Two Factor Authentication and You

Slide 1

Slide 1 text

Slide 2

Slide 2 text

Chris Stone | E-Moxie | @cmstone | php[tek] 2014 | Two Factor Authentication and You | https://joind.in/10645 2 WHO AM I? •President and Co-Founder of E-Moxie - www.emoxie.com •Baltimore, MD •PHP Developer, System Administrator, Tinkerer •Meetup Organizer - Baltimore PHP/Mobile/API •Trainer •Maximize efﬁciencies and make life easier (mainly mine) •I’ve seen things, and learned a bit on the way ! [email protected] Twitter: @cmstone

Slide 3

Slide 3 text

Slide 4

Slide 4 text

Chris Stone | E-Moxie | @cmstone | php[tek] 2014 | Two Factor Authentication and You | https://joind.in/10645 4 WHAT IS TWO FACTOR AUTH? •Not a new concept •Two pieces of information needed (in addition to a username) •Something you know and something you have •First factor is typically a password (The know) •Second factor is typically a uniquely generated code (The have)

Slide 5

Slide 5 text

Slide 6

Slide 6 text

Slide 7

Slide 7 text

Slide 8

Slide 8 text

Slide 9

Slide 9 text

Chris Stone | E-Moxie | @cmstone | php[tek] 2014 | Two Factor Authentication and You | https://joind.in/10645 9 E-MAIL - THE BAD :( •Prone to failure •Delivery problems •Message blocking •SPAM •Send/Receive Problems •Requires Internet/Network Access •More mail?? Who really wants to get more?

Slide 10

Slide 10 text

SMS

Slide 11

Slide 11 text

Slide 12

Slide 12 text

Chris Stone | E-Moxie | @cmstone | php[tek] 2014 | Two Factor Authentication and You | https://joind.in/10645 12 SMS - BAD THINGS :( •Can’t receive SMS •Could cost money •Network •Delivery delays •Lost messages •Power? •Threat could have access to a web front end! •Susceptible to architecture issues

Slide 13

Slide 13 text

Slide 14

Slide 14 text

Chris Stone | E-Moxie | @cmstone | php[tek] 2014 | Two Factor Authentication and You | https://joind.in/10645 14 NEXMO •php[tek] Sponsor - yay! •Shared short code •REST API ! •API Key & Secret •Destination & Pin curl "https://rest.nexmo.com/sc/us/2fa/json?api_key={api_key} &api_secret={api_secret}&to=14435281326&pin=1234"

Slide 15

Slide 15 text

MOBILE APP

Slide 16

Slide 16 text

Slide 17

Slide 17 text

Slide 18

Slide 18 text

Chris Stone | E-Moxie | @cmstone | php[tek] 2014 | Two Factor Authentication and You | https://joind.in/10645 18 •Easy to use •DOES NOT rely on an Internet connection •DOES NOT rely on cellular connection •Google just provides the app •Implements time-based on-time passwords (TOTP) •Open source (kind of) •All of those password thefts? Could be kind of a non-issue •Not just for websites GOOGLE AUTHENTICATOR

Slide 19

Slide 19 text

Slide 20

Slide 20 text

Chris Stone | E-Moxie | @cmstone | php[tek] 2014 | Two Factor Authentication and You | https://joind.in/10645 20 TOTP •Time-based One-time Password Algorithm •Computed from a shared secret key and the current time. •Combines secret with timestamp using a cryptographic hash func •Typically increases in 30-second intervals •Allows for a time drift •RFC 6238

Slide 21

Slide 21 text

Slide 22

Slide 22 text

Slide 23

Slide 23 text

Chris Stone | E-Moxie | @cmstone | php[tek] 2014 | Two Factor Authentication and You | https://joind.in/10645 https://github.com/cmstone/phptek2014-‐two-‐factor/ 23 WORKFLOW OVERVIEW $username = '[email protected]'; $userkey = TwoFactor::generateKey(); $timestamp = TwoFactor::getTimestamp(); ! $secretKey = Base32::decode($userkey); $currentPassword = TwoFactor::getSecret($secretKey, $timestamp);

Slide 24

Slide 24 text

Chris Stone | E-Moxie | @cmstone | php[tek] 2014 | Two Factor Authentication and You | https://joind.in/10645 https://github.com/cmstone/phptek2014-‐two-‐factor/ 24 Step 1 - Generate a random secret key TwoFactor::generateKey(); ——————— public static function generateKey($length = 16) { $key = ""; ! for ($i = 0; $i < $length; $i++) { $key .= Base32::getRandom(); } ! return $key; } ! // Gives you something like: CHBEYSUCFDAECIHM WORKFLOW

Slide 25

Slide 25 text

Slide 26

Slide 26 text

Chris Stone | E-Moxie | @cmstone | php[tek] 2014 | Two Factor Authentication and You | https://joind.in/10645 https://github.com/cmstone/phptek2014-‐two-‐factor/ 26 Step 2 - Get the current timestamp TwoFactor::getTimestamp(); ——————— public static function getTimestamp() { return floor(microtime(true) / self::keyRegeneration); } ! // Gives you something like: 46692614 WORKFLOW

Slide 27

Slide 27 text

Chris Stone | E-Moxie | @cmstone | php[tek] 2014 | Two Factor Authentication and You | https://joind.in/10645 https://github.com/cmstone/phptek2014-‐two-‐factor/ 27 WORKFLOW Step 3 - Decode $userkey = TwoFactor::generateKey(); $timestamp = TwoFactor::getTimestamp(); ! $secretKey = Base32::decode($userkey); ! // $secretKey = ?LJ?(?A ?

Slide 28

Slide 28 text

Chris Stone | E-Moxie | @cmstone | php[tek] 2014 | Two Factor Authentication and You | https://joind.in/10645 https://github.com/cmstone/phptek2014-‐two-‐factor/ 28 WORKFLOW $currentPassword = TwoFactor::getSecret($secretKey, $timestamp); ——————— public static function getSecret($key, $counter) { if (strlen($key) < 8) { throw new Exception('Secret key is too short. Must be at least 16 base 32 characters'); } ! $bin_counter = pack('N*', 0) . pack('N*', $counter); // Counter must be 64-‐bit int $hash = hash_hmac('sha1', $bin_counter, $key, true); ! return str_pad(self::oathTruncate($hash), self::otpLength, '0', STR_PAD_LEFT); } ! // $currentPassword = 373604 Step 4 - Decode

Slide 29

Slide 29 text

Chris Stone | E-Moxie | @cmstone | php[tek] 2014 | Two Factor Authentication and You | https://joind.in/10645 29 ADDITIONAL RESOURCES Bypassing two-factor authentication http://shubh.am/how-i-bypassed-2-factor-authentication-on-google- yahoo-linkedin-and-many-others/ ! Google Authenticator Code: https://code.google.com/p/google-authenticator/

Slide 30

Slide 30 text

Slide 31

Slide 31 text