UPDATED: Following its introduction of on-demand authentication for Google Apps users in March, Arcot has extended its tool to Salesforce.com (NYSE: CRM) users.

The service, available on the Force.com AppExchange portal, protects online identities and data with a combination of a transparent software credential, the ArcotID, and a password. This approach is called two-factor authentication .

Salesforce.com has been urging customers to adopt two-factor authentication after a phishing scam in November tricked one of its employees into revealing his password. The perpetrator then copied a customer contact list, leading to subsequent phishing attacks.

Like many of the other security applications for Salesforce.com users, Arcot's software offers single sign-on, which lets users log on to multiple applications or Web sites.

"If you're within the Salesforce application, you can log on to, say, Google Apps and use the same credentials to sign in," Carol Alexander, Arcot's vice president of marketing, told InternetNews.com.

A-OK "adds an additional application for customers who want an option for single sign-on and two-factor authentication," a Salesforce.com spokesperson told InternetNews.com.

According to Alexander, Salesforce.com needed an application like Arcot's. The company previously implemented a username-and-password approach -- and more recently, IP-based security -- so users would be challenged to provide authentication if they were coming from a different IP(define) address. These steps, she said, were not robust enough.

The problem with Arcot's solution is that it's not portable, Jennifer Gilburg, director of business development for identity and authentication services at VeriSign (NYSE: VRSN), told InternetNews.com. "The user's identity is tied to the machine on which the credential is installed, so if you want to access your Salesforce account from another machine or your cell phone, that could be a limitation," she added.

LATEST NEWS

Foes Unite: Google, Telcos Team on Broadband Push
Oracle Helps Linux Get Enhanced Data Integrity
IBM Pitches Tool for Tighter App Dev
Tech Firms Still Ready to Deal
Does Facebook Connect Go Far Enough?

That limitation is common to all browser- and software-based credentials, Gilburg said. VeriSign Identity Protection (VIP) doesn't have that problem, she added.

VIP consists of a two-factor authentication offered in SaaS form, and a token, the VIP Credential. The VIP Credential is a credit card–size device that uses an algorithm to generate a six-digit number forming the basis of a password.

This number is matched to a password similarly generated by the algorithm on VeriSign's back-end servers. The device can be used at any company that's part of the VIP Network, a shared validation infrastructure run off VeriSign's servers.

"The benefit of our network is you have only one credential, not a pocketful of tokens, that gives you access to multiple sites," Gilburg said. Users can employ that token to log in to a Web site from any device, including mobile phones.

UPDATED to clarify Arcot uses a transparent software credential.