Comparison of Authentication Security Solutions

Authentication is the act of confirming the truth of an attribute of a single piece of data (a datum) claimed true by an entity. Out of different types of authentication Two-factor authentication is a technology that provides identification of users by means of the combination of two different components. There are number of Two-factor authentication and Multi-factor authentication providers around us. Multi factor authentication products can provide significant benefits to an enterprise, but the technology is complex and the tools themselves can vary greatly from provider to provider.^[1]

Threat coverage

Provider	Phishing	Malware	Password guessing	Man in the middle	Re-used password attacks	Serverside Database Breaking	Shoulder Surfing	Theft of Authenticator	OTP Interception	Side Channel vulnerabilitiess
Authenticator Plus	N/A	N/A	N/A	N/A	N/A	N/A	N/A	N/A	N/A	N/A
Authentify Inc	Yes	N/A	N/A	Yes	N/A	N/A	N/A	N/A	N/A	N/A
Authy	Yes[2]	Yes[2]	Yes}[3]	Yes[3]	N/A	N/A	N/A	N/A	N/A	N/A
Azure Multi-Factor Authentication	Yes[4]	Yes[5]	N/A	N/A	N/A	N/A	N/A	N/A	N/A	N/A
Clef	Yes[6]	N/A	Yes[6]	N/A	N/A	Yes[6]	N/A	Yes	N/A	N/A
Cognalys Inc	N/A	N/A	N/A	N/A	N/A	N/A	N/A	N/A	N/A	N/A
CryptoPhoto	Yes[7]	Yes[7]	N/A	N/A	N/A	N/A	Yes[7]	N/A	N/A	N/A
Duo Security	Yes	N/A	N/A	Yes[8]	N/A	N/A	N/A	N/A	N/A	N/A
FreeOTP	N/A	N/A	N/A	Yes	N/A	N/A	N/A	N/A	N/A	N/A
Google Authenticator	No	N/A	N/A	N/A	N/A	N/A	N/A	N/A	N/A	N/A
Latch	N/A	N/A	N/A	N/A	N/A	N/A	N/A	N/A	N/A	N/A
LaunchKey	N/A	N/A	N/A	N/A	N/A	N/A	N/A	N/A	N/A	N/A
LoginTC	Yes	N/A	N/A	Yes	N/A	N/A	N/A	N/A	N/A	N/A
MePIN	N/A	N/A	N/A	N/A	N/A	N/A	N/A	N/A	N/A	N/A
Nexmo	N/A	N/A	N/A	N/A	N/A	N/A	N/A	N/A	N/A	N/A
Ping Identity	N/A	N/A	N/A	N/A	N/A	N/A	N/A	N/A	N/A	N/A
PortalGuard	Yes[9]	N/A	N/A	Yes[9]	N/A	N/A	N/A	N/A	N/A	N/A
privacyIDEA	N/A	N/A	Yes	N/A	Yes	N/A	N/A	N/A	N/A	N/A
Protectimus	N/A	N/A	N/A	N/A	N/A	N/A	N/A	N/A	N/A	N/A
Rublon	N/A	Yes[10]	Yes[10]	N/A	N/A	N/A	N/A	N/A	N/A	N/A
SAASPASS	Yes	Yes	N/A	Yes	N/A	N/A	N/A	N/A	N/A	N/A
SAT Mobile ID	N/A	N/A	N/A	N/A	N/A	N/A	N/A	N/A	N/A	N/A
SecSign	Yes[11]	Yes[11]	Yes[11]	N/A	N/A	N/A	N/A	N/A	N/A	N/A
SecureAuth	Yes	N/A	N/A	N/A	N/A	N/A	N/A	N/A	N/A	N/A
SecurePass	N/A	N/A	N/A	N/A	N/A	N/A	N/A	N/A	N/A	N/A
SmartSign	N/A	N/A	N/A	N/A	N/A	N/A	N/A	N/A	N/A	N/A
Solidpass[12]	Yes	Yes	N/A	Yes	N/A	N/A	N/A	N/A	N/A	N/A
SyferLock GridGuard[13]	Yes	Yes	Yes	Yes	Yes	N/A	Yes	N/A	Yes	Yes
Symantec/Verisign VIP	N/A	N/A	N/A	N/A	N/A	N/A	N/A	N/A	N/A	N/A
TeleSign	Yes[14]	N/A	Yes[14]	N/A	Yes[14]	N/A	N/A	N/A	N/A	N/A
TextPower	N/A	Yes[15]	N/A	Yes[16]	N/A	N/A	N/A	N/A	N/A	N/A
Token2	N/A	N/A	N/A	N/A	N/A	N/A	N/A	N/A	N/A	N/A
Toopher	N/A	N/A	N/A	N/A	N/A	N/A	N/A	N/A	N/A	N/A
Totp.Me	N/A	N/A	N/A	N/A	N/A	N/A	N/A	N/A	N/A	N/A
Transakt	Yes[17]	Yes[17]	Yes[17]	Yes[17]	N/A	N/A	N/A	N/A	N/A	N/A
VASCO Data Security	Yes	N/A	N/A	Yes	N/A	N/A	N/A	N/A	N/A	N/A
WWPass	Yes	Yes	N/A	Yes	N/A	N/A	N/A	N/A	N/A	N/A
WiKID Systems	N/A	N/A	N/A	N/A	N/A	N/A	N/A	N/A	N/A	N/A
Yubico	Yes	Yes	N/A	Yes	N/A	N/A	N/A	N/A	N/A	N/A

