Have. Know. Be.
Quick summary
Authentication can rely on something we have, know or are, and combining these factors strengthens security. The article explains how WebAuthn combines a password, a phone and biometric verification to protect access to Tryton.
Contents
Hello,
every day you get into your home thanks to the key you have.
Have
Having a key, in this case, is what allows you to get in.
Having to have a key has the advantage that if you want to let someone into your home, you only need to give them this object. At the same time, someone only needs to take your keys or steal your bag to get in.
After entering with the key, you may need to deactivate the alarm. You will probably need to know a code to do so.
Know
Knowing is what distinguishes who we want to be able to enter from those who should not.
If you use some kind of contactless key to deactivate the alarm, it is probably not the best idea, because stealing your bag would be enough to get both keys.
Notice, on the other hand, that if you use a security code, access is a little more complicated: someone would have to steal your bag and also obtain the code through some other means.
Knowing a password is what lets you access—or prevents you from accessing—many websites. It is also the system Tryton users usually rely on.
Be
Being, verified by a fingerprint or iris scan, for example, is another way to verify access to a property or system.
Each of these mechanisms—having, knowing, or being—has its advantages and disadvantages. That is why, for maximum security, it is best to combine two or (ideally) all three.
That is precisely what the WebAuthn protocol allows. And since a more secure way to authenticate users existed than the one we were using, we had no choice but to integrate this protocol into Tryton.
The new module we have created adds Have and Be to the password-based Know that we already use.
How does WebAuthn work when integrated with Tryton?
After entering their password, the user sees a screen like this:
Scanning the QR code with a mobile phone opens a page like this:
When the user taps the access button, the phone verifies them using a fingerprint or their face.
Therefore, anyone who wants to log in must know the password, have the phone, and be the right person.
Frequently asked questions
What do “have”, “know” and “be” mean in authentication?
“Have” means possessing an object, such as a key or a phone; “know” means knowing a secret, such as a password or code; and “be” means verifying a biometric characteristic, such as a fingerprint or a face.
Why is it safer to combine several authentication factors?
Each mechanism has strengths and weaknesses. Combining two, or ideally three, means that an attacker must overcome more than one check to gain access.
What is the risk of relying only on a physical or contactless key?
If someone steals the key or the bag carrying it, they may also have what is needed to enter. Adding a code or another check makes access more difficult.
How is WebAuthn used to access Tryton?
After entering the password, the user scans a QR code with their phone and presses the access button. The phone verifies their identity using a fingerprint or face recognition.
Which factors must the user provide in the integrated Tryton access example?
The user must know the password, have the phone and be the right person, verified through a fingerprint or face recognition.
What does the new authentication module described in the article add?
It adds the “have” and “be” factors to the “know” factor represented by the password users already use routinely.
Related articles
Tryton
Safety in Tryton (video in catalan)
This session presents Tryton’s security capabilities and explains how the ERP and its data are protected against cyberattacks and user errors. The article provides access to both the video and the presentation from the security event held in Sabadell.
Open Source and Trends
We warn you: IT safety is a priority
The WannaCry attack showed that technology security is a priority for companies and organisations of every size. The article argues for accurately assessing security solutions and highlights how open, transparent technologies make protection mechanisms easier to understand and improve.
Tryton
Koo Integration with KWallet
Koo can use KDE’s KWallet to store credentials and form data centrally. With PyKDE installed, the integration should work without configuration; if needed, it can be enabled in `~/.koorc`, with an option to ask for confirmation before saving a password.
