Live Ensure® launches latest product features into US Market

 Live Ensure® the SAAS  multi-factor authentication solution has spent the last year and a half field trialing the mobile version of the product with a few select customers who have collectively made millions of authentications without a single breach or failure.  Feedback provided valuable input which allowed the product to be further refined and streamlined making the user experience even better while making the solution stronger.  

Live Ensure® is easily integrated into an existing log-in form including SSO solutions like Twitter and Facebook.   This means that sites which allow users to log in e.g. with Twitter can now include a strong authentication layer thereby thwarting ID theft hacks which have become ubiquitous.   Examples are too numerous to mention but the weakness of password log-ins to emails (Bush Hack)  and social media products (Twitter and Facebook) and their consequent failure are well documented. 

Live Ensure® leverages the smart-phone, now virtually ubiquitous, as the second factor ( the ‘ something you have ‘) for use in the authentication process.  The site integrates the Live Ensure® service by simply  ‘mashing up’ the API code into its log in form (like mashing up Google maps)  and inviting its customers to download the Live Ensure®  App (iOS, Android, Windows Mobile).

Live Ensure® uses a triangulated architecture and the context of the session to validate the correct parties (the legitimate site and user) to ensure iron clad authentication.   Not only does Live Ensure® come with an insurance warranty from Munich Re but it is now being resold by, amongst others, CSC.   As a Cloud based service harnessing users existing devices Live Ensure® can scale rapidly allowing social media sized user bases to be enrolled quickly and effortlessly.   

The recent launch of the FIDO Alliance  (FIDO)  in response to the growing need for a more secure and easier to use alternative to user name / passwords is to be lauded.    The rapid increase of cyber crime whether at a military ‘level’  i.e. ‘cyberwar’ or the more innocuous social media [Twitter hacked] is testimony to the manifest failure of the majority of authentication solutions in use today.   The desire by FIDO to architect a simpler and more secure authentication solution that leverages users existing hardware makes good sense.     FIDO aims to provide specifications or standards to the industry that embody an approach to authentication which starts to move away from the ‘security by obscurity ‘  (i.e. the shared secret  -  user name/password paradigm prevalent today. )   

There is a concern that by creating another industry body there will be the need to get a critical mass of players on board in order for the standard to become effective, which will undoubtedly lead to much heel dragging at a time when things need to proceed with alacrity. 

FIDO aims to leverage hardware devices such as phones and tablets as well as fingerprint readers, webcams, TPM chips and tokens into an open-standard whereby there will be inter-operability between different systems but which comply to the standard.   A client/server architecture in combination with some hardware fingerprint starts to approach a much more secure approach than the exchange of self reported credentials.    

The creation of a global repository and browser based plug-in  (a la certificate authority) is a potential weakness in the model.   Who will be the custodian of this information and who will ensure it is updated. ?   

Some of the key elements of FIDO are already embodied in the architecture of Live Ensure®. 

·      Passwordless authentication

·      Leveraging existing hardware

·      Rapid scalability

·      Triangulated architecture

We will support the initiative with cautious enthusiasm while expanding the Live Ensure® footprint into the US market.