TL;DR
Security tokens are physical or digital devices that authenticate user identity by requiring possession of a device, knowledge of a credential, or biometric verification — or a combination of all three. They come in connected, disconnected, and contactless forms, each with distinct password mechanisms (static, dynamic, or challenge-based). While they significantly strengthen security over passwords alone and are a cornerstone of multi-factor authentication (MFA), they carry real-world vulnerabilities including loss, theft, and hacking. Crypto security tokens are a separate concept and not relevant to everyday IT authentication workflows.
Understanding security tokens and authentication
A security token is a physical device that users must possess to access a system. Authentication data must flow between both the user and the system to validate identities and access. A security token is the conduit for this data.
How prevalent are security tokens in modern businesses?
Passwords and personal identification numbers are ubiquitous in modern businesses. Most employees know that they must enter some set of credentials to access files, servers, and sensitive documents. Security tokens take this protection to the next level.
A security token can be as big as a key fob or as small as a microchip. They either hold information that verifies a person's identity or communicate with a database or third-party system that offers verification services.
How do security tokens work?
Each year, hackers cause approximately $400 billion in losses. Businesses have to protect against this very real threat, or the damage could be immense.
What does a real-world token setup look like?
Imagine you work for a large corporation, and it's your job to protect intellectual information worth millions. Hackers want it, and it's your job to keep them away. Your token setup could include:
- Keywords. The user must type in a secure password from memory. There are often detailed requirements for this password, such as a certain minimum number of characters or other specifications.
- Computer setup. During an attempted login event, the computer system sends a message to the user's cellphone. That message contains a password that must be entered, or access is blocked.
On the surface, this is the same type of authentication and authorization consumers have used for years with passwords. They must enter credentials they have memorized to access the systems they need. But security tokens require some type of tool. Simple memory isn't enough.
3 main types of security tokens
Security tokens are built with customization in mind. The needs of one company can be quite different than those of another. Select your version carefully to ensure you're delivering the right balance of security and flexibility.
Security token types include:
| Type | How It Connects | Example |
|---|---|---|
| Connected tokens | Users must physically tie the token to the system they want to use. | A smartcard or fob like a Yubikey. Users slide the device into a reader, and the device automatically pushes authentication information to the computer system. |
| Disconnected tokens | Users don't need to physically insert anything into a device, but they may need to enter a code generated by the token. | A cellphone set up as a two-factor authentication (2FA) device. |
| Contactless tokens | Users don't need to connect to a device, and they aren't required to input an additional keyword or access code. Instead, these devices connect with the system wirelessly, and access is granted or denied based on that connection. | Bluetooth tokens and keyless entry systems. |
The customization doesn't stop there. Your security token system could also include:
- Keypads. Lock down the data inside your token by requiring a password.
- Biometric data. Store iris scans or fingerprints, and tie that data to scanners on site.
- Tamper-resistant qualities. Security measures are added to ensure that thieves can't take apart the keys and steal data.
What types of passwords do security tokens use?
Every security token contains a tiny bit of data that could be considered a password. It isn't always entered into a system via a keypad or scanner, but the token completes some type of secure data exchange with the resource the user is trying to access.
Plenty of security token password types exist, including:
- Static passwords. A string of numbers, letters, or both sit within the token. The password never changes without direct support from a security professional. The person who holds the token may not know that the password exists, and the person can't call out the data if asked.
- Dynamic passwords. The security system picks a new password, and it's tossed to the token. Typically, the user must type in the results before gaining access. Some systems like this use a timer and an algorithm to generate passwords, while others use a one-time password solution.
- Challenge passwords. The server and the key connect with one another, and the data is encrypted along the journey. The device must provide the challenge in its decrypted form to gain access.
What are the benefits of using security tokens?
Passwords are incredibly hackable. In fact, researchers say the most common password is "123456." Leave your security solely in the hands of your users, and a catastrophe is just waiting to happen. Security tokens can moderate these threats by supplementing — or even fully replacing — user-generated passwords.
A proper security token system is built on three types of information.
- Possession: The person must have something (like a phone, a key card, or a USB) handy to access the system.
- Knowledge: The person must know something (a password) to complete the loop and get access.
- Inheritance: This relates to biometrics. It is something the person is (like a fingerprint or a facial recognition scan).
When used in conjunction with passwords, security tokens form part of a multi-factor authentication (MFA) solution. MFA solutions reinforce authentication security, as they require the user to submit another verification factor, such as one-time passcodes and Universal 2nd Factor (U2F) token information.
