The operative word here is "standard." Systems based on OATH's architecture allow for interoperability among user tokens and a variety of services requiring authentication. The ultimate goal: a single token compatible with any number of services from different providers. This is a fantastic idea, but it's currently possible only in a limited way. Because the current token implementation is event-triggered, if a token is used with unconnected services, the event count for those services will not match the state of the token, causing authentication to fail. The only way to make the system work is for all services to use the same validation back end, thereby keeping token state consistent. One such service is VeriSign's Verified Identity Protection, or VIP. Charles Schwab and eBay are two high-profile users; customers need only a single token to authenticate to these and other VIP-managed online services.
For every open standard there are proprietary alternatives, and strong authentication is no exception. While RSA has been the closed-system market leader for quite a while, the multifactor authentication space is getting crowded. Entries include WiKID, which uses a mobile phone-based software token, and PhoneFactor, which sends an authentication code to users' phones. Still, this is one area where the open alternative has a real shot. OATH's membership list is large and varied. Besides VeriSign, the latest spec is integrated into products from AOL, BMC, Citrix, Entrust, Hewlett-Packard, IBM/Tivoli, Imprivata, SanDisk, and many more.
A BETTER WAY