We're considering a phone-based 2-factor authentication solution for our windows remote access vpn. Goal is to enable people to work from home, vacation home, outerspace, etc. The phone-based solution is important because we are looking for ease of use, easy management, potential or ubiquity, etc. Does anyone have experience with these solutions and have recommendations for a good one?

I would not recommend one. It doesn't protect against a lot (phishing, identity theft, ect). Also your users have passwords, which are very easily lost or given to other people. Your best bet is creating keys/certs. You control them, you issue them to your clients. You can tell who gets on to what. But that my personal opinion. Others may disagree. Thanks for any input.

I think 2-factor is useful in driving discipline among your user base, and in avoiding the long-term effects of phishing and man in the middle attacks. They are worth looking into.

"I would not recommend one. It doesn't protect against a lot (phishing, identity theft, ect). Also your users have passwords, which are very easily lost or given to other people." How does 2-factor authentication not protect against this? It doesn't matter if you lose or give your passwords to someone else, you also need to have the specified cell or land line at hand to authenticate you are who you are. Do you understand what 2-factor authentication is?

Okay Gordo, settle down :-). The term 2-factor authentication seems to be victim to lots of very similar definitions. What I was talking about specifically was the idea of proving who you are by both what you know and what you have. We've come across PhoneFactor as a potential 2f authentication solution for our windows vpn. Anyone have any experience with it?

Hehe, okay sorry I got a little bit carried away :-). Within my enterprise (a 150 person company) we use PhoneFactor, my CTO and the IT team love it. Probably key for us was the fact that PhoneFactor requires no remote hardware or certificates. We are using it for our cisco vpn authentication.

PhoneFactor has actually worked out pretty well at our company for the purpose of providing authentication our cisco-provided vpn. Check it out at www.phonefactor.com/solutions/remote-access-vpns/