Transport Methods

Provider	SMS	Phone Call	Email	Hardware token	Software implementation	Recovery method
Authenticator Plus[18]	No	No	No	No	Yes	Email
Authentify Inc[19]	Yes	Yes	No	Yes	Yes	Email
Authy[20]	Yes	Yes	No	Yes	Yes	Email[21]
Azure Multi-Factor Authentication[22]	Yes	Yes	No	No	Yes	Email
Clef[23]	No	No	No	No	Yes	Email
Cognalys Inc	No	Yes	No	No	Yes	Email
CryptoPhoto	No	No	No	No	Yes	Paper TAN
Duo Security	Yes	Yes	No	Yes	Yes	Email[21]
FreeOTP	No	No	No	No	Yes	Email
Google Authenticator	Yes	Yes	No	No	Yes	Paper TAN[21]
Latch	No	No	No	No	Yes	Email
LaunchKey	No	No	No	No	Yes	Email
LoginTC	No	No	No	No	Yes	Email
MePIN	Yes	No	No	Yes	Yes	Email
Nexmo	Yes	Yes	No	No	No	Email
Ping Identity	Yes	Yes	No	No	Yes	Email
PortalGuard	No	Yes	No	No	Yes	Email
privacyIDEA	Yes	No	Yes	Yes	Yes	Email / helpdesk
Protectimus	Yes	No	Yes	Yes	Yes	Email
Rublon	No	No	Yes	No	Yes	Email
SAASPASS	No	No	No	No	Yes	Email
SAT Mobile ID	Yes	Yes	No	Yes	Yes	Email
SecSign	No	No	No	No	Yes	Email
SecureAuth	Yes	Yes	Yes	Yes	Yes	Email
SecurePass	No	No	No	Yes	Yes	Email
SmartSign	No	No	Yes	No	Yes	Email
Solidpass[12]	Yes	No	No	Yes	Yes	Email
SyferLock GridGuard	Yes	No	Yes	No	Yes	Email
Symantec/Verisign VIP	Yes	Yes	Yes	Yes	Yes	Email
TeleSign	Yes	Yes	No	No	Yes	Email
TextPower	Yes	No	No	No	No	Email
Token2	Yes	No	No	Yes	Yes	Email
Toopher	Yes	No	No	No	Yes	Email
Totp.Me	No	No	No	No	Yes	Email
Transakt	No	No	No	No	Yes	Email
VASCO Data Security	Yes	Yes	Yes	Yes	Yes	Email
WWPass	No	No	No	Yes	Yes	Email
WiKID Systems	No	No	No	No	Yes	Email
Yubico	No	No	No	Yes	Yes	Email

