$30 off During Our Annual Pro Sale. View Details »


November 15, 2022



November 15, 2022

More Decks by Christine

Other Decks in Technology


  1. @[email protected]
    One does not simply add MFA

    Just like a walk into Mordor, good MFA is a journey

    View Slide

  2. @[email protected]
    What you will learn
    ✓ What is MFA

    ✓ How to secure your accounts

    ✓ What are the MFA types

    ✓ How to protect users and
    secure an application

    ✓ Potential testing steps

    ✓ MFA implementation best
    "Its black gates are guarded by more than just orcs. "

    View Slide

  3. @[email protected]
    Taking notes or pictures 📝

    Asking foolish questions 🤔

    Things you don't need to worry about
    "There is evil there that does not sleep, and the Great Eye is ever watchful"

    View Slide

  4. View Slide

  5. View Slide

  6. View Slide

  7. @[email protected]
    Back to the beginning
    To when you signed up for

    View Slide

  8. View Slide

  9. View Slide

  10. View Slide

  11. @[email protected]
    What was the
    hacker up to?
    Calling your mobile provider

    View Slide

  12. @[email protected]
    On the phone
    with your mobile
    Using social engineering

    View Slide

  13. @[email protected]
    Now they have
    all the access...
    Sim swap/sim hijacking

    View Slide

  14. View Slide

  15. @[email protected]

    View Slide

  16. View Slide

  17. @[email protected]
    We learned that SMS-based
    authentication is not nearly as
    secure as we would hope, and the
    main attack was via SMS intercept

    Christopher Slowe

    Reddit chief technology of
    cer and founding engineer

    August 2018

    View Slide

  18. @[email protected]
    What is authentication?
    The process of verifying that someone or
    something is the actual entity that they claim
    to be.

    - OWASP.org

    (these people know what they are talking about when it comes to security)

    View Slide

  19. @[email protected]
    ... but what are the different factors of auth?
    ✔Factor is knowledge (i.e. your password)

    ✔Is the other method choice

    - Possession (token/soft token)

    - Identity (biometrics)

    View Slide

  20. @[email protected]
    2FA = 2SV = MFA = 2F? = ???

    What about all those other acronyms...

    View Slide

  21. @[email protected]
    Why didn't MFA help?
    •SMS was used

    •For most users MFA won’t even be enabled

    View Slide

  22. @[email protected]
    • Most common

    • Most compromised

    • Not recommended
    by NIST since 2016

    View Slide

  23. @[email protected]
    If SMS wasn't bad enough
    •SS7 (network shared by every telecom) has
    it's own vulnerabilities

    •Text messages that are sent can be

    View Slide

  24. @[email protected]
    Let's figure out
    all the ways to
    hack it...
    1. Sim-swap (aka what just
    happened to us)
    2. Port-out scam
    3. Brute force on the
    application itself
    4. Exploit SS7 weakness

    View Slide

  25. @[email protected]
    • Associated with certain
    authorized devices

    • Not visible on a locked
    phone screen
    Push Based

    View Slide

  26. @[email protected]
    … Push Based has
    major drawbacks too
    September 15th, 2022

    View Slide

  27. @[email protected]
    Security Questions
    • Convient

    • Just an extension of your first factor,
    password (knowledge)
    ❓ ❓

    View Slide

  28. @[email protected]
    • Convient

    • Should only be used with
    verified emails

    • Less Common, may be in use
    but not referred to as 2FA

    View Slide

  29. @[email protected]
    Time-based One Time Password

    aka app based

    aka soft token

    • Authy

    • Google Authenticator

    • 1Password

    View Slide

  30. @[email protected]
    Token based
    Physical keys that can auth

    • FIDO2/WebAuthn

    • USB drive

    • near-
    eld communication

    • Many use U2F (Universal
    2nd Factor)

    View Slide

  31. @[email protected]
    OTP vs U2F

    View Slide

  32. @[email protected]
    OTP U2F
    • User has physical device

    • Strong security from
    public key cryptography

    • No personal information
    associated with a key
    • Users type in codes

    • Set up and provision required

    • Secrets stored, providing a
    single point of attack

    View Slide

  33. What would you change now?

    View Slide

  34. @[email protected]
    Secure Your Account
    1. Use long password/passphrase

    2. Secure with alternate authentication method

    3. Use a VOIP number

    4. Don't reuse passwords

    5. Pin/password protect phone provider

    Keep on being @awesome

    View Slide

  35. @[email protected]
    But wait...
    Now you are the developer at jiffygram (an insta rival)

    How do you secure your users from all the bad stuff
    out there?

