0 ms
Typical time to clear the second factor
Two Factor Authentication
Two Factor Authentication
Two factor authentication (2FA) asks for two different kinds of proof before it lets anyone in: something the user knows, like a password, and something the user has, like their phone. Spriv keeps that protection and removes the chore. The second factor is verified out-of-band, in the background, in about 175 milliseconds.
Two Factor Authentication · Verified in the background
0
Codes to type on a trusted login
0
Authentication methods on one platform
0 min
Install time, start to finish
The basics
What is two factor authentication?
Two factor authentication is a login check that requires proof from two different categories of factor. A stolen password on its own is no longer enough, because the attacker also needs the second factor, and that factor lives somewhere else.
Something you know
A password or PIN. It is the factor every login already has, and the one attackers phish, guess, key-log and reuse from old breaches.
Something you have
A phone, a hardware token or a smart card. Spriv uses the phone your users already carry, so there is no extra device to buy, ship or replace.
Something you are
A fingerprint or a face scan. Strong, but it needs supported hardware at every login point. Spriv does not require biometrics.
Somewhere you are
The environment the login comes from. Spriv pairs the workstation with the environmental identifier the phone reports, and checks that both still match.
Two categories, not two of a kind. A password plus a security question is still one factor: both are something you know. Real 2FA combines factors from different categories, so one stolen secret cannot unlock the account.
Why 2FA
Why a password alone is no longer enough
Each of these attacks ends at the second factor, as long as that factor is checked on a channel the attacker does not control.
Stolen and reused passwords
Passwords leak in breaches and get reused across sites. With 2FA, a leaked password gets the attacker as far as the second factor and no further, because the phone that completes the login is not in their hands.
Phishing and key logging
A fake login page or a key logger captures whatever the user types, and that includes a one-time code. Spriv's adaptive 2FA gives the user nothing to type: the second factor is verified out-of-band between the workstation and the phone, so there is no code to steal.
Brute force and credential stuffing
Automated tools try millions of password combinations. Even a correct guess still needs the paired phone, so the attack stalls at the second factor.
Session hijacking after login
Malicious code can take over a session after the user has signed in, which a one-time login check never sees. Spriv can also verify high-risk transactions on the second channel, and it tells your platform when the user has left the authorized computer. How automated MFA stops session hijacks.
Not all 2FA is equal. SMS codes, TOTP, push prompts and hardware keys each leave different gaps. The MFA comparison table scores six methods against eleven threats and usability checks.
Spriv's approach
How Spriv's two factor authentication works
Classic 2FA interrupts the user on every login. Spriv asks once, learns the trusted workstation-and-phone pair, then checks the second factor silently from then on.
STEP 01
Pair the phone once
The administrator adds the user in the Spriv control panel and sends a pairing link. The user installs the Spriv app and opens the link on the phone. How pairing works.
STEP 02
Approve the first login
On the first sign-in from a workstation, the user approves the request on the phone. Spriv records that computer together with the environment the phone reports.
STEP 03
Later logins clear silently
When the workstation and phone match, the second factor completes in the background. When either does not, the user is challenged, exactly as 2FA should behave.
Traditional 2FA vs adaptive 2FA
The same two factors, a fraction of the wait
Typical time to clear the second factor, by method. Every second spent on a code or a tap is repeated on every login, for every user, every day.
0.18 s
Spriv adaptive 2FA, no user interaction
~8 s
Push approval on the phone
~14 s
Typing a TOTP code
~22 s
Finding and using a hardware token
Less friction is also more security. Users who are prompted on every login learn to approve without reading, which is called repetition poisoning. Keeping routine logins silent means the rare prompt gets real attention. Why risk based 2FA is faster.
Five methods, one console
Two factor authentication methods Spriv supports
Adaptive 2FA is the default. Add the other methods where they fit, and decide which one each user experiences at each step.
Adaptive 2FA, the default
Spriv's patented method compares the phone's environment with the workstation's fingerprint. A match approves the login automatically, with no code and no tap. A mismatch falls back to a manual Allow or Deny prompt. Adaptive Multi Factor Authentication.
Allow / Deny push
A prompt on the phone that the user approves or rejects. Best kept for exceptions such as wire transfers, address changes, password resets or a login to a production server, so it never becomes a reflex. Push authentication.
One-way SMS code
A code sent to the registered handset. It needs no app, works on any phone with SMS and is delivered in more than 200 countries, which makes it the right choice for activation and as a fallback. SMS two factor authentication.
Two-way SMS verification
Spriv texts a question and the user replies. The reply is posted to your endpoint, closing the loop on a second channel that is separate from the login, which suits order and transaction confirmations. Transaction authentication.
TOTP one-time password
Standard time-based one-time passwords (RFC 6238): six digits generated on the phone and refreshed every 30 seconds. They work with no internet or cellular signal, for travellers and restricted networks. TOTP authentication.
Where it runs
Two factor authentication for servers, desktops and your own apps
The same second factor protects Windows logins, Linux shells and customer-facing applications, all managed from one control panel.
-
Windows and Remote Desktop
Automated 2FA on the Windows login screen for local accounts and RDP sessions. 2FA for RDP
-
Linux and Unix
A PAM module that covers SSH, su and sudo across your servers. 2FA for Linux PAM
-
Your own applications
A REST API with sample code in five languages for web and customer logins. API reference
Questions
Two factor authentication questions
Is two factor authentication the same as multi factor authentication?
2FA is a kind of multi factor authentication that uses exactly two factors. MFA means two or more. Spriv checks the password, the phone and the workstation-and-environment pair, which gives you three factors at two-factor pricing. Multi factor authentication explained.
Is SMS two factor authentication still safe?
SMS is far better than a password alone, but codes can be phished or redirected by a SIM swap. Spriv uses adaptive 2FA as the default and keeps SMS for activation and as a fallback for users who cannot install the app.
Do my users need a hardware token?
No. Spriv turns the phone your users already own into the second factor, so there are no tokens to buy, ship, replace or keep track of.
What if the phone has no signal?
TOTP codes are generated on the phone and work offline. On a protected Windows computer, users can also sign in with a local credential and an optional Bypass Code while the internet is down. Logging in offline.
Does two factor authentication help with compliance?
Yes. PCI DSS requires two-factor authentication for remote access to the network, and FFIEC, HIPAA and SOX set strong authentication as a baseline. Spriv verifies out-of-band across two separate channels and transfers no personally identifiable information. MFA compliance guide.
How much does Spriv two factor authentication cost?
The Startup plan is free for 2 users and 2 servers, with no credit card. The Business plan is $5.5/month/user with unlimited users, and servers are billed at $10/server/month. See pricing.
Explore
Keep reading
Checkit!
Turn on two factor authentication today
Two free users and two free servers, no credit card. Install in under five minutes and watch the second factor clear in the background.