High security multifactor authentication using a
series of single-use "passcodes" does not need
to be expensive. In fact, it can be free...
Generate your own unique set of
Printable Paper Passcards right now:
What is "Multi-Factor Authentication"
. . . and why might you need it?
Almost without exception, today's Internet users prove their identity online using a fixed account name and password. In the past, this simple system provided sufficient security. But with the growing popularity of online banking and eCommerce, the value of stealing online identities has skyrocketed. And the increasing presence and "spyware" and "malware" on innocent users' computers means that users can be "watched" while logging onto their banking and other eCommerce sites. Once their logon credentials have been "captured" and stolen, Internet criminals can easily assume their identity.
The trouble with a username and password is that they never change. We create them, write them down or memorize them, then use them over and over again. What has been needed is an inexpensive system that provides something which changes everytime it is used. GRC's Perfect Paper Passwords system offers a simple, safe and secure, free and well documented solution that is being adopted by a growing number of security-conscious Internet facilities to provide their users with state-of-the-art cryptographic logon security.
To hear or read more about the important and fascinating topic of "Multi-Factor Authentication", you are invited to listen to the free audio (mp3) podcast Leo Laporte and I produced to address this topic. The link below will take you to large high-quality and smaller lower-quality audio files as well as text transcripts in web or PDF format:
http://www.grc.com/securitynow.htm#90
To learn more about the design, operation, and security of GRC's Perfect Paper Passwords system,
you are invited to listen to a detailed description of the background and operation of this system, including a detailed discussion of the design and development path that led to this result. This discussion took place over
three episodes of our weekly "Security Now!" audio podcast with
Leo Laporte:
The first episode (#113) explains the problem I was working to solve. It explains the security issues and considerations leading up to the decision to design a paper-based one-time password system:
Higher quality: 64 kbps mp3, 27 MB (Right-click and "Save Target As...")
or smaller size: 16 kbps mp3, 6.7 MB (Right-click and "Save Target As...")
The second episode (#115) explains the development of this one-time password system, examining the many directions not taken, and thoroughly detailing the finished PPP system:
Higher quality: 64 kbps mp3, 40 MB (Right-click and "Save Target As...")
or smaller size: 16 kbps mp3, 10 MB (Right-click and "Save Target As...")
The third episode (#117) discusses the evolution of this one-time password system from version 1 to version 2 and examines interesting questions such as whether it's better to have truly never repeating one-time passwords or this system's "equally unlikely" but possibly repeating passwords.:
Higher quality: 64 kbps mp3, 26 MB (Right-click and "Save Target As...")
or smaller size: 16 kbps mp3, 6.5 MB (Right-click and "Save Target As...")
Notes about GRC's PPP online demonstration form above...
The form above defaults to, and these PPP pages describe, the "PPP Standard" system based upon 4-character passcodes drawn from a 64-character alphabet. Since this yields nearly 17 million possible passcodes occurring in a cryptographically unpredictable sequence, it delivers a highly-secure balance between security and convenience. By providing a 64-character hexadecimal sequence key and other optional customizing data, this page may be used to generate and print valid passcards for use with any compliant PPP implementation that lacks its own passcard printing facility. Many free and open source implementations of this PPP system are currently available, and more are on the way. GRC offers a complete and free (though not open source) PPP CryptoSystem implementation for Windows platforms, and other open source solutions are already available for Windows, Mac, Linux, and Java-equipped cell phones. The "PPP Software" page provides further details. GRC employees are using this system to enable their own secure roaming access to GRC's private corporate network. One of the values of this system compared with hardware authentication credential tokens, is that it supports fully local "TNO" (Trust No One) authentication without relying upon any third parties or third-party relationships. This PPP secure authentication system will appear in GRC's future commercial "CryptoLink™" product to offer secure roaming access features to individual users and corporations. Everything is free: (Although GRC's code is not open source.) To further document and promote the use of this system, GRC has made a Windows implementation of the entire PPP CryptoSystem freely available for download and use. It is our sincere hope that other Internet sites and services will adopt this, or a similar system, to help protect Internet users by employing secure authentication technologies such as this.
In addition to the information and podcast audio files above, the following pages provide a thorough description of the design and operation of GRC's Perfect Paper Passwords system: