Nesh Popovic

As a Developer and Solutions Engineer for the past 20+ years, I've been involved in developing and selling secure and robust software solutions. When not helping my sales team deal with the complexities of software platforms, you can usually find me playing pickleball, basketball or backgammon.

Principal Solutions Engineer - CIAM

Learn how to set up an Amazon API Gateway and secure the REST API with Okta Customer Identity Cloud (CIC) Adaptive MFA Risk Score

Protecting REST APIs Behind Amazon API Gateway Using Okta

I stream, blog, and make youtube videos about tech stuff. I love coding, I love AI, and I love building stuff!

Staff Developer Advocate

Juan Cruz Martinez

Learn how to leverage Auth0 Actions to create custom MFA (Multi-Factor Authentication) workflows, enforce enrollment of users based on specific conditions, and validate user authentication.

Multi-factor authentication (MFA) is an essential security measure that helps to protect your organization's data and assets. By requiring users to provide an additional authentication factor, such as a security token or fingerprint, in addition to their username and password, MFA can significantly reduce the risk of unauthorized access.

However, implementing MFA can sometimes create friction in the user experience, potentially leading to frustration and reduced productivity. Additionally, not all users or scenarios may require the same level of security, making a one-size-fits-all MFA approach impractical.

Auth0 Actions is a powerful feature that allows you to customize and extend the functionality of Auth0. With Actions, you can create custom workflows that trigger in response to specific events, such as user login or registration. This enables you to tailor your MFA implementation to meet your organization's specific needs.

For example, you can use Actions to:

- **Enforce MFA based on user roles or permissions**: You can require certain users, such as administrators or those with access to sensitive data, to use MFA while allowing others to bypass it.
- **Implement risk-based authentication**: You can use Actions to assess the risk level of a login attempt based on factors such as the user's location, device, and IP address. If the risk is high, you can then require the user to provide an additional factor of authentication.

## Prepare your Tenant

Before diving into customizing your Multi-Factor Authentication (MFA) flows, let's make sure we have the essentials in place. This quick guide will walk you through the initial setup steps:

- **Activate MFA**: Head over to your Auth0 Dashboard (<a href="https://a0.to/blog_signup" data-amp-replace="CLIENT_ID"  data-amp-addparams="anonId=CLIENT_ID(cid-scope-cookie-fallback-name)">Get a free account</a> if you don't already have one) and navigate to [Security > Multi-factor Auth](https://manage.auth0.com/#/security/mfa). Here, you'll be able to activate MFA for your tenant.

- **Choose Your Factors**: [MFA comes in various forms](https://auth0.com/blog/not-all-mfa-is-created-equal/). Decide which factors suit your security needs and enable them on the same Multi-factor Auth page. You might choose options like push notifications, SMS codes, or even biometrics.
    ![Auth0 Dashboard > Security > Multi-factor Auth](https://images.ctfassets.net/23aumh6u8s0i/5NSKKAcGSjkj40ZkTmUlDD/3165f217e14e7a85b9f0304695fdf9d5/MFA_Auth.png)

- **Enable Customization**: To personalize your MFA flows, toggle on the "Customize MFA Factors using Actions" setting. This is like unlocking a secret level – it opens the door to fully customized experiences for your users.
    ![Auth0 Dashboard > Security > Multi-factor Auth > Additional Settings](https://images.ctfassets.net/cdy7uua7fh8z/2hv0ELTkkka3t230SXfxw/46def5395652b2451cfc9e0ad01a371a/MFA_actions.png)

> Actions with `enrollWith` or `enrollWithAny` commands override any existing policies or rules that enable or disable MFA in a tenant.

## Understand the APIs

Once you've enabled Multi-Factor Authentication (MFA) in your Auth0 tenant, you can go beyond the basic settings and create truly customized enrollment flows using Auth0 Actions. Actions are snippets of code that run at specific points in the user's authentication journey, giving you granular control over your authentication workflow and, in particular, how MFA is presented.

To customize your MFA experiences, Auth0 Actions provides a set of APIs designed for enrollment and requiring authentication challenges. Here's a breakdown of the four key APIs you can use: 

### `enrollWith(factor, options)`

Initiates MFA enrollment for a specific factor (e.g., `otp`, `push-notification`, `webauthn-roaming`, etc. Visit the docs to learn about [all supported values](https://auth0.com/docs/customize/actions/flows-and-triggers/login-flow/api-object#:~:text=api.authentication.enrollWith(factor%2C%20options)).

