Upgrade to Pro — share decks privately, control downloads, hide ads and more …

2FA, WTF? at Identity and Security Meetup

Phil Nash
September 19, 2019

2FA, WTF? at Identity and Security Meetup

Everyone is hacking everything. Everything is vulnerable. Your site, your users, even you. Are you worried about this? You should be!

Don't worry, I'm not trying to scare you (that much). We have plenty of safeguards against attempts on our applications' user data. We all (hopefully) recognise Two Factor Auth as one of those safeguards, but what actually goes on under the hood of 2FA?

We'll take a look into generating one time passwords, implementing 2FA in web applications and the only real-life compelling use case for QR codes. Together, we'll make the web a more secure place.

Phil Nash

September 19, 2019

More Decks by Phil Nash

Other Decks in Programming


  1. ARE

  2. Mat Honan's Hackers' Timeline 1. Found Gmail address on his

    personal site 2. Entered address in Gmail and found his @me.com back up email 3. Called Amazon to add a credit card to file 4. Called Amazon again to reset password and got access 5. 4:33pm: called Apple to reset password 6. 4:50pm: reset AppleID password and gained access to email @philnash
  3. Mat Honan's Hackers' Timeline 7. 4:52pm: reset Gmail account password

    8. 5:01pm: wiped iPhone 9. 5:02pm: reset Twitter password 10. 5:05pm: wiped MacBook and deleted Google account 11. 5:12pm: posted to Twitter taking credit for the hack @philnash
  4. Ashley Madison Top 10 Passwords 1. 123456 - 120,511 users

    2. 12345 - 48,452 users 3. password - 39,448 users 4. DEFAULT - 34,275 users 5. 123456789 - 26,620 users 6. qwerty - 20,778 users 7. 12345678 - 14,172 users 8. abc123 - 10,869 users 9. NSFW - 10,683 users 10. 1234567 - 9,468 users Source: http:/ /qz.com/501073/the-top-100-passwords-on-ashley-madison/ @philnash
  5. Compromised sites • Adobe • Yahoo • LinkedIn • Tumblr

    • MySpace • DropBox • Bitly • Disqus @philnash
  6. 2FA

  7. Two Factor Authentication 2FA is a security process in which

    a user provides two different forms of identification in order to authenticate themself with a system. The two forms must come from different categories. Normally something you know and something you have. @philnash
  8. SMS

  9. 2FA import random random_num = random.randint(0, 999999) code = str(random_num).rjust(6,

    "0") user.login_code = code user.save() 01. 02. 03. 04. 05. 06. @philnash
  10. 2FA from twilio.rest import Client import os client = Client(os.environ['ACCOUNT_SID'],

    os.environ['AUTH_TOKEN']) message = client.messages.create( to=user.phone_number, from_=os.environ['PHONE_NUMBER'], body=f'Your login code is {code}') 01. 02. 03. 04. 05. 06. 07. 08. @philnash
  11. SS7

  12. Tokens: Cons Requires a smart phone Needs backup codes to

    recover account QR codes can be intercepted @philnash
  13. Push: Cons Requires a smart phone Requires a native app

    Requires more work on your web application Can't use offline @philnash