This is because tokens can be easily lost, stolen or shared.Ī token can also be copied or tampered with if:

Using a token by itself might not be appropriate if your service needs a high level of protection. If the bank is sure the phone is the same device the user installed the app on, it will approve the transaction. When a user pays for something using their phone, the bank checks the digital certificate. When a user adds an electronic wallet app to their mobile phone, a digital certificate is created and stored securely within their phone. found out, for example if the answer to a KBV challenge is publicly available.guessed, for example if the password or PIN is low quality (like ‘1234’).stolen, for example from a phishing attack.an answer to a question that only the user knows the answer to - also called knowledge-based verification ( KBV)Ī secret is one of the easiest ways for someone to sign in to a service, as a user does not need any special equipment or software to use it.The most common way for users to sign in to a service is by entering a piece of information that only they know. The piece of paper is now the authenticator because it contains information that previously could not be known by anyone apart from the user. If the user writes it down on a piece of paper, it will also become something the user has. It’s secure because no one apart from the user will know or be able to access it.

Set up authenticator app microsoft