Example:

```javascript
api.authentication.enrollWith({type: 'otp'})
```

### `enrollWithAny(factors)`

Similar to `enrollWith` but prompts the user to select an MFA factor to enroll in from the supplied list.

Example:

```javascript
api.authentication.enrollWithAny([{type: 'otp'}, {type: 'webauthn-roaming'}])
```

### `challengeWith(factor, options)`

Challenge the user with one or more specified multifactor authentication factors. This method presents the default challenge first, then allows the user to select a different option if additional factors have been supplied. If the user has not enrolled in any of the factors supplied (including both the default and any additional factors), the command fails.

Example:

```javascript
api.authentication.challengeWith({type: 'otp'})
```

### `challengeWithAny(factors)`

Trigger a MFA challenge and allow the user to select their preferred factor from the supplied list.

Example:

```javascript
api.authentication.challengeWithAny([{type: 'otp'}, {type: 'webauthn-roaming'}])
```

## Create a New Auth0 Action

To begin, let's create a new [Auth0 Action](https://auth0.com/docs/customize/actions/actions-overview). Actions are serverless functions that run in a secure Auth0 environment.

To create an Action, log into your [Auth0 Dashboard](https://manage.auth0.com/#/actions/flows), select Actions from the left sidebar menu, then select Flows. This page shows the different flows you can customize. For our use case, we’ll choose the “Login” flow.

![The “Actions” page of the Auth0 dashboard.](https://images.ctfassets.net/23aumh6u8s0i/3Es0FEV0EEyNeKgN6LXEeM/67763781d697663da79113ba381e8610/actions_flows.png)

This will take you to the “Login” flow page, where you can install, create, and add Actions to the flow.

![The “Login” flow page of the Auth0 dashboard.](https://images.ctfassets.net/23aumh6u8s0i/5dveq8h22H0Nje8Rub6sa9/7071335d4db1571af98440e527f1b999/actions_login_flow.png)

The screen has two main sections: the diagram in the center of the page shows the login flow and the Actions panel.

On the diagram, we can see the default login flow, which contains two states.

- **Start:** The user completed the login form and is ready to log in.
- **Complete:** The system issues the user’s credentials (an ID token and, if required, an access token).

You can drag and drop Actions in between these states to add custom logic to the login flow or deny the login request before the tokens are issued.

On the right panel, we have the Actions panel with two tabs.

- **Installed**: Pre-installed Actions from the [Auth0 Actions Marketplace](https://marketplace.auth0.com/features/actions)
- **Custom:** Actions created for this tenant

To create an Action, click the plus icon on the Actions panel and select "Build from scratch".

![Create a custom Action using the Actions panel](https://images.ctfassets.net/23aumh6u8s0i/3TABItaKOdq9dpsUIdQIpx/47d5010f5642123942ba3b7afd710300/actions_login_flow_create_menu.png)

After that, a modal window will appear to enter the information for our Action: you’ll have to provide a name, and you can leave the trigger and runtime as the default values. For my Action, I’ll name it “Require webauthn MFA for admins”.

![Enter the Action name and click create](https://images.ctfassets.net/23aumh6u8s0i/H6zvDcXGyg2a773gW790H/07ce6e74ee07f115d0e58d6e3863642f/actions_login_flow_create_dialog.png)

After clicking on "Create", you’ll be taken to the Action’s code editor, where you can write the code for your Action, install packages, test it, and more:

![Auth0 Actions code editor page](https://images.ctfassets.net/23aumh6u8s0i/6OzG8Oe3XU8lFnzLIr5Ver/4644c79782edaa0d279d4cf2112ae32c/actions_editor.png)

An Action can make use of two JavaScript functions to alter the Login flow:

- `onExecutePostLogin`: defines what should happen immediately after the user provides login credentials that Auth0 verified. This method receives two parameters, `event` and `api`.
    - `event`: contains details about the login request, such as the user and the context.
    - `api`: contains methods to manipulate the login’s behavior.
- `onContinuePostLogin`: defines what should happen when control returns to the Login Action after a redirect to another web page. It’s used only when the user returns after being redirected, which is why it’s commented out by default.