    View Slide

  36. @[email protected]
    • Developers

    • Designers

    • Infrastructure

    • Managers

    • Not just info sec!
    Security is everyone's job

    View Slide

  37. @[email protected]

    View Slide

  38. @[email protected]

    View Slide

  39. @[email protected]
    Back to your security basics
    1. Strong passwords/passphrase 💪

    2. Don't make them be rotated 🔁

    3. Store the hash securely 🔒

    4. Only store sensitive data that you need ⛔

    View Slide

  40. https://xkcd.com/936/ @[email protected]

    View Slide

  41. @[email protected]
    Why this helps
    •Greater entropy = harder to brute force the password

    •Passwords should be hard to guess, but easy to remember

    •Extra length + randomness allows for more entropy

    View Slide

  42. View Slide

  43. View Slide

  44. Do this 😄

    View Slide

  45. View Slide

  46. View Slide

  47. Not this 😞

    View Slide

  48. ⬆ that is 6 a's

    View Slide

  49. ⬆ that is just six aaaaaa that ended up working

    View Slide

  50. @[email protected]
    Let's talk about password hash encryption
    • Just an algorithm that takes data and produces fixed-size output

    • Some hashes are stronger then others

    • MD5/SHA-1 = 👎

    • SHA-256/512-bit SHA-2= 👍

    • If possible with performance, use an adaptive one-way function

    View Slide

  51. @[email protected]
    Strong recommended adaptive functions




    Head on over to OWASP.org for more details

    View Slide

  52. @[email protected]
    …we made the decision to rotate customer
    accounts on May 5, 2022, out of an abundance
    of caution due to not all of the customers
    having multi-factor authentication (MFA)
    enabled at the time and potential for password

    Bob Wise

    Heroku General Manager and Salesforce

    View Slide

  53. @[email protected]
    ...a user lost their phone/app access/token
    • Recovery codes to
    the rescue! 🦹

    • Allows access to

    • Shown once, used

    View Slide

  54. Choose your path

    View Slide

  55. @[email protected]
    If you choose to BUY
    •Choose your vendor wisely

    •What factor choices are available?

    •What are your authorization and
    authentication needs?

    View Slide

  56. @[email protected]
    If you choose DIY
    More flexibility
    More security surface area to cover
    More control over the user experience

    View Slide

  57. @[email protected]
    Rate limiting prevents brute force attacks

    View Slide

  58. @[email protected]
    Rate limiting prevents brute force attacks

    View Slide

  59. @[email protected]
    Use a truncated exponential back-off algorithm

    View Slide

  60. @[email protected]
    What is an exponential back-off algorithm?

    View Slide

  61. @[email protected]
    Get user buy-in

    View Slide

  62. View Slide

  63. @[email protected]
    ✓ Make it easy opt in

    ✓ Make it easy to add

    ✓ Make it visible

    ✓Make it flexible

    View Slide

  64. @[email protected]
    Not this 😢
    American Express







    Best Buy

    State Farm


    Twitter (well not right now)
    🚫 MFA

    View Slide

  65. @[email protected]
    • For editing/removing of
    MFA require credentials

    • If authentication does
    fail, be generic in error
    More authentication

    View Slide

  66. Do this

    "Login failed - invalid user ID or password"


    View Slide

  67. Not this

    "Login for User awesome: invalid password"

    "Login failed, invalid user ID"

    "Login failed; account disabled"

    "Login failed; this user is not active"


    View Slide

  68. @[email protected]
    Are we doing all we can to protect our users?

    View Slide

  69. View Slide

  70. @[email protected]
    Users with the most amount of
    privilege, 2FA is a requirement
    not optional

    View Slide

  71. View Slide

  72. @[email protected]
    MFA can help but...
    • Can only improve security if you are
    following secure password practices

    • Some MFA methods are more secure
    then others

    View Slide

  73. View Slide

  74. @[email protected]
    Thanks for having me PetFriendly!

    Tyson Reeder for the final graphic


    For references and further reading checkout


    View Slide

  75. @[email protected]
    What questions can I answer?

    View Slide

  76. code!!

    View Slide

  77. @[email protected]
    Twilio API Example

    View Slide

  78. @[email protected]
    The Ruby One Time Password Library Example

    View Slide

  79. View Slide

  80. @[email protected]
    But you need to
    get this code to
    your user...

    View Slide

  81. @[email protected]
    Authy One Touch API Example

    View Slide

  82. @[email protected]
    QR Code Rendering
    Twilio Ruby API
    Auth Ruby API

    View Slide