User confidence takes a Net loss

The idea of minimalist authentication came to mind when I spoke to Ori Eisen, CEO of The 41st Parameter. Besides being an entrepreneur with a computer-security startup, Eisen has previously been the director of worldwide fraud for American Express and for VeriSign, so he knows a bit about computer security firsthand. Like the idea of minimalist authentication, Eisen believes his products offer "zero imposition" on a company's customers. The 41st Parameter recently announced a patent for a core piece of its antiphishing product, PhishingNet. The technology, called TimeDiff Linking, automatically correlates log-in data, computer data, and customer data to build a fingerprint of a perpetrator's device. By creating a unique fingerprint for each device that logs in, The 41st Parameter's technology pinpoints repeat offenders and builds a stronger defense against all the different behaviors exhibited by unauthorized users.

"For instance, if someone takes your password and sells it to an overseas hacker, and then the hacker attempts to connect to your banking Web site, our product can tell that this is not the same computer that usually checks into the site and, depending on how the customer sets up the system, can deny access to the hacker," Eisen says.

In other words, if someone from Moscow attempts to access your bank's site with your password at 3 a.m., PhishingNet will realize you are, a) not up at that unholy hour, psychotic about that $15.25 check to Wal-Mart, b) unlikely to be buying the complete works of the Russian rock band Vasily Shumov and Center, and c) not guzzling java and Web surfing at one of the Montana Coffee cafes in Moscow. That is just one component of PhishingNet, Eisen says. Much like McDonald's guards its secret sauce, Eisen did not disclose all the components of the product. "We don't want to tell the hackers exactly what we're doing, just our customers," he says.