For this tutorial, we’ll focus on the `onExecutePostLogin` method.

## Writing the Actions Code

Next, we'll write the Action's code that will require users under the Admin's group to use `webauthn` as an additional authentication step. If the user isn't already enrolled with `webauthn`, the first time they login they will be prompted to do so.

The action will make use of the APIs `challengeWith` and `enrollWith`, in addition to using the user's property `enrolledFactors` to determine if the user has an MFA factor enrolled already.

Here's the actual code:

```javascript
exports.onExecutePostLogin = async (event, api) => {
    // Check if the user is an admin, enforce webauthn
    if (event.authorization?.roles?.includes('Admin')) {
        // Check if the user is already enrolled with webauthn
        if (event.user.enrolledFactors && event.user.enrolledFactors.some(m => m.type === 'webauthn-roaming')) {
            api.authentication.challengeWith({type: 'webauthn-roaming'})
        } else {
            api.authentication.enrollWith({type: 'webauthn-roaming'})
        }
    }
};
```

## Attach an Auth0 Action to the Login Flow

After coding and testing your Actions, it’s time to deploy and use them as part of the login flow. Once you are ok with your testing results, you can hit the `Deploy` button on the top right corner of the screen. This will take the existing code and settings and generate a function snapshot you can use in your login flow.

If you ever need to change the code on the function, all changes will automatically be saved as a new draft, and if you want the changes to become effective, you’ll have to deploy your latest version once again.

Once your code is deployed, it doesn’t mean it is actively used as part of your login flow. To check for that, please refer back to the [login flow screen](https://manage.auth0.com/#/actions/flows/login/), where the login diagram is shown. If you don’t see your Action as part of the diagram, it means that, even if your Action is deployed, it has not yet been activated. To activate the Action as part of the flow, click on the “Custom” tab on the Actions panel, locate your Action by name, and simply drag and drop the box over the login diagram between the "Start" and "Complete" steps. After that, you can apply changes using the “Apply” button on the top right corner of the screen.

![Apply an Auth0 Action to the Login Flow](https://images.ctfassets.net/23aumh6u8s0i/5IKiEeHy8WharqTOjJnSLh/eb5025dfd22de94c2446ccc22f1b524d/actions_attach_to_flow.gif)

## Test Your New Authentication Flow

Now, you can try your new Action by logging into your Auth0-powered application using both admin and non-admin accounts. When you log using any method (e.g. username/password, or social login) with a non-admin user, you'll get direct access to your application or continue with the authentication flow as you have it specified for your tenant.

When you log in using an admin user (a member of the group "Admin", as we defined it on the Action), you'll be prompted to either register or validate your account with webauthn. The screen may look something like this:

![Auth0 MFA Validation Step](https://images.ctfassets.net/23aumh6u8s0i/7duWHgEkhhz2e7rLgLJV1X/d174ce044c7a8011f660cd83be1cc815/mfa_validate.png)

## Conclusion

Auth0 Actions provides a versatile and powerful toolkit to revolutionize your organization's MFA implementation. By harnessing the flexibility of Actions, you can create personalized, risk-based, and context-aware MFA workflows that enhance security without compromising user experience.

The ability to tailor MFA requirements based on user roles, risk assessments, and specific applications empowers you to implement a layered security approach. This means that you can enforce stricter MFA for high-risk scenarios, such as administrative access or sensitive data handling while offering a streamlined experience for regular users.

As you explore the possibilities of Auth0 Actions, remember that Customization is key. By experimenting with different workflows and conditions, you can fine-tune your MFA implementation to perfectly align with your organization's unique security requirements and user expectations.

Thanks for reading!

Using Actions to Customize Your MFA Factors

auth0_by_okta_hero copy

Auth0 Team

Offering expanded access and optionality for self-service plans and features

**TLDR**: 
Self-service customers have access to Auth0 capabilities that previously required a call with sales. Effective immediately: (1) customers can now upgrade to our B2B Professional Plan directly through the dashboard, (2) the Enterprise Connection limit in the B2B Pro plan has been increased from 3 to 5, and (3) Pro plans customers can now add a single Enterprise MFA factor (called 'Enterprise MFA Lite') via self-service.