Why do security tokens outperform passwords alone?
Exclusively using a password is like protecting your home with just a number combination. It works, but it also grants access for anyone else who knows the number. Adding a security token puts a key-locked gate in front of your door. Even those who know your door combination can't get past the gate, and your home stays safe and sound. It adds another level of protection to keep you secure.
Consumers appreciate the benefits of security tokens. They also have critical information to protect, including:
- Financial data.
- Stored savings information.
- Identity documents.
- Legal documents.
Some companies, including banks, use their two-factor authentication plans as selling points to cautious customers. By proving the company cares about safety, they are more likely to retain and build their customer base.
What are the vulnerabilities of security tokens?
As the name implies, security tokens should keep critical data secure. Unfortunately, they're not invincible. The risks are real, and they can sometimes be hard to mitigate.
Common security token vulnerabilities include:
- Loss. Keycards, fobs, and USB sticks are tiny and easy to lose. If they're not encrypted or protected with a secondary password, anyone who finds them has access.
- Theft. These same devices can be stolen, either in a targeted assault or as part of another crime, such as a purse theft. As with loss, this can put them in the hands of nefarious individuals.
- Hacking. Tokens should protect users from malware, and companies like banks often tell their customers token systems are safer for that reason. But anything that's electronic and connected to a network can be hacked by someone with skill and patience. While security tokens add another layer of support, they aren't impervious to hacking.
- Security breaches. Hackers can step in front of authentication systems and entice users to tap in keywords for collection. This happened to a major banking system in 2006, and it caused quite a scandal.
No matter what security token system you use, moderation and vigilance are required. Ensure that everything is working as you planned, and prepare to step in if you see something that has gone awry.
How do authentication tokens compare to crypto security tokens?
Cryptocurrency deals require proof of ownership, and that ownership must be transferred to a buyer. Crypto security tokens work as a sort of liquid contract.
Some experts believe this form of security token represents the future of finance. These tokens have a security element, but they aren't germane to the work most IT administrators do every day.
Simplify your processes
Security tokens could help your company lock down and protect valuable assets. They bring an enhanced layer of protection to ensure your customers, employees, partners, and overall business remain secure.
Creating a system like this isn't always easy. You want to ensure this system is set up the right way, free from glitches.
More than 8,400 global organizations trust Okta to help them manage and authenticate systems like this. Join them to make your organization more secure.
Frequently asked questions
What is the difference between a connected, disconnected, and contactless security token?
Connected tokens require physical attachment to the system — such as inserting a smartcard or Yubikey into a reader — so the device can push authentication data directly. Disconnected tokens, like a cellphone used for 2FA, generate a code the user must enter without any physical connection to the system. Contactless tokens go a step further by connecting wirelessly and granting or denying access automatically, with no insertion or code entry required — Bluetooth tokens and keyless entry systems are common examples.
Can a security token be hacked?
Yes. While security tokens add an important layer of protection, anything that's electronic and connected to a network can be hacked by someone with skill and patience. Hackers can also step in front of authentication systems and entice users to tap in keywords for collection — a technique that affected a major banking system in 2006. Security tokens are not impervious to hacking, and ongoing vigilance is required.
What happens if a security token is lost or stolen?
If a security token such as a keycard, fob, or USB stick is lost or stolen and is not encrypted or protected with a secondary password, anyone who finds or takes it may gain access to the protected system. Theft can occur in a targeted assault or as part of another crime, such as a purse theft. This is why layered security measures — such as requiring a PIN or password alongside the token — are important.
How does a security token work with multi-factor authentication?
Security tokens are a key component of multi-factor authentication (MFA). Rather than relying on a password alone, MFA combines the token with at least one additional verification factor — such as a one-time passcode or Universal 2nd Factor (U2F) credential — so that a compromised password is not enough on its own for an attacker to gain access.
What is the difference between a static password and a dynamic password in a security token?
A static password is a fixed string of numbers, letters, or both stored within the token that never changes without direct support from a security professional — the token holder may not even know it exists. A dynamic password is generated fresh by the security system and sent to the token; the user typically must type in the result before gaining access, and some systems use a timer and algorithm or a one-time password solution to generate it.
Are crypto security tokens the same as authentication security tokens?
No. Crypto security tokens are used in cryptocurrency deals as a form of liquid contract to prove and transfer ownership. Authentication security tokens are physical or digital devices used to verify a user's identity when accessing a system. While both are called "security tokens," crypto security tokens are not germane to the work most IT administrators do every day.
