To 2FA, or not to 2FA? Let's answer this question!

@tech_christine To 2FA or not to 2FA? Let's answer this
question! Two factor authentication the worst, the best, and everything in-between

Titanium Sponsors Platinum Sponsors Gold Sponsors

@tech_christine Flywheel

@tech_christine

@tech_christine Back to the beginning To when you signed up
for

@tech_christine

@tech_christine What was the hacker up to? Calling your mobile
provider

@tech_christine Still on the phone with your mobile provider... Using
social engineering

@tech_christine And now they have all the access... Sim swap/sim
hijacking

@tech_christine

“ @tech_christine We learned that SMS-based authentication is not nearly
as secure as we would hope, and the main attack was via SMS intercept Christopher Slowe Reddit chief technology ofﬁcer and founding engineer August 2018

@tech_christine What is authentication? The process of verifying that someone
or something is the actual entity that they claim to be. - OWASP.org (these people know what they are talking about when it comes to security)

@tech_christine ... but what are the different factors of auth?
1 factor is knowledge (i.e. your password) 2 is the other method choice - Possession (token/soft token) - Identity (biometrics)

@tech_christine 2FA == 2SV == MFA 2FA = Two factor
authentication 2SV = Two Step verification MFA = Multi-factor authentication What about all those other acronyms...

@tech_christine Why didn't 2FA help? •SMS was used •2FA wasn't
even enabled

@tech_christine • Most common • Most compromised • Not recommended
by NIST since 2016 SMS

@tech_christine If SMS wasn't bad enough •SS7 (network shared by
every telecom) has it's own vulnerabilities •Text messages that are sent can be intercepted

@tech_christine Let's figure out all the ways SMS can be
hacked... 1. Sim-swap (aka what just happened to us) 2. Port-out scam 3. Brute force on the application itself 4. Exploit SS7 weakness

@tech_christine Time-based One Time Password aka app based aka soft
token • Authy • Google Authenticator • 1Password TOTP

@tech_christine • Associated with certain authorized devices • Not visible
on a locked phone screen Push Based

@tech_christine Token based Physical keys that can auth • USB
drive • near-ﬁeld communication • Many use U2F (Universal 2nd Factor)

@tech_christine OTP vs U2F

@tech_christine OTP U2F • User has physical device • Strong
security from public key cryptography • No personal information associated with a key • Users type in codes • Set up and provision required • Secrets stored, providing a single point of attack

What would you change now?

@tech_christine Secure Your Account 1.Use a VOIP number 2.Don't reuse
passwords 3.Use long passwords 4.Secure with alternate authentication method 5.Pin/password protect phone provider Keep on being @awesome

@tech_christine But wait... •Now you are the developer at an
jiffygram (an insta rival) •How do you secure your users from all the bad stuff out there?

@tech_christine •Developers •Designers •Infrastructure •Managers •Not just info sec! Security
is everyone's job

@tech_christine Back to your security basics 1. Strong passwords !
2. Don't make them be rotated 3. Store the hash securely 4. Only store sensitive data that you need ⛔

https://xkcd.com/936/ @tech_christine

Do this @tech_christine

⬆ that is 6 a's Not this ☹ @tech_christine

Definitely not this either @tech_christine

@tech_christine Let's talk about password hash encryption • Just an
algorithm that takes data and produces fixed-size output • Some hashes are stronger then others • MD5/SHA-1 = ) • SHA-256/DES = * • If possible with performance, use an adaptive one-way function

@tech_christine Strong recommended adaptive functions 1. Argon2 - winner of
the password hashing competition, should be considered first choice for new applications 2. PBKDF2 - when FIPS certification or enterprise support on many platforms is required 3. Scrypt - where resisting any/all hardware accelerated attacks is necessary but support isn’t 4. Bcrypt - where PBKDF2 or Scrypt support is not available Head on over to OWASP.org for more details

@tech_christine ...a user lost their phone/app access/token • Recovery codes
to the rescue! + • Allows access to application • Shown once, used once

@tech_christine lessons learned 2FA Implementation @tech_christine

@tech_christine Rate limiting prevents brute force attacks @tech_christine

@tech_christine Use a truncated exponential back-off algorithm @tech_christine

@tech_christine What is an exponential back-off algorithm?

@tech_christine Example in Ruby login_request if retries <= max_retries retries
+= 1 sleep (retries + rand(100)/1000) retry else raise "You've hit your max retries!" end

@tech_christine Get user buy-in

@tech_christine •Make it easy opt in •Make it easy to
add •Make it visible

@tech_christine Do this

@tech_christine Not this American Express OpenShift Netﬂix Pandora Pinterest Spotify
Target Best Buy Freshbooks State Farm AT&T 2FA

@tech_christine Enforce authentication on all pages

@tech_christine • For editing/removing of 2FA require credentials • If
authentication does fail, be generic in error response Moar authentication

Do this "Login failed - invalid user ID or password"

Not this "Login for User foo: invalid password" "Login failed,
invalid user ID" "Login failed; account disabled" "Login failed; this user is not active"

@tech_christine Users with the most amount of privilege, 2FA is
a requirement not optional

The answer to the question The Hitchhiker's Guide to the
Galaxy Douglas Adams

@tech_christine Yes to 2FA but... •Can improve security if you
are following good password practices •Some 2FA methods are more secure then others

@tech_christine Thanks for having me KCDC! All the organizers and
volunteers deserve 0 0 0 Tyson Reeder for the final graphic @tysondreeder For references and further reading checkout https://christine-seeman.com/talks

@tech_christine getﬂywheel.com/about/careers

@tech_christine What questions can I answer?

@tech_christine Twilio API Example

@tech_christine The Ruby One Time Password Library Example

@tech_christine

@tech_christine But you need to get this code to your
user...

@tech_christine Authy One Touch API Example

@tech_christine QR Code Rendering https://github.com/whomwah/rqrcode ROTP: TOTP https://github.com/mdp/rotp Twilio Ruby
API https://www.twilio.com/docs/libraries/ruby Auth Ruby API https://github.com/twilio/authy-ruby

To 2FA, or not to 2FA? Let's answer this questi...

To 2FA, or not to 2FA? Let's answer this question!

More Decks by Christine

Other Decks in Programming

Featured

Transcript