News for hackers. Stuff that matters.
Re:YubiKey comes to the iPhone with Mobile SDK for iOS and L... by zaroth on Tuesday May 22, 2018 @11:52AM (#17126850)
Regardless of what screen you are authenticating on, a key stored on the iPhone secure element can always be considered to be a factor in the authentication process.

If are logging into a site on your mobile device, and part of the authentication verifies your password and another part verifies that you are in fact on your mobile (e.g. verifying a signature of a private key stored on the device) I would still call that multi-factor authentication.

Optionally, there may be a user prompt on the device before allowing the signature.

Optionally, the user prompt could also require a local biometric authentication (3rd factor).

Or there could be no prompt at all — just a automatic handshake proving it is the same device being used that was originally enrolled.

In any case you are constraining the authentication process to only work with access to a specific private key, hence a second factor.

There are no comments on this comment yet.