some issues, risks, and problems associated with Single-Factor Authentication and Multi-Factor Authentication. A Single-Factor Authentication could lead to a temporary or permanent loss of access in the event of a lost factor or an exposed factor. Alternatively, Multi-Factor Authentication takes a longer time to set up and log in, which poses an inconvenience to some users and could cost more than usual due to difficulties in the linking and confirmation of one of the authentication techniques. Lack of access to one of the factors of authentication at a point in time means the user is successfully denied entry due to incomplete identity verification. Hacking can lead to leakage of information or unauthorized access to one of the factors of authentication, thereby exposing the credentials of the factors or locking out the real user.
It is worth to note that the Cybersecurity and Infrastructure Agency (CISA), America’s Cyber Defense Agency, has added Single-Factor Authentication to its record of bad cybersecurity practices. In addition, Multi-Factor Authentication usage is recommended by the agency and explained to take responsibility for issues that might arise from Single-Factor Authentication.
Wasiu Adeleke