In November 2023, we introduced [updated self-service plans and pricing](https://auth0.com/blog/upcoming-pricing-changes-for-the-customer-identity-cloud/) to scale with our customers. As a continuation of this work and based on your feedback, we now offer self-service customers easier access to plans and capabilities that previously required a discussion with sales.

### Here’s what’s new, effective May 2024:

* You can now choose our [B2B Professional Plan](https://auth0.com/pricing) using your dashboard! The B2B Pro Plan includes: 
    * 5,000 M2M Authentications (more available as add-ons)
    * M2M Add-on
    * External Database
    * Cross App SSO
    * 5 Enterprise Connections (increased from 3)
    * 100 organizations
    * And other features included in the B2B Essentials plan.

    _To upgrade: [Dashboard > Settings (Subscription Tab)](https://manage.auth0.com/#/tenant/billing/subscription) > Select Plan & Quota > Click Upgrade or you can continue to purchase this plan through our Sales team._

* **5 Enterprise Connections** for the B2B Professional Plan's Enterprise Connection limits have increased from 3 connections to 5 connections via self-service. This will allow more of our SaaS customers to scale more effectively. As a reminder, there is no limit on [Okta Enterprise Connections](https://auth0.com/docs/authenticate/identity-providers/enterprise-identity-providers/okta) for customers on all of our B2B plans.
* **Enterprise MFA Lite** is now available through self-service for both B2C and B2B Professional. This capability was only available via a contract with Sales, but it can now be added via the dashboard.
    * Enterprise MFA Lite allows you to add either SMS, push, or voice notifications to Professional plans for an additional fee. Fees vary by the amount of MAUs; find more information on [Dashboard > Settings (Subscription Tab.)](https://manage.auth0.com/#/tenant/billing/subscription)
    * This includes the support of push, [SMS, and voice notifications](https://auth0.com/docs/secure/multi-factor-authentication/multi-factor-authentication-factors/configure-sms-voice-notifications-mfa), (SMS charges for MFA are charged separately by carriers supported by Auth0). Under Enterprise MFA Lite, subscriptions will be limited to one MFA factor on the subscription. 

### MFA Offerings Explained

MFA ([Multi-Factor Authentication](https://auth0.com/blog/multifactor-authentication-mfa/)) provides a method to verify a user's identity by requiring them to provide more than one piece of identifying information. For example, **something you know**: a password, PIN, or security question, **something you have**: a smartphone, security token, or smart card, or **something you are**: your fingerprint, face scan, or voice pattern.

Some of our MFA offerings include: 

* **Pro MFA** &mdash; included in B2C Professional, B2B Essentials, B2B Professional, and Enterprise plans 
* **Enterprise MFA Lite Add-on** &mdash; an add-on for B2B and B2C Professional plans and Enterprise plans
* **Enterprise MFA** &mdash; included in our Enterprise Plans 

![Pro Plan Improvements for Self-Service Customers - May 2024](https://images.ctfassets.net/23aumh6u8s0i/sTrHbEBf42kTVlbfp6mRt/2459de4604259c2031a9808dd2111efa/MFA_Table.png)

<div class="alert alert-info alert-icon">
  <i class="icon-budicon-487"></i>
  <b> Please note that upgrading to B2B Professional and adding Enterprise MFA Lite to B2B and B2C Professional plans will incur additional fees. Visit our <a href="https://auth0.com/pricing">pricing page</a> for more information.</b><br> 
</div>

### Which MFA factor(s) are best for my product?

Choosing the right [MFA factor](https://auth0.com/docs/secure/multi-factor-authentication#mfa-factors) is all about striking a balance between security and user experience. Consider the sensitivity of the accounts you're protecting, the technical comfort level of your users, and the accessibility of the MFA factor across different devices. 

![Not All MFA is Created Equal](https://images.ctfassets.net/23aumh6u8s0i/5TgjqFrUJwTDkldGCqov7o/6d80ca9d9c0d29faebea01578a02e0b6/Not_All_MFA_is_Created_Equal.png "Not All MFA is Created Equal")
<p align="center"><i>From blog post: <a href="https://auth0.com/blog/not-all-mfa-is-created-equal/">Not All MFA is Created Equal</a></i></p>

<p align="left"</p>
To help evaluate our MFA offerings, visit this [blog post](https://auth0.com/blog/not-all-mfa-is-created-equal/) to learn about your options and for more details on factor types and authentication assurance levels, check out [this datasheet](https://www.okta.com/resources/datasheet-factor-assurance/).

