A second factor at sign-in
A password is one factor. Sign-in asks for a second one as well, so the password on its own is not enough.
SECURITY · SIGN-IN PROTECTION
A known password alone does not let anyone in
Updated
Sign-in protection is one layer of the enterprise cybersecurity we build. Two-factor sign-in, sign-in bound to the owner’s device, and a guard on the user’s computer.
- Two-factor sign-in
- Bound to the owner’s device
- Guard on the computer
A sign-in attempt with a password someone else knows
- PasswordKnown to someone elseEntered
- Second factorAsked for at sign-inMissing
- Owner’s deviceSign-in is bound to itOther device
- Guard on the computerWatches network routesWatching
Not let in. The password alone does not open the account.
THREE PARTS
Three checks stand between a password and the account
Each one works without the others. Together they mean a leaked password is not a way in.
Sign-in tied to the owner’s device
Sign-in is bound to the owner’s device. Someone who knows the password but signs in from elsewhere is not let in.
Remote sessions that were not allowed are cut
A guard on the user’s computer watches network routes. When someone opens a remote session that was not allowed, it cuts that session.
LAYER BY LAYER
What a stranger with your password runs into
From the first factor to the session itself, in the order a sign-in meets them.
01 Not enough
on its own
The password
The first factor. Someone else may come to know it.
on its own
02 Asked at
sign-in
The second factor
Two-factor sign-in asks for a second proof at the door.
sign-in
03 Bound to
the owner
The owner’s device
Sign-in is bound to it. Another device with the same password is turned away.
the owner
04 While the
session runs
The guard on the computer
It watches network routes and cuts a remote session that was not allowed.
session runs
THE GUARD ON THE COMPUTER
A remote session nobody allowed is cut
The guard sits on the user’s computer and watches network routes. It is not a spam filter. It sits quietly and watches the routes.
When someone tries to reach the computer through a remote session that was not allowed, the guard cuts that session.
The user’s computerThe guard watches its network routes
- A session that was allowedThe route is watchedRuns
- A remote session that was not allowedThe guard acts on itCut
WHERE IT FITS
One layer of enterprise cybersecurity
Sign-in protection works beside the other measures we build.
| At the door | Sign-in protection: two-factor sign-in, bound to the owner’s device. |
|---|---|
| On the computer | A guard that watches network routes and cuts a remote session that was not allowed. |
| Access | Zero trust. Nobody gets standing access, including us. Access ends when the work ends. |
| Our position | Measures, not a guarantee. No completely secure system exists. |
STRAIGHT ANSWERS
Questions about sign-in protection
What a known password can and cannot do.
No, a known password alone does not let anyone in. Sign-in also asks for a second factor, and it is bound to the owner’s device, so someone with the password on another device is turned away. These are measures, not a guarantee: no completely secure system exists, and we will not tell you one does.
Two-factor sign-in asks for two separate proofs before it lets anyone in. The password is the first. A second factor is asked for as well, so a password that leaks, or that someone guesses, does not open the account on its own. It is one of three parts of the sign-in protection we build.
The guard watches network routes on the user’s computer. When someone tries to reach that computer through a remote session that was not allowed, the guard cuts the session. It is not a spam filter. It sits quietly, watches the routes and acts only on a remote session that nobody allowed.
No. No completely secure system exists, and we publish measures instead of a guarantee. Sign-in protection is one layer of the enterprise cybersecurity we build, beside post-quantum encryption and monitoring inside systems. Nobody gets standing access either, including us, and access ends when the work ends.
Build sign-in protection into your system.
Two-factor sign-in, sign-in bound to the owner’s device and a guard on the computer, built in from the start.