What is geofactor authentication

Definition

What is geofactor authentication?

Geofactor authentication uses a proven physical location as an authentication factor: before an action is allowed, a device proves with a signature made in its own secure hardware that it is inside a permitted region, and anyone can check that proof without asking the vendor.

A factor about place

Authentication asks for evidence. Passwords are something you know, phones and keys are something you have, fingerprints are something you are. A geofactor is somewhere you are, and it is worth asking for only if the device can prove the answer.

Location has been used in security for years, mostly as an IP lookup that raises a risk score. That is a signal rather than a factor: a VPN can move it, and nobody else can verify it. A geofactor is a signed statement from the device that it was inside a region at a moment, tied to the action it authorises.

Geofactor authentication and LFA

Geofactor authentication is the general idea. It applies wherever an action should depend on where a device is: a sign-in, a wire approval, a trade, a wager, a data download. Location factor authentication (LFA) is the sign-in case: Octet’s authenticator app and OpenID Connect provider, which add the geofactor to logins you already run.

What makes it a factor rather than a signal

It is bound. The proof is tied to one device, one moment and one challenge, so it cannot be replayed into another session.
It is signed in hardware. The key sits in the Secure Enclave or StrongBox, out of reach of the software that reads the sensors. See device-attested location.
It discloses a verdict. YES, NO or INDETERMINATE for a named region. The coordinates stay on the device.
It is independently verifiable. The proof verifies offline with open-source octet-verify.

Where it is used

Allowing sign-in only while the user’s enrolled phone is in a permitted country.
Stopping a stolen password used from another computer, when policy requires a QR scan at each sign-in. See location factor authentication.
Approving high-value payments only from a permitted place.
Keeping sanctioned or unlicensed jurisdictions out of each transaction, not only at onboarding. See in-process geolocation.
Limiting access to sensitive systems, such as frontier AI models, by country. See Frontier AI access is a location problem.

What this does not establish

A verdict answers for a device, not a person. It says an enrolled device was inside or outside a region at a time. It does not say who was holding it. Use it alongside identity verification, never instead of it. It does raise the cost of cheating: instead of a VPN subscription, a cheater needs real devices and a person in the permitted place for every transaction.