Chapter 7 · 1986–2011

Something you have

Stealing the password stopped being enough — now you also needed the plastic brick in someone's pocket. Then someone breached the brick factory.

The “proving the person” branch starts from a simple admission: the secret can always be stolen, so stop relying on it alone. Ask for a second, different kind of evidence. Security people carve the kinds into three — something you know (a password), something you have (a device), something you are (a fingerprint) — and the whole point of multi-factor authentication is that stealing one kind shouldn’t hand over the others. Explore the three below; the strength is in combining categories, not in stacking two of the same.

The “something you have” factor arrived in 1986 as a physical object. Security Dynamics — later renamed RSA — shipped SecurID: a keyfob with a little screen showing a six-digit number that changed every sixty seconds, in sync with a server that knew the same secret seed. To log in you typed your password and the current number. Now an attacker who phished or guessed your password still couldn’t get in, because they didn’t have the brick in your pocket generating this minute’s code. For the first time at scale, a stolen secret wasn’t a stolen account.

It genuinely raised the bar, and for years it was the gold standard of serious access — banks, defense, remote engineers. But watch the thesis reassert itself, because it always does. The keyfob’s security didn’t live in the fob. It lived in the seed — the shared secret that let the fob and the server agree on this minute’s number. And the seeds were manufactured, stored, and distributed by one company. Guard the seed database and the system is strong. Fail to, and every fob it ever made is glass.

In 2011 that abstraction became a crater. RSA — the company whose entire business was the second factor — was breached. The entry was almost insultingly ordinary: a phishing email with a poisoned spreadsheet, opened by an employee. From there the attackers reached the SecurID seed records and walked out with them, and the stolen seeds were then turned against defense contractors who trusted those very fobs. The lesson landed on the whole industry at once: a second factor is only as strong as the governance around its secrets. The factor you have still rests on a secret someone else is storing — chapter 5’s argument, delivered by chapter 5’s absence.

The same year, the factor got cheaper and more phishable in the same motion. TOTP became an open standard and the rotating code moved from a dedicated fob into an app on the phone you already carried. MFA for everyone, nearly free — and a new soft underbelly. Because the code is just a number you read and type, an attacker can simply ask for it: a convincing fake login page collects your password and your code together and replays both in real time. Or they skip the trickery and spam you with approval prompts at two in the morning until you tap “yes” to make it stop — the technique that walked into more than one household-name company. The one-time code raised the bar over passwords alone, but it left a door: anything a human can be talked into typing or tapping, a human can be tricked into typing or tapping.

Which frames the breakthrough of chapter 8 precisely. Every factor so far can be relayed — phished, forwarded, fatigued out of you — because it flows through the person, and the person can be fooled. The fix isn’t a better code. It’s a factor that refuses to answer the wrong website at all, no matter how convincingly the human is deceived. That’s the unphishable key, and it’s where the “proving the person” branch finally gets ahead of the attacker.