On devices

Where a device fails too#

Layering a something you have factor on top of something you know is a genuine improvement to your security position. Nevertheless, devices can be breached or made meaningless as a factor too:

• Sharing the phone’s unlock code.
• Unlock patterns, which are very easy to watch and replicate.
• Device codes, which are easily shoulder-surfed.
• Devices get stolen and later unlocked.
• Fingerprints and Face ID can be spoofed.

What to do about it#

So educate your users where you can. In an enterprise, where you have some control over devices, disable pattern unlock. Ideally use a second device as the authenticator — sign in on a computer and approve on the phone — so a single stolen device is not the whole story. This is exactly the separation Ydentifi’s ceremony assumes: the thing being protected and the thing that approves are not the same surface.