$30 off During Our Annual Pro Sale. View Details »

To 2FA, or not to 2FA? Let's answer this question!

To 2FA, or not to 2FA? Let's answer this question!

Two factor authentication the worst, the best, and everything in-between

Looking at 2FA from a user perspective and then in a development and implementation one.

Christine

July 19, 2019
Tweet

More Decks by Christine

Other Decks in Programming

Transcript

  1. @tech_christine
    To 2FA or not to 2FA?
    Let's answer this question!
    Two factor authentication the worst, the best, and everything in-between

    View Slide

  2. Titanium Sponsors
    Platinum Sponsors
    Gold Sponsors

    View Slide

  3. @tech_christine
    Flywheel

    View Slide

  4. View Slide

  5. @tech_christine

    View Slide

  6. View Slide

  7. View Slide

  8. @tech_christine
    Back to the beginning
    To when you signed up for

    View Slide

  9. @tech_christine

    View Slide

  10. @tech_christine
    What was the
    hacker up to?
    Calling your mobile provider

    View Slide

  11. @tech_christine
    Still on the
    phone with your
    mobile
    provider...
    Using social engineering

    View Slide

  12. @tech_christine
    And now they
    have all the
    access...
    Sim swap/sim hijacking

    View Slide

  13. @tech_christine

    View Slide


  14. @tech_christine
    We learned that SMS-based
    authentication is not nearly as
    secure as we would hope, and the
    main attack was via SMS intercept
    Christopher Slowe
    Reddit chief technology officer and founding engineer
    August 2018

    View Slide

  15. @tech_christine
    What is authentication?
    The process of verifying that someone or
    something is the actual entity that they
    claim to be.
    - OWASP.org
    (these people know what they are talking about when it comes to security)

    View Slide

  16. @tech_christine
    ... but what are the different factors of auth?
    1 factor is knowledge (i.e. your password)
    2 is the other method choice
    - Possession (token/soft token)
    - Identity (biometrics)

    View Slide

  17. @tech_christine
    2FA == 2SV == MFA
    2FA = Two factor authentication
    2SV = Two Step verification
    MFA = Multi-factor authentication
    What about all those other acronyms...

    View Slide

  18. @tech_christine
    Why didn't 2FA help?
    •SMS was used
    •2FA wasn't even enabled

    View Slide

  19. @tech_christine
    • Most common
    • Most compromised
    • Not recommended
    by NIST since 2016
    SMS

    View Slide

  20. @tech_christine
    If SMS wasn't bad enough
    •SS7 (network shared by every telecom)
    has it's own vulnerabilities
    •Text messages that are sent can be
    intercepted

    View Slide

  21. @tech_christine
    Let's figure out
    all the ways
    SMS can be
    hacked...
    1. Sim-swap (aka what just
    happened to us)
    2. Port-out scam
    3. Brute force on the
    application itself
    4. Exploit SS7 weakness

    View Slide

  22. @tech_christine
    Time-based One Time Password
    aka app based
    aka soft token
    • Authy
    • Google Authenticator
    • 1Password
    TOTP

    View Slide

  23. @tech_christine
    • Associated with certain
    authorized devices
    • Not visible on a locked
    phone screen
    Push Based

    View Slide

  24. @tech_christine
    Token based
    Physical keys that can auth
    • USB drive
    • near-field communication
    • Many use U2F (Universal
    2nd Factor)

    View Slide

  25. @tech_christine
    OTP vs U2F

    View Slide

  26. @tech_christine
    OTP U2F
    • User has physical
    device
    • Strong security from
    public key
    cryptography
    • No personal
    information associated
    with a key
    • Users type in codes
    • Set up and provision
    required
    • Secrets stored, providing
    a single point of attack

    View Slide

  27. What would you change now?

    View Slide

  28. @tech_christine
    Secure Your Account
    1.Use a VOIP number
    2.Don't reuse passwords
    3.Use long passwords
    4.Secure with alternate authentication method
    5.Pin/password protect phone provider
    Keep on being @awesome

    View Slide

  29. @tech_christine
    But wait...
    •Now you are the developer at an jiffygram (an
    insta rival)
    •How do you secure your users from all the bad stuff
    out there?