### Have more questions about your plan or our MFA offerings?

We’re here to help! If you’re on a paid plan, our [Support team](https://support.auth0.com/) can help, and if you’re on a free plan, you can post in our [Community forum](https://community.auth0.com/). Thanks for being a valued customer. We hope this allows for more flexibility and optionality during your auth journey. Happy authenticating!

Pro Plan Improvements for Self-Service Customers - May 2024

carla_urrea

I've been working as a software engineer since 2014, particularly as a backend engineer and doing system design. I consider myself a language-agnostic developer but if I had to choose, I like to work with Ruby, Python, and Elixir.  

After realizing how fun it was to create content and share experiences with the developer community I made the switch to Developer Advocacy. I like to learn and work with new technologies. 

When I'm not coding or creating content you could probably find me going on a bike ride, hiking, or just hanging out with my dog, Dasha. 

Senior Developer Advocate

Carla Urrea Stabile

andrea-chiarelli

I have over 20 years of experience as a software engineer and technical author. Throughout my career, I've used several programming languages and technologies for the projects I was involved in, ranging from C# to JavaScript, ASP.NET to Node.js, Angular to React, SOAP to REST APIs, etc.

In the last few years, I've been focusing on simplifying the developer experience with Identity and related topics, especially in the .NET ecosystem.

Principal Developer Advocate

Andrea Chiarelli

Learn about the different MFA options and how weak or strong they are in comparison.

Using [Multi-Factor Authentication (MFA)](https://auth0.com/docs/secure/multi-factor-authentication) to secure your accounts is something you should always do. MFA adds a layer of security during login that requires users to provide more than one credential to prove their digital identity. 

[Why is it so important?](https://auth0.com/docs/secure/multi-factor-authentication#why-use-multi-factor-authentication-) Well, it's not so unlikely for attackers to steal usernames and passwords or programmatically attack user accounts. Having additional steps to prove your identity can nullify the effectiveness of these violations.

However, not all MFA options provide the same level of security assurance. So, let's review them and understand why some are stronger than others.


## Factors, Authenticators, and Assurance

[**Okta's Businesses at Work Report 2023**](https://www.okta.com/blog/2023/02/businesses-at-work-2023/) shows that *more organizations realize that not all multi-factor authentication (MFA) is created equal*.

> Low-assurance security questions are experiencing the slowest growth across the board, while high-assurance security keys and biometrics (including WebAuthn) are growing more quickly

&mdash; <cite>Todd McKinnon on the [Businesses at Work Report post](https://www.okta.com/blog/2023/02/businesses-at-work-2023/)</cite>

**But what does low-assurance or high-assurance mean?** 

To understand how strong or weak an MFA option is, we need to explore a few related concepts: authenticators, authentication factors, and authenticator assurance level.

### Authenticators

An [**authenticator**](https://pages.nist.gov/800-63-3/sp800-63-3.html#def-and-acr) is something that can confirm the user identity. It can be a shared secret, such as a security question or a password, but it can also be a device or something the user needs to demonstrate to possess or control.

Based on the specific authenticator, there are _methods_ to demonstrate the possession or control of the authenticator. For example, sending a code via SMS is a method used to prove a user possesses a device. Another method could be an authenticator app like Google Authenticator or a Security Key.

### Authentication factors

In the authentication process, there are many options you can use to prove your digital identity. These are called [**authentication factors**](https://auth0.com/docs/secure/multi-factor-authentication/multi-factor-authentication-factors) and there are three main types:

  - **Knowledge**: Something you know, like a password or the answer to a security question. 
    - Users are familiar with authenticating with a password or answering a security question and are easy to use. Still, this information is usually easy to lose or guess, making it vulnerable to data breaches, social engineering, and phishing. 
  - **Possession**: Something you own, like a device or other physical tokens. 
    - The device stores or receives the user information, making it more secure than knowledge-based factors. Users are familiar with, for example, [SMS authentication](https://www.okta.com/blog/2020/10/sms-authentication/), where they receive an MFA code or [one-time password (OTP)](https://www.okta.com/blog/2020/06/what-is-a-one-time-password-otp/) to their phone. At the same time, devices can be lost or stolen, making them vulnerable to person-in-the-middle and phishing attacks.
  - **Biometrics/Inherence**: Something you are or is inherent to you, like a fingerprint.
    - Biometrics are unique for each user; they don't have to remember or store their fingerprints or face. These factors are phishing-resistant and offer a seamless end-user experience but have yet to be widely adopted.

