Upgrade to Pro — share decks privately, control downloads, hide ads and more …

One does not simply add MFA

November 29, 2022

One does not simply add MFA


November 29, 2022

More Decks by Christine

Other Decks in Technology


  1. @[email protected] One does not simply add MFA Just like a

    walk into Mordor, good MFA is a journey
  2. @[email protected] What you will learn ✓ What is MFA ✓

    How to secure your accounts ✓ What are the MFA types ✓ How to protect users and secure an application ✓ Potential testing steps ✓ MFA implementation best practices "Its black gates are guarded by more than just orcs. "
  3. @[email protected] Taking notes or pictures 📝 Asking foolish questions 🤔

    christine-seeman.com/talks Things you don't need to worry about "There is evil there that does not sleep, and the Great Eye is ever watchful"
  4. “ @[email protected] We learned that SMS-based authentication is not nearly

    as secure as we would hope, and the main attack was via SMS intercept Christopher Slowe Reddit chief technology of fi cer and founding engineer August 2018
  5. @[email protected] What is authentication? The process of verifying that someone

    or something is the actual entity that they claim to be. - OWASP.org (these people know what they are talking about when it comes to security)
  6. @[email protected] ... but what are the different factors of auth?

    ✔Factor is knowledge (i.e. your password) ✔Is the other method choice - Possession (token/soft token) - Identity (biometrics)
  7. @[email protected] 2FA = 2SV = MFA = 2F? = ???

    What about all those other acronyms...
  8. @[email protected] If SMS wasn't bad enough •SS7 (network shared by

    every telecom) has it's own vulnerabilities •Text messages that are sent can be intercepted
  9. @[email protected] Let's figure out all the ways to hack it...

    1. Sim-swap (aka what just happened to us) 2. Port-out scam 3. Brute force on the application itself 4. Exploit SS7 weakness
  10. @[email protected] Security Questions • User answers a set of questions

    during sign-up • For example • Merry’s mother’s maiden name? • What is the shire’s address? • Just an extension of your first factor, password (knowledge) ❓ ❓
  11. @[email protected] Email • At login time, an email with verification

    code is sent to user • Convient • Should only be used with verified emails • Less Common, may be in use but may not referred to as MFA
  12. @[email protected] Time-based One Time Password aka app based aka soft

    token • Authy • Google Authenticator • 1Password TOTP
  13. @[email protected] Token based Physical keys that can auth • FIDO2/WebAuthn

    • USB drive • near- fi eld communication • Many use U2F (Universal 2nd Factor)
  14. @[email protected] OTP U2F • User has physical device • Strong

    security from public key cryptography • No personal information associated with a key • Users type in codes • Set up and provision required • Secrets stored, providing a single point of attack
  15. @[email protected] Secure Your Account 1. Use long password/passphrase 2. Secure

    with alternate authentication method 3. Use a VOIP number 4. Don't reuse passwords 5. Pin/password protect phone provider Keep on being @awesome
  16. @[email protected] Not that twist... Now you are the developer at

    shiregram (an insta rival) How do you secure your users from all the bad stuff out there?
  17. @[email protected] • Developers • Designers • Infrastructure • Managers •

    Not just info sec! Security is everyone's job YOU MEAN TO TELL ME INFORMATION SECURITY IS PART OF MY JOB TOO!?
  18. @[email protected] Back to your security basics 1. Strong passwords/passphrase 💪

    2. Don't make them be rotated 🔁 3. Store the hash securely 🔒 4. Only store sensitive data that you need ⛔
  19. @[email protected] Why this helps •Greater entropy = harder to brute

    force the password •Passwords should be hard to guess, but easy to remember •Extra length + randomness allows for more entropy (strength)
  20. @[email protected] Let's talk about password hash encryption • Just an

    algorithm that takes data and produces fixed-size output • Some hashes are stronger then others • MD5/SHA-1 = 👎 • SHA-256/512-bit SHA-2= 👍 • If possible with performance, use an adaptive one-way function
  21. “ @[email protected] …we made the decision to rotate customer accounts

    on May 5, 2022, out of an abundance of caution due to not all of the customers having multi-factor authentication (MFA) enabled at the time and potential for password reuse. Bob Wise Heroku General Manager and Salesforce
  22. @[email protected] ...a user lost their phone/app access/token • Recovery codes

    to the rescue! 🦹 • Allows access to application • Shown once, used once
  23. @[email protected] If you choose to BUY •Choose your vendor wisely

    •What factor choices are available? •What are your authorization and authentication needs? •Can you export your data?
  24. @[email protected] If you choose DIY More flexibility More security surface

    area to cover More control over the user experience
  25. @[email protected] ✓ Make it easy opt in ✓ Make it

    easy to add ✓ Make it visible ✓Make it flexible Make it easy on your users
  26. @[email protected] Not this 😢 American Express OpenShift Net fl ix

    Pandora Pinterest Spotify Target Best Buy State Farm AT&T Twitter (well not right now) 🚫 MFA
  27. @[email protected] • For editing/removing of MFA require credentials • If

    authentication does fail, be generic in error response More authentication IT COMES IN PINTS?
  28. Not this "Login for User awesome: invalid password" "Login failed,

    invalid user ID" "Login failed; account disabled" "Login failed; this user is not active" 😖
  29. @[email protected] MFA can help but... Can only improve security if

    you are following secure password practices Some MFA methods are more secure then others
  30. Thanks for having me WP Engine Omaha friends! Thanks to:

    Tyson Reeder for the final graphic @tysondreeder For references and further reading checkout christine-seeman.com/talks Find me on mastodon @[email protected]
  31. @[email protected] QR Code Rendering https://github.com/whomwah/rqrcode ROTP: TOTP https://github.com/mdp/rotp Twilio Ruby

    API https://www.twilio.com/docs/libraries/ruby Auth Ruby API https://github.com/twilio/authy-ruby