Going Password-Free

46093583d8895095adb1b0071c505af2?s=47 Eric Mann
February 03, 2017

Going Password-Free

Passwordless authentication via Tozny as presented at SunshinePHP 2017

46093583d8895095adb1b0071c505af2?s=128

Eric Mann

February 03, 2017
Tweet

Transcript

  1. Going Password-Free Sunshine PHP 2017

  2. 90

  3. 19

  4. hunter2

  5. None
  6. How can we fix it? Password managers help Password strength

    meters (zxcvbn) help Two-factor authentication helps But why require a password at all?
  7. None
  8. A PHP Example Defer to a 3rd party for email

    & validation Use the SlimPHP framework for quick bootstrapping Allow either password or password-less authentication
  9. Authentication Provider Free developer preview Powers both link-based and push-based

    auth Supports PHP (and other langs)
  10. Endpoints $app->get('/', function($request, $response, $args) {
 // Render index view


    return $this->renderer->render($response, 'index.phtml', $args);
 }); $app->get('/register', function($request, $response, $args) {
 // Render registration view
 return $this->renderer->render($response, ‘register.phtml', $args);
 }); $app->get('/authenticated', function($request, $response, $args) {
 // Render protected view
 return $this->renderer->render($response, ‘authenticated.phtml', $args);
 });
  11. Endpoints $app->get('/authenticated', function($request, $response, $args) {
 if ( 
 !

    isset( $_SESSION['username'] ) || 
 ! $this->users->get( $_SESSION['username'] ) 
 ) {
 return $response->withRedirect('/?error=notloggedin');
 }
 
 // Render protected view
 return $this->renderer->render($response, ‘authenticated.phtml', $args);
 });
  12. Endpoints $app->any('/login', function($request, $response, $args) {
 return $response->withRedirect('/?error=invalidlogin');
 }); $app->get('/logout',

    function($request, $response, $args) {
 session_destroy();
 
 return $response->withRedirect('/?loggedout');
 });
  13. None
  14. Middleware class PasswordAuth {
 private $c;
 
 public function __construct($cont)

    {$this->c = $cont;}
 
 public function __invoke($req, $res, $next) {
 $user = $req->getParam(‘username’);
 $pass = $req->getParam(‘password’);
 
 if (empty($u) || empty($p)) return $res = $next($req, res);
 
 if ($this->c->validAuth($user, $pass)) {
 $_SESSION[‘username’] = $user;
 return $res = $res->withRedirect(‘/authenticated’);
 }
 return $res = $res->withRedirect(‘/?error=invalidlogin’);
 }
 }
  15. Endpoints $app->any('/login', function($request, $response, $args) {
 return $response->withRedirect('/?error=invalidlogin');
 })->add(new PasswordAuth($container));

  16. Endpoints $app->any('/login', function($request, $response, $args) {
 if($request->getParam(‘magiclink’) && $request->getParam(‘username’)) {


    $user = $this->users->get($request->getParam(‘username’));
 $sent = sendMagicLink($user->email);
 
 if(‘ok’ === $sent[‘return’])
 return $response->withRedirect(‘/?message=checkemail’);
 }
 return $response->withRedirect('/?error=invalidlogin');
 })->add(new PasswordAuth($container));
  17. Middleware class MagicLinkAuth {
 private $c;
 
 public function __construct($cont)

    {$this->c = $cont;}
 
 public function __invoke($req, $res, $next) {
 $toznyo = $req->getParam(‘toznyo’);
 $toznyr = $req->getParam(‘toznyr’);
 
 if (empty($toznyo) || empty($toznyr)) {
 $res = $next($req, res);
 } else {
 if ($this->c->validLink($toznyo, $toznyr) {
 $user = $this->c->users->getUserFromLink($toznyo);
 $_SESSION[‘username’] = $user->username;
 $res = $res->withRedirect(‘/authenticated’);
 }
 }
 return $res;
 }
 }
  18. Endpoints $app->any('/login', function($request, $response, $args) {
 return $response->withRedirect('/?error=invalidlogin');
 })->add(new PasswordAuth($container))->add(new

    MagicLinkAuth($container));
  19. What just happened? Registered users can authenticate with their password

    Registered users can request a secure, one-time login link sent to their inbox The application doesn’t care which way the users authenticate
  20. How does this benefit us? One less password for users

    to remember More flexible authentication schemes for existing users The middleware stack could be further extended to support TOTP/HOTP/ U2F/etc
  21. What are the risks? Your users’ accounts are only as

    secure as their email
  22. Questions?

  23. Thank You! Eric Mann - @ericmann - http://eam.me/10v - https://tozny.com