Every authenticator has one or more authentication factors.

### Authenticator Assurance Level (AAL)

[**Assurance**](https://support.okta.com/help/s/article/How-authenticators-and-assurance-levels-are-described?language=en_US) refers to the degree of confidence that an end user signing in to an application is the same end user who previously signed in to the application.

The **[Authenticator Assurance Level (AAL)](https://pages.nist.gov/800-63-3-Implementation-Resources/63B/AAL/)** is measured based on the use of one or more authenticators and the characteristics of their methods, as we will see in a moment.


## What Makes an Authenticator Stronger than Another?

Now that you know the concept of assurance, factors, and authenticators, how can they help you understand when an authenticator is stronger? We said that the **level of assurance** is based on the authenticators and the characteristics of their methods. To measure this level of assurance, we need to answer the following question: "How confident am I that the user is who they say they are?"

### Authenticators and assurance level

For example, a password provides some confidence in the user's identity. Only the user should know this password. But passwords can be stolen and used by other users. If I can get the user's fingerprint, I have more confidence in their identity: stealing their fingerprint is way more complicated than stealing their password. In other words, the user's fingerprint provides a higher level of assurance than a password.

There are intermediate levels of assurance between a password and a fingerprint. For example, proving that a user possesses a device provides a higher level of assurance than a password but lower than a fingerprint. While a password can be stolen and used by an attacker without the user realizing it, a device is less likely to be stolen, and if it happens, the user is usually aware of the theft in a short time.

The following diagram shows the different factor types and assurance levels for some of the most common authenticators:  

<br/><br/>
![Authenticators by Assurance Level and Factor](https://images.ctfassets.net/23aumh6u8s0i/6lndb4OGHrhpfUnkeB9C4b/ed1e79f85cc48bad42ee8a5e6e47c3a9/MFA_factors_by_assurance__1_.jpg)
<br/><br/>

Depending on the authenticator method, you can be more or less confident about the user's identity. As you see in the diagram, security questions and passwords have low assurance because it is easier for the user to forget them and for attackers to guess when users use weak answers or passwords. On the other hand, FIDO2/WebAuthn credentials and biometrics have the highest assurance level because they rely on cryptographic algorithms and inherent characteristics that are hard to break.

### MFA and assurance level

Authenticator assurance levels are not intended to measure the level of assurance of individual authenticators. They measure [the level of assurance of the authenticated session](https://pages.nist.gov/800-63-3-Implementation-Resources/63B/AAL/). Therefore, if you use one authenticator to authenticate your user, the AAL of that authenticated session will match the AAL of the authenticator used. However, by combining authenticators, you can achieve a higher AAL for a session than you could with individual authenticators. That's where MFA comes in.

Also, using **authenticators with different factor types** is strongly recommended to make MFA effective. For example, by combining password and SMS authentication, you get an authenticated session with a higher assurance level than just the password. In this case, you combine a knowledge factor authenticator (the password) with a possession factor authenticator (the phone) through the SMS method.

If you use a combination of password and security key as your MFA, the assurance level of the authenticated session is stronger than the password and SMS combination. Indeed, the assurance level of the security key is higher than the SMS authentication.

## Low-Assurance Authenticators

Following the [NIST's Digital Identity Guidelines](https://pages.nist.gov/800-63-3-Implementation-Resources/), low-assurance authenticators provide some confidence that the user controls an authenticator that confirms their identity. These authenticators **permit single-factor authentication**, provide baseline security at low cost, and most users are familiar with the authenticating process. Some of these authenticators are:  

- Passwords 
- Security Questions
- SMS, Voice, and Email One-Time Password (OTP)
- One-Time Password (OTP) Apps

In addition to single-factor authentication, this level of assurance allows multi-factor authentication based on the proof that the user possesses and controls an additional authenticator. However, no mandatory cryptography is required at this level, so you can find MFA options based on the combination of password and email or password and SMS, for example.

Most of the authenticators falling in this assurance level are low-cost, and users are familiar with them. However, their vulnerability ranges from being easy to guess or discover to being exposed to social engineering and phishing.

