I'm sure you've all heard of two-factor/multi-factor authentication. Basically it comes down to these factors:


Knowledge - something you know (e.g. password, PIN, pattern)
Possession - something you have (e.g. mobile phone, credit card, key)
Existence - something you are (e.g. fingerprint)


My question is: Does a fourth factor of authentication exist?

A quick search on Google did not bring any interesting results other than a patent document that I didn't bother reading through. Could somewhere you are be considered a fourth factor?

As you noted, the main three are:


Something you know
Something you have
Something you are


I'd argue that there are others:


Something you can do, e.g. accurately reproducing a signature.
Something you exhibit, e.g. a particular personality trait, or even neurological behaviour that could be read by an fMRI. These are not strictly "are" features, as they're more fluid.
Someone you know, e.g. authentication by chain of trust.
Somewhere you are (or have access to), e.g. locking a session to an IP, or sending a confirmation pin to your address. This one is a bit tenuous in terms of being called an authentication factor, but it's still useful to note.

