If you do add it, make it optional (maybe I don't care that much about my data in your web app). And choose duo, they rock!
I second the recommendation for Duo. Know them personally and yes they do rock!
Want to be more secure? Build two-factor authentication into your webapp
31–40 of 41 posts
Re: Want to be more secure? Build two-factor authentication into your webapp
#32Before you even think about this can you make sure you've got the basics down. No one in this day and age should have basic SQL injection attacks, but there clearly are given the number of 'whoops we got our database stolen threads'. Add to that Remote Code Injection, XSS, CSRF, Session Fixation Attacks etc.
Re: Want to be more secure? Build two-factor authentication into your webapp
#33Two-factor authentication is by definition more annoying than regular authentication. The solution to security is not to add annoyance for users, who will simply hate your product, or disable two-factor. The solution to security is to come up with better and innovative security solutions. Imagine that you had a "log in with iPhone" button, like the common "log in with Facebook" buttons. It would send down a push noti…
"log in with iPhone" button" - that almost sounds like Two-Factor authentication...? :)
Seriously - how is that any different than turning on your iPhone and clicking on the Google authenticator app to get your code?
Re: Want to be more secure? Build two-factor authentication into your webapp
#34of course the issue with 2 factors is that: - you can still social engineer your way out (!) - "oh i lost my phone and the recovery keys" "heres my name address cc number, etc please help!" (ie nothing has been solved) - its quite annoying to use - it doesnt solve everything, only weak passwords/brute force - it locks you out if you lose your phone/token until you get back home to get your recovery keys - compromisin…
How does compromising the phone compromise the password? I turned on 2 factor auth and the only thing that would be compromised is the code generated by the 2 factor auth. My password is still secure in my head. My password doesn't get used for anything, all my applications have a 1 app only password. An attacker would still need my password...
I think the issue is most people have email on their iphone, so you can send yourself a password reset to your phone, get your password, then use the code also generated on your phone.
Personally I have a pin on my iPhone - and I have my iPhone set to 'reset' itself if there are 10 incorrect pin attempts - so even if I lose my phone, I doubt they would get in...
Re: Want to be more secure? Build two-factor authentication into your webapp
#35If you do add it, make it optional (maybe I don't care that much about my data in your web app). And choose duo, they rock!
Implementations like Duo help only if you're the service provider, right? As a user, independent of the service provider is there anything I can do?
Re: Want to be more secure? Build two-factor authentication into your webapp
#36Two-factor authentication is a good step, a better one is to completely outsource authentication to a third-party single sign-on provider (Google, Facebook, Twitter). It's a little more work upfront than a standard username/password box, but you get out of a ton of annoying hassles by doing this, including email verification, account suspension, enforcing password rotation/complexity, and building two-factor authenti…
No it's not better. If one'e Google Account get hacked. hacker can access all the sites, including yours. SSO offers good UX but not the security.
Well, it leans on the fact that it is more likely that Google has good security and that your web app will probably never reach that kind of security.
It also works the other way around, someones Webapp gets hacked (which is far more likely) and the same password is used for google, you get the same end result, but then it is YOUR fault, and not google's.
Re: Want to be more secure? Build two-factor authentication into your webapp
#37Two-factor authentication is by definition more annoying than regular authentication. The solution to security is not to add annoyance for users, who will simply hate your product, or disable two-factor. The solution to security is to come up with better and innovative security solutions. Imagine that you had a "log in with iPhone" button, like the common "log in with Facebook" buttons. It would send down a push noti…
That cryptographic "login with iPhone" thing has been done, albeit without the biometric dimension you've suggested. http://www.ekaay.com/?lang=en
Unfortunately the SDK is only available for PHP & mysql.
Re: Want to be more secure? Build two-factor authentication into your webapp
#38Earlier quoted context omitted.
"I wish I could log in and check my account balance. If only I hadn't burned one finger, and got a cut on the other!"
I had this problem when I was applying for US citizenship. I was on the crew team in college, which means I had callouses all the time on my fingers, and thus blank fingerpads. I applied for citizenship 3 times over a period of 3 years, and each time got rejected due to poor quality of fingerprints. Finally I stopped rowing and then got my citizenship. I'm sure there's some way around it, but it was kind of amusing a…
Make a mold of someone else's and then wear those to your stamping.
Re: Want to be more secure? Build two-factor authentication into your webapp
#39of course the issue with 2 factors is that: - you can still social engineer your way out (!) - "oh i lost my phone and the recovery keys" "heres my name address cc number, etc please help!" (ie nothing has been solved) - its quite annoying to use - it doesnt solve everything, only weak passwords/brute force - it locks you out if you lose your phone/token until you get back home to get your recovery keys - compromisin…
> compromising the phone (2nd factor for the general public) allow compromising both passwords and the authenticator Unless I've misunderstood how 2-factor authentication works, this is misinformation. The entire point of 2-factor authentication is that you need _both_ factors; i.e., having only one does not compromise the system.
Except in practice you have both factors on the phone (unless you don't use the phone for anything else than .. phone and an authenticator? that just never happens)
so, no, you just need to think about it a little while longer.
Re: Want to be more secure? Build two-factor authentication into your webapp
#40of course the issue with 2 factors is that: - you can still social engineer your way out (!) - "oh i lost my phone and the recovery keys" "heres my name address cc number, etc please help!" (ie nothing has been solved) - its quite annoying to use - it doesnt solve everything, only weak passwords/brute force - it locks you out if you lose your phone/token until you get back home to get your recovery keys - compromisin…
How does compromising the phone compromise the password? I turned on 2 factor auth and the only thing that would be compromised is the code generated by the 2 factor auth. My password is still secure in my head. My password doesn't get used for anything, all my applications have a 1 app only password. An attacker would still need my password...
what do you think happens, when you type the password that's safely stored in your head, onto your phone?:P