3
$\begingroup$

I use a smart card - as read only device - for user identity as well as a password:

  • The smart card (holds the user ID) is something I have;
  • The password is something I know.

Is this still two-factor authentication?

$\endgroup$
2
$\begingroup$

Is this still a two-factor authentication?

Yes, it can be but it depends on how the smartcard is used.

For example your OS could just use the password for authentication and ignore the fact that a smartcard is present in which case there would be no 2FA.

Or your smart card / OS could be configured to use a key on the card that doesn't actually require a correct user input to allow operation (though I'm not sure how many cards support that) and in this case it is imaginable that only the card matters for authentication which is also no 2FA.

However it is most likely that the OS will e.g. decrypt a per-user secret using a private key stored on the card or perform public-key based authentication against a remote server and your card will allow usage of the relevant key if you authenticate first to the card, which indeed is a form of two-factor authentication, as you need the card which holds the key and you need the password to operate the card.

$\endgroup$
  • $\begingroup$ smart card for identity and also as you describe in the last paragraph. is it counted as two-factor authentication?? $\endgroup$ – Wei Wen Aug 21 '18 at 12:14
  • $\begingroup$ @WeiWen what I described in the last paragraph does indeed count as two-factor authentication and usually if you can't log in without your smart card and the card wants a password, chances are very good that this is the case from the last paragraph (-> 2FA). $\endgroup$ – SEJPM Aug 21 '18 at 14:29

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.