Turning your cellphone into an OTP machine

EVERYONE has to key in multiple passwords every day - to access their work networks, their private e-mail accounts, social networking sites etc. For the average person, 10 passwords are par for the course. Because of this, people either use simple, easily crackable passwords or they create strong passwords but then write them down, often on a Post-it in their cubicle. In both cases, security is compromised.

This situation got a few whizz-kids in Stellenbosch thinking about possible solutions, resulting in a company called Fireflight that offers a unique authentication application. The Fireflight system is a highly secure mobile authentication system that provides a two-factor, one-time-password (OTP) authentication solution by generating secure passwords on a user`s mobile phone. Each password is unique and expires as soon as it has been used.

Fireflight is unique, says its creators,  because unlike the systems currently in use around the world, the passwords generated by the program are not sent to the user via a text message, they are actually generated on the phone.

Companies requiring OTP authentication for users would purchase a Fireflight backend server and users would download the application on to their phones for free. The `token` application would then independently generate a password on each user`s phone, and when being used to authenticate someone, the password would be verified by the server.

Fireflight is currently in talks with ISPs and banks, among other organisations, who are requesting pilot projects. In fact, some of South Africa`s biggest companies are already piloting the application, say the team members.

"Fireflight has been warmly received by everyone we`ve showed it to. Now we`re ramping up - we know we`re sitting on top of something great," says Justin Stanford, CEO at Fireflight. "In the future, we`re expecting the end-users who are currently trying the product to continue using is as the pilot projects expand. Within the next few months we will start promoting to consumers, but right now, we`re just talking to business."

GOING GLOBAL

The unique concept and working environment fostered by the company has attracted some of the best development talent in the country to work on a unique and entirely South African developed software product. Stanford is himself a prominent technology entrepreneur who has interests in various companies, and who`s security expertise has had him consulting for leading auditing firms including Ernst & Young and BDO Spencer Steward, as well as the South African Police Service.

"Fireflight is a world-class security application that is able to compete on the global stage, and several patents have been filed for the pioneering and innovative solutions and technologies developed by the company," he says. "Much of what is in Fireflight, which has been written in Java and deploys automatically and equally well on all cellphones, has been patented."

But Stanford points out that the window of opportunity is closing, and other companies will enter this space in the new year - whoever gets to market first could have a billion-dollar company. He says that the company`s aim is to take the solution global quickly, and that South Africa is a great platform to launch it.

MOBILE AUTHENTICATION

Stanford explains that a one-time  password is an old concept, but that the way these passwords are being delivered is not convenient. So, he says, realising that there clearly wasn`t an ideal solution available, and understanding that mobile phones are becoming the most ubiquitous computer, in 2005 Fireflight was born with a software-based prototype. "We saw the potential, and over the last few years sat quietly on our golden egg and developed the application. We were aiming to fully flesh out a comprehensive solution before we made it public."

The Fireflight product, as it exists now, is that comprehensive solution. Officially unveiled in July of this year, this highly complex mobile software works on all the different makes and models of mobile phones.