Possession-based authentication. Authentication based on something you physically have like a key fob token with one-time passwords, ID badge, or a key. An advantage to requiring a physical device for authentication is that the attack surface is greatly limited since a hacker would need the physical key. In two-factor authentication solutions, the Type-2 Authentication is the second factor. 

Also known as possession-based authentication, type 2 authentication is based on what the user has in possession like a security key, ID badge, memory card, or smart card token. On their own, possession-based factors are anything that users in their hands. They are entry tokens that we have to connect with computers to authenticate our identity and give us access or proves who we are. Just like our homes require us to “possess keys” to get inside and no one else can enter unless they have the key, these factors work on the same principle in a computing environment.

While using possession-based authentication, the ability of a cybercriminal to launch a successful attack is greatly reduced as they have to steal the key. This property offers it a significant advantage over knowledge-based factors like passwords and PINs, since the attacker needs the physical possession of the key to launch a successful attack. They have to engage with every single victim to get in possession of tokens or keys, in sharp contrast to the knowledge factors, where just a single password hack can cause a huge server breach. For instance, a single LinkedIn data breach in 2012 lost at least 117 million passwords.

Possession-based factors have been in use for as long as we’ve been using the keys. The basic principle is that the key or token incorporates a secret code that is shared between the lock and key. The same formula applies to the latest, more sophisticated possession items to bar unauthorized users or cybercriminals from accessing private information.

Companies and entities across the world provide possession factors in the form of connected tokens and disconnected tokens to the authorized users to allow them to connect to the client computer or portal. Connected tokens are factors that physically connect with a computer to authenticate a user’s identity such as USB tokens, card readers, etc. Disconnected tokens, on the other hand, are factors/items that don’t physically connect with the computer or portal – and rather require input from the authorized user on a built-in screen, displaying the generated authentication data, to sign in.