No More Post-its: Boost your login security with APIs

Transcript

1. No More Post-its: Boost your login security with APIs PRESENTED BY: Alvaro Navarro Senior Developer Advocate, Vonage
2. 91 % 2
3. 91 % Cyberattacks started with a phishing email 3 according to a security report by Deloitte, AAG and ASEE)
4. 4 2020
6. Services collects our personal data, which could be leaked!
7. More sophisticated attacks to steal our data Leaked data +
8. Fraud is everywhere 8
9. is there anything we can do to feel safer? 9
11. How to improve the security of your users using APIs 11
12. 3 factors of authentication 12
13. Something you know Something you have Something you are
14. Something you know
15. Let’s talk about passwords 15
16. If you know the secret, you must be the right person
17. If you know the secret, you must be the right person
18. What’s wrong with Passwords? • Easy to forget. Force users to follow complex patterns difficult to remember
21. What’s wrong with Passwords? • Easy to forget. Force users to follow complex patterns difficult to remember • (Sometimes) Easy to guess
23. What’s wrong with Passwords? • Easy to forget. Force users to follow complex patterns difficult to remember • (Sometimes) Easy to guess • (Sometimes) Easy to crack
25. 25 What is your password? It’s my cat name and a random number
26. 26 What is your password? It’s my cat name and a random number You’ve got this cat for a while? Yeah, she’s my childhood pet
27. 27 What is your password? It’s my cat name and a random number You’ve got this cat for a while? Yeah, she’s my childhood pet Ohh… what’s her name? Her name is Jolie
28. 28 What is your password? It’s my cat name and a random number You’ve got this cat for a while? Yeah, she’s my childhood pet Ohh… what’s her name? Her name is Jolie So your password would be Jolie and then number… Like number one… Uh… like.. My birthday
29. 29 What is your password? It’s my cat name and a random number You’ve got this cat for a while? Yeah, she’s my childhood pet Ohh… what’s her name? Her name is Jolie So your password would be Jolie and then number… Like number one… Uh… like.. My birthday Oh, and when is your birthday? June 12th
34. 34 mypassword 91dfd9ddb4198affc5c194cd8ce6d338fde470e2 https://api.pwnedpasswords.com/range/91dfd
36. Something you have
37. OTP (one-time-passwords) 37
38. But not Jolie6695 38
39. 39 two-factor authentication (2FA)
40. 40 Message App Push Notification Hardware
41. 41 Message App Push Notification Hardware Still the most used 2FA method!
42. 42 Something you have Verify API Prevent fraud with two-factor authentication
45. 45 But… What if…
47. 47 SIM Swap attack • Hijacking your phone number by linking it with a different SIM card • Sending a message is not safe anymore!
48. 48 https://camaraproject.org/ APIs enabling seamless access to Telco network capabilities
49. 49 Something you have SIM Swap API • Determine if the SIM Card linked to a phone number has recently changed • Make sure that the user’s mobile number can be used for authentication purposes.
52. 52 Something you have SIM Swap API Determine if the SIM Card linked to a phone number has recently changed
55. 55 2FA enabled SIM swap not detected ✅ ✅
56. 56 But… What if…
57. 57 • We want to keep users logged in but we don’t want to go through all these steps again • Use mobile data to verify users!
58. 58 Something you have Number Verification API Verify end-users using mobile data over 5G
59. 59 Something you have
60. 60 Something you have
61. 61 Mobile Operator Auth URL
62. 62 Mobile Operator Auth URL Backend Callback
63. 63 Mobile Operator Auth URL Backend Callback Number Verification API call
64. 64 Mobile Operator Auth URL Backend Callback True / False Number Verification API call
65. Something you are
66. Integrate image and video analysis capabilities into their applications via API 66 Something you are
68. Something you know Something you have Something you are
69. Something you know Something you have Something you are Somewhere you are
71. Verify whether the location of an end-user is within a specified area 71 Somewhere you are Device Location Verification API
76. 76 To recap
77. Verify API SIM Swap API Number Verification API Amazon Rekognition API Device Location API Something you have Something you are Somewhere you are Something you know I have been pwned API
78. Thank You! developer.vonage.com developer.vonage.com/blog