Feature Support

Provider	TOTP	EOTP	Mutual authentication	PIN protection	Biometrics	Separate Channel	Scalability	Transaction Signing	Coverage	Revocation
Authenticator Plus	Yes	N/A	N/A	Yes	N/A	N/A	N/A	N/A	N/A	N/A
Authentify Inc	N/A	N/A	N/A	N/A	N/A	Yes	N/A	Yes	N/A	N/A
Authy	Yes	N/A	N/A	N/A	Yes[24]	N/A	N/A	Yes[25]	N/A	N/A
Azure Multi-Factor Authentication	N/A	N/A	N/A	N/A	Yes	N/A	N/A	N/A	N/A	N/A
Clef	N/A	N/A	N/A	N/A	Yes	N/A	N/A	N/A	N/A	N/A
Cognalys Inc	N/A	N/A	N/A	N/A	N/A	N/A	N/A	N/A	N/A	N/A
CryptoPhoto	N/A	N/A	N/A	Yes[26]	Yes[26]	N/A	N/A	N/A	N/A	Yes[26]
Duo Security	Yes	N/A	N/A	N/A	Yes	N/A	N/A	N/A	N/A	N/A
FreeOTP	Yes[27]	N/A	N/A	N/A	N/A	N/A	N/A	N/A	N/A	N/A
Google Authenticator	Yes	N/A	N/A	N/A	N/A	N/A	N/A	N/A	N/A	N/A
Latch	N/A	N/A	N/A	N/A	N/A	N/A	N/A	N/A	N/A	N/A
LaunchKey	N/A	N/A	N/A	N/A	Yes	N/A	N/A	N/A	N/A	N/A
LoginTC	N/A	N/A	N/A	N/A	N/A	N/A	N/A	N/A	N/A	N/A
MePIN	Yes	N/A	N/A	N/A	Yes	N/A	N/A	N/A	N/A	N/A
Nexmo	N/A	N/A	N/A	N/A	N/A	N/A	Yes[28]	N/A	N/A	N/A
Ping Identity	N/A	N/A	N/A	N/A	Yes[29]	N/A	N/A	N/A	N/A	N/A
PortalGuard	Yes[9]	N/A	N/A	N/A	N/A	N/A	N/A	N/A	N/A	N/A
privacyIDEA	Yes	Yes	N/A	N/A	N/A	N/A	N/A	Yes	N/A	N/A
Protectimus	Yes	Yes	N/A	N/A	N/A	N/A	N/A	N/A	N/A	N/A
Rublon	N/A	N/A	N/A	N/A	N/A	N/A	N/A	N/A	N/A	N/A
SAASPASS	Yes	N/A	Yes	N/A	N/A	N/A	N/A	N/A	N/A	N/A
SAT Mobile ID	N/A	N/A	N/A	N/A	N/A	N/A	N/A	N/A	N/A	N/A
SecSign	N/A	N/A	N/A	Yes[11]	N/A	N/A	N/A	N/A	N/A	N/A
SecureAuth	N/A	N/A	N/A	N/A	Yes[30]	N/A	N/A	N/A	N/A	N/A
SecurePass	N/A	N/A	N/A	N/A	N/A	N/A	N/A	N/A	N/A	N/A
SmartSign	N/A	N/A	N/A	N/A	N/A	N/A	N/A	N/A	N/A	N/A
Solidpass[12]	Yes	Yes	Yes	N/A	Yes	N/A	N/A	Yes	N/A	N/A
SyferLock GridGuard	N/A	N/A	N/A	N/A	N/A	N/A	N/A	N/A	N/A	N/A
Symantec/Verisign VIP	N/A	N/A	N/A	N/A	Yes	N/A	N/A	N/A	N/A	N/A
TeleSign	Yes[14]	N/A	N/A	N/A	N/A	N/A	N/A	N/A	N/A	N/A
TextPower	N/A	N/A	N/A	N/A	Yes[31]	N/A	N/A	N/A	N/A	N/A
Token2	Yes[32]	N/A	N/A	N/A	N/A	N/A	N/A	N/A	N/A	N/A
Toopher	N/A	N/A	N/A	N/A	N/A	N/A	N/A	N/A	N/A	N/A
Totp.Me	Yes	N/A	N/A	N/A	N/A	N/A	N/A	N/A	N/A	N/A
Transakt	Yes[17]	N/A	N/A	N/A	Yes[17]	Yes[17]	N/A	Yes[17]	N/A	N/A
VASCO Data Security	Yes	N/A	N/A	N/A	Yes	N/A	N/A	N/A	N/A	N/A
WWPass	N/A	N/A	N/A	N/A	N/A	N/A	N/A	N/A	N/A	N/A
WiKID Systems	N/A	N/A	N/A	N/A	N/A	N/A	N/A	N/A	N/A	N/A
Yubico	Yes	N/A	N/A	N/A	N/A	N/A	N/A	N/A	N/A	N/A

References

1. "Comparing the top multifactor authentication vendors". November 2014.
2. "INTRODUCING AUTHY FOR YOUR PERSONAL COMPUTER".
3. "SECURITY NOTICE: OPENSSH PASSWORDS VULNERABLE".
4. Larry Seltzer (30 April 2014). "Microsoft Azure is phishing-friendly". Retrieved 27 April 2016.
5. Yuri Diogenes (22 March 2016). "Microsoft Antimalware for Azure Cloud Services and Virtual Machines". Retrieved 27 April 2016.
6. "Clef".
7. "CryptoPhoto Features". Retrieved 18 April 2016.
8. Jon Oberheide (6 June 2014). "Duo Patches for the Latest OpenSSL Vulnerabilities". Retrieved 18 April 2016.
9. "Two factor Authentication:Flexible Options" (PDF).
10. "Rublon".
11. "SecSign".
12. "Solid Pass".
13. "GridGuard Overview".
14. "TeleSign_US_Datasheet_Push_Verify_20161" (PDF). 2016. Retrieved 27 April 2016.
15. NEIL J. RUBENKING (20 May 2014). ""Hack-Proof" TextKey Turns SMS Authentication on Its Head". Retrieved 1 May 2016.
16. "TextKey Scores Well in Network World Review of Authentication Solutions".
17. "Build in trust with the Transakt SDK" (PDF).
18. "Authenticator plus".
19. "Authentify Two-Factor Authentication".
20. "Authy: Two-Factor Authentication Made Easy".
21. Matthew Prince (28 November 2012). "Choosing a Two-Factor Authentication System". Retrieved 16 April 2016.
22. "What is Azure Multi-Factor Authentication?".
23. "Clef Two-Factor Authentication".
24. "AUTHY two factor authentication". Retrieved 27 April 2016.
25. Dan Killmer. "AUTHY ONETOUCH: SIMPLY STRONG SECURITY". Retrieved 18 April 2016.
26. "Two Factor and Multifactor Authentication by CryptoPhoto". Retrieved 18 April 2016.
27. "FreeOTP".
28. "Nexmo".
29. "PingID Multi-factor Authentication".
30. "SecureAuth" (PDF).
31. "GET AN INDUSTRY LEADING MULTI-FACTOR AUTHENTICATION SOLUTION".
32. "TOKEN2".