    View Slide

  30. @tech_christine
    •Developers
    •Designers
    •Infrastructure
    •Managers
    •Not just info sec!
    Security is everyone's job

    View Slide

  31. @tech_christine
    Back to your security basics
    1. Strong passwords !
    2. Don't make them be rotated
    3. Store the hash securely
    4. Only store sensitive data that you
    need ⛔

    View Slide

  32. https://xkcd.com/936/
    @tech_christine

    View Slide

  33. Do this
    @tech_christine

    View Slide

  34. ⬆ that is 6 a's
    Not this

    @tech_christine

    View Slide

  35. Definitely
    not this
    either
    @tech_christine

    View Slide

  36. @tech_christine
    Let's talk about password hash encryption
    • Just an algorithm that takes data and produces
    fixed-size output
    • Some hashes are stronger then others
    • MD5/SHA-1 = )
    • SHA-256/DES = *
    • If possible with performance, use an adaptive
    one-way function

    View Slide

  37. @tech_christine
    Strong recommended adaptive functions
    1. Argon2 - winner of the password hashing competition,
    should be considered first choice for new applications
    2. PBKDF2 - when FIPS certification or enterprise
    support on many platforms is required
    3. Scrypt - where resisting any/all hardware accelerated
    attacks is necessary but support isn’t
    4. Bcrypt - where PBKDF2 or Scrypt support is not
    available
    Head on over to OWASP.org for more details

    View Slide

  38. @tech_christine
    ...a user lost their phone/app access/token
    • Recovery codes to
    the rescue! +
    • Allows access to
    application
    • Shown once, used
    once

    View Slide

  39. @tech_christine
    lessons learned
    2FA Implementation
    @tech_christine

    View Slide

  40. @tech_christine
    Rate limiting prevents brute force attacks
    @tech_christine

    View Slide

  41. @tech_christine
    Use a truncated exponential back-off algorithm
    @tech_christine

    View Slide

  42. @tech_christine
    What is an exponential back-off algorithm?

    View Slide

  43. @tech_christine
    Example in Ruby
    login_request
    if retries <= max_retries
    retries += 1
    sleep (retries + rand(100)/1000)
    retry
    else
    raise "You've hit your max retries!"
    end

    View Slide

  44. @tech_christine
    Get user buy-in

    View Slide

  45. @tech_christine
    •Make it easy opt in
    •Make it easy to add
    •Make it visible

    View Slide

  46. @tech_christine
    Do this

    View Slide

  47. @tech_christine
    Not this

    American Express
    OpenShift
    Netflix
    Pandora
    Pinterest
    Spotify
    Target
    Best Buy
    Freshbooks
    State Farm
    AT&T
    2FA

    View Slide

  48. @tech_christine
    Enforce authentication on all pages

    View Slide

  49. @tech_christine
    • For editing/removing of
    2FA require credentials
    • If authentication does
    fail, be generic in error
    response
    Moar authentication

    View Slide

  50. Do this
    "Login failed - invalid user ID or password"

    View Slide

  51. Not this
    "Login for User foo: invalid password"
    "Login failed, invalid user ID"
    "Login failed; account disabled"
    "Login failed; this user is not active"

    View Slide

  52. @tech_christine
    Users with the most amount of
    privilege, 2FA is a requirement not
    optional

    View Slide

  53. The answer to the question
    The
    Hitchhiker's
    Guide to the
    Galaxy
    Douglas Adams

    View Slide

  54. @tech_christine
    Yes to 2FA but...
    •Can improve security if you are
    following good password practices
    •Some 2FA methods are more secure
    then others

    View Slide

  55. View Slide

  56. @tech_christine
    Thanks for having me KCDC!
    All the organizers and volunteers deserve
    0 0 0
    Tyson Reeder for the final graphic
    @tysondreeder
    For references and further reading checkout
    https://christine-seeman.com/talks

    View Slide

  57. @tech_christine
    getflywheel.com/about/careers

    View Slide

  58. @tech_christine
    What questions can I answer?

    View Slide

  59. @tech_christine
    Twilio API Example

    View Slide

  60. @tech_christine
    The Ruby One Time Password Library Example

    View Slide

  61. @tech_christine

    View Slide

  62. @tech_christine
    But you need to
    get this code to
    your user...

    View Slide

  63. @tech_christine
    Authy One Touch API Example

    View Slide

  64. @tech_christine
    QR Code Rendering
    https://github.com/whomwah/rqrcode
    ROTP: TOTP
    https://github.com/mdp/rotp
    Twilio Ruby API
    https://www.twilio.com/docs/libraries/ruby
    Auth Ruby API
    https://github.com/twilio/authy-ruby

    View Slide