Salesforce Signs On to Arcot Authentication

Richard Adhikari

Updated · Jul 16, 2008

Salesforce, Arcot

UPDATED: Following its introduction of on-demand authentication for Google Apps users in March, Arcot has extended its tool to (NYSE: CRM) users.

The service, available on the AppExchange portal, protects online identities and data with a combination of a transparent software credential, the ArcotID, and a password. This approach is called two-factor authentication . has been urging customers to adopt two-factor authentication after a phishing scam in November tricked one of its employees into revealing his password. The perpetrator then copied a customer contact list, leading to subsequent phishing attacks.

Like many of the other security applications for users, Arcot’s software offers single sign-on, which lets users log on to multiple applications or Web sites.

“If you’re within the Salesforce application, you can log on to, say, Google Apps and use the same credentials to sign in,” Carol Alexander, Arcot’s vice president of marketing, told

A-OK “adds an additional application for customers who want an option for single sign-on and two-factor authentication,” a spokesperson told

According to Alexander, needed an application like Arcot’s. The company previously implemented a username-and-password approach — and more recently, IP-based security — so users would be challenged to provide authentication if they were coming from a different IP address. These steps, she said, were not robust enough.

The problem with Arcot’s solution is that it’s not portable, Jennifer Gilburg, director of business development for identity and authentication services at VeriSign (NYSE: VRSN), told “The user’s identity is tied to the machine on which the credential is installed, so if you want to access your Salesforce account from another machine or your cell phone, that could be a limitation,” she added.

That limitation is common to all browser- and software-based credentials, Gilburg said. VeriSign Identity Protection (VIP) doesn’t have that problem, she added.

VIP consists of a two-factor authentication offered in SaaS form, and a token, the VIP Credential. The VIP Credential is a credit card–size device that uses an algorithm to generate a six-digit number forming the basis of a password.

This number is matched to a password similarly generated by the algorithm on VeriSign’s back-end servers. The device can be used at any company that’s part of the VIP Network, a shared validation infrastructure run off VeriSign’s servers.

“The benefit of our network is you have only one credential, not a pocketful of tokens, that gives you access to multiple sites,” Gilburg said. Users can employ that token to log in to a Web site from any device, including mobile phones.

UPDATED to clarify Arcot uses a transparent software credential.

  • CRM
  • News
  • More Posts By Richard Adhikari