two-factor security model for a web-site

I've been asked to look in to the possibility of implementing a two-factor security model for a web application.

It has been suggested that a USB dongle (or something similar) is used to verify the user before they enter the website.

Does anybody have experiences of such an application and how did they go about achiving it?

I am looking to use PHP for the web application side of it. I see it would be likely that some sort of client side applet would need to run to communicate with a USB dongle? Maybe Java?

I'd appreciate any advice, comments, product suggestions.

Thanks.

If you want to implement your own scheme for authentication, you would have to write a plugin for the browser which all users have to install.

But there is already a pre-made solution: SSL. SSL supports not only server authentication but also client auth.
If you want the users to take their key with them, you can put the client certificate on the usb stick (or a chip card or floppy disk... they are all equally "secure").

There is docs out there on the 'net, but I could not find anything quickly. Look for the SSL howto on http://tldp.org or something.

HTH,
M.

Installing a custom certificate on each machine a person uses could be messy. Plus is it allowed on machines which may be used in Government or a cybercafe?

I will get somebody to look more in to this suggestion.

The problem is the clients are mobile, and would need to log in to the web-application from any possible Internet terminal.

One idea was something like the RSA SecureID. However their product is very expensive.

A similar system could be achieved using mobile phones and SMS maybe. But then there is the cost of the sending of an SMS from the server.

Try the new 2FactorSMS component from www.zone443.com. This product is designed for Microsoft websites and provides a means of sending one-time passwords to mobile phones via SMS messages. The beta version of 2FactorSMS supports over 400 mobile phone networks in over 150 countries around the world.

As you said, the message cost will come into account, but the initial setup cost is extremely low.

Cheers,
Craig.