Mobile two-factor authentication on the rise

Fronde Anywhere has reported significant uptake of its mobile two-factor authentication platform, TwoSecure.

Since the product's launch in Q2 2007, TwoSecure has been deployed by organisations in a range of sectors. Customers include a tier one French bank; a major Australasian telecoms provider; a German financial Institution; m35 in the UK; and an electronic payments switch for verification of online debit payments. It is also currently being piloted by a district health board for verifying doctor identities when accessing patient records.

"By giving businesses confidence in their network security, and consumers' confidence in online banking, TwoSecure addresses a clear market need,” says Caroline Dewe, CEO, Fronde Anywhere. “It has an extensive sales pipeline, including significant prospects with banks and enterprises in Europe and the U.S. Not only is it easy to use, deploy and roll-out, but its uses are practically limitless. We are now also seeing organisations looking to use this technology to further secure transactions at the point of sale."

Many of the user organisations have implemented this solution as a more user-friendly and cost-effective replacement for hardware tokens for their identity authentication requirements. The product line generates one time passwords (OTPs) via a Java application stored on the mobile phone. It also includes an SMS module to enable delivery of OTPs to the phone via a text message.

TwoSecure secures internet banking transactions and login by eliminating the risk of third parties assuming the user's identity, while the Enterprise solution gives employees a second level of authentication when they remotely access business networks and systems. By also preventing man-in-the-middle attacks, the platform mitigates against threats such as Trojan.Silentbanker, a Trojan horse that has the ability to steal confidential financial information by defeating traditional two-factor authentication measures.

The transaction signing capability adds an additional layer of security to a transaction, and prohibits any third party to hijack a transaction, as the OTP used by the customer is useless for any other transaction other than the one intended. The solution, which can be configured to support incremental levels of security, has passed independent security audits, performance testing by IBM, and device testing by SQS.