Authentication to various applications may be performed according to a variety of authentication form factors, such as user password authentication (UPA), static knowledge-based authentication (SKBA or, herein, simply KBA), one-time password authentication (OTA, or sometimes OTP), etc. According to a UPA form factor, a user provides a token, e.g., a password, that the application compares to a pre-stored token associated with that user (the token sometimes being stored in a hashed form). According to a static KBA form factor, a user successfully provides evidence of certain knowledge, e.g., answers a “secret question” or the like, to obtain authentication to the application. According to an OTA form factor, a hardware and software device is somehow synchronized with the application, e.g., a device sometimes referred to as a security token or the like, is used to generate a one-time token, or password, that the application may compare to an expected value. OTA may require a user token, generally called a personal identification number (PIN), or may refer to a single token transmitted to a user, e.g., via mail, email, telephone, etc. In addition, various authentication form factors such as those mentioned above may be used in various combinations with one another.
Different authentication form factors present varying levels of reliability, and therefore varying levels of risk of being breached by an attacker. Unfortunately, mechanisms for adequately evaluating such risk, and for determining when an authentication method is sufficient, are presently lacking.