Want to be more secure? Build two-factor authentication into your webapp
blog.alainmeier.com
Want to be more secure? Build two-factor authentication into your webapp
1–10 of 41 posts
Re: Want to be more secure? Build two-factor authentication into your webapp
#2Two-factor authentication is by definition more annoying than regular authentication. The solution to security is not to add annoyance for users, who will simply hate your product, or disable two-factor.
The solution to security is to come up with better and innovative security solutions.
Imagine that you had a "log in with iPhone" button, like the common "log in with Facebook" buttons. It would send down a push notification to your iPhone that shows a dialog "Log in to hn.com? Yes | No." Pressing Yes uses fingerprint-sensing capability under the touchscreen to send anonymized[^1] biometric information to provider to authorize the login with.
You'd also get a smartphone app to generate temporary login keys for when you need to give a friend access to your account, and get a 32-byte "master" key that can be used to unlock the account without biometric access.
[^1]: simply a HMAC / hash value using both the biometric data + the domain being authorized would deal with privacy concerns.
Re: Want to be more secure? Build two-factor authentication into your webapp
#3Chances are the only ones who will try this are your users already using two-factor auth somewhere else, and it's most likely they got started with Google. Might as well use an app that's already on their phones, Google Authenticator (http://news.ycombinator.com/item?id=4348475)
Re: Want to be more secure? Build two-factor authentication into your webapp
#4Please don't. I need to secure my gmail because it can be used to request password resets from any account and so is in some way the master key to my online life.
Re: Want to be more secure? Build two-factor authentication into your webapp
#5Two-factor authentication is by definition more annoying than regular authentication. The solution to security is not to add annoyance for users, who will simply hate your product, or disable two-factor. The solution to security is to come up with better and innovative security solutions. Imagine that you had a "log in with iPhone" button, like the common "log in with Facebook" buttons. It would send down a push noti…
I'm not a fan of biometrics (I have a fingerprint reader on my laptop) because you can't change your password once it's stolen.
The "Log-in with your iPhone?" could be coupled with some kind of non-biometric authentication and that would be better. But honestly, two-factor with strong passwords are more than enough. The dismal security scenario is mostly cultural, not technological.
Re: Want to be more secure? Build two-factor authentication into your webapp
#6Please don't. I need to secure my gmail because it can be used to request password resets from any account and so is in some way the master key to my online life.
There are plenty of other apps you want to keep as secure as possible. For me it's: web hosts, DNS providers, Dropbox and source control hosts (GitHub/BitBucket).
Re: Want to be more secure? Build two-factor authentication into your webapp
#7Chances are the only ones who will try this are your users already using two-factor auth somewhere else, and it's most likely they got started with Google. Might as well use an app that's already on their phones, Google Authenticator ( http://news.ycombinator.com/item?id=4348475 )
Who says it's optional? I make primarily B2B web apps, it's very easy to require all users begin using two factor auth.
Re: Want to be more secure? Build two-factor authentication into your webapp
#8None of these options work for the enterprise and only google authenticator works for B2C. The days of just providing 2-FA are over, companies now need to use an authentication broker, or 2-Factor STS (ping & rsa together or secureauth)
Re: Want to be more secure? Build two-factor authentication into your webapp
#9Two-factor authentication is by definition more annoying than regular authentication. The solution to security is not to add annoyance for users, who will simply hate your product, or disable two-factor. The solution to security is to come up with better and innovative security solutions. Imagine that you had a "log in with iPhone" button, like the common "log in with Facebook" buttons. It would send down a push noti…
Oh yeah, that'll be way more convenient. Right up until you need to login when your phone is out of batteries, not in wireless coverage, under water, etc.
Re: Want to be more secure? Build two-factor authentication into your webapp
#10Two-factor authentication is a good step, a better one is to completely outsource authentication to a third-party single sign-on provider (Google, Facebook, Twitter). It's a little more work upfront than a standard username/password box, but you get out of a ton of annoying hassles by doing this, including email verification, account suspension, enforcing password rotation/complexity, and building two-factor authentication flows into your app.