![MFA factors](https://images.ctfassets.net/23aumh6u8s0i/4EmRhsgk2yQw5l21Xqwbr7/a99be0023a811661bb7e7e02784d0b53/Debunking_Misconceptions_About_Passwordless_Separator_V02_3x.jpg)


## Mid-Assurance Authenticators

This level of assurance offers a higher level of confidence of the user's identity. It **requires using two authentication factors**, which are either a physical authenticator and a memorized secret or a physical authenticator and a biometric associated with it. Some of these authenticators are:

- Push Notifications
- Physical token One-Time Password (OTP)

MFA can be performed using either a multi-factor authenticator or through the use of two independent authenticators. Multi-factor authenticators use an additional factor, either something you know or have, to unlock a secret stored in the (physical) authenticator.


## High-Assurance Authenticators

Authenticators with a high level of assurance introduce a new requirement beyond the mid-level assurance: using **multiple authentication factors** with a hardware-based authenticator. Some authenticators with a high level of assurance are:

- FIDO2/WebAuthn with security keys or biometrics

[FIDO2](https://www.yubico.com/authentication-standards/fido2/) is an open authentication standard hosted by the FIDO Alliance that consists of the W3C Web Authentication specification (WebAuthn API), and the [Client to Authentication Protocol (CTAP2)](https://www.yubico.com/resources/glossary/ctap/).

[WebAuthn](https://webauthn.me/introduction) is a W3C recommendation for defining an API enabling the creation and use of strong, attested, scoped, public key-based credentials by web applications for strongly authenticating users.

Using FIDO2/WebAuthn credentials guarantees users a phishing-resistant and seamless end-user experience. The use of higher-assurance security keys and biometrics ticked up to 24% in 2022, up from 21% a year ago, according to the [2023 Businesses at Work Report](https://www.okta.com/blog/2023/02/businesses-at-work-2023/) so even though it is not widely adopted yet, using high-assurance MFA is growing rapidly. 

![Passwordless Biometric](https://images.ctfassets.net/23aumh6u8s0i/50DnWYiAPCa18mVZOfrOBP/c29ceb90bd492ae124f89ff23ca1f237/Debunking_Misconceptions_About_Passwordless_Separator_V01_3x.jpg)

<include src="SignupCTA" text="Sign up to try out Auth0 for free." linkText="Get started →" />


## Conclusion 

In this post, you learned about Multi-Factor Authentication and the different types of authenticators, assurance levels, and existing factors. 

Depending on your authenticator method, you can be more or less confident about the user's identity. When you combine authenticators, you can achieve a higher level of assurance that the user is who they say they are than when you use individual authenticators. Therefore it's recommended that you use authenticators with different factor types.

If you want to learn more about MFA, factors, and authenticator assurance levels, you can download the [Factor Types and Authenticator Assurance Levels datasheet](https://www.okta.com/resources/datasheet-factor-assurance/) or download the entire [2023 Businesses at Work Report](https://www.okta.com/blog/2023/02/businesses-at-work-2023/). 

Not All MFA Is Created Equal

Learn what is a Yubikey and how you can set one up with your Auth0 account.

If you are reading this blog post, you are interested in security and how to make your accounts more secure. This blog post will teach you about Yubikeys, their benefits, and how to provide two-factor authentication (2FA) in your applications with Auth0.

<AmpContent>
<amp-youtube
    data-videoid="hS3tHjK0p_E"
    layout="responsive"
    width="480" height="270">
</amp-youtube>
</AmpContent>
<NonAmpContent>
<div class='embed-container' style="position: relative; padding-bottom: 56.25%; height: 0; overflow: hidden; max-width: 100%;margin-bottom:40px;"><iframe style="position: absolute; top: 0; left: 0; width: 100%; height: 100%;" src='https://www.youtube.com/embed/hS3tHjK0p_E' frameborder='0' allowfullscreen></iframe></div>
</NonAmpContent>

## What is a Yubikey?

**A Yubikey is** a hardware authentication device that makes two-factor authentication easier by plugging it into your laptop and tapping it. Yubikeys are a type of [security key](https://www.okta.com/identity-101/security-token/) manufactured by [Yubico](https://www.yubico.com/).

Usually, when logging in to any service, you must enter **something you know**, such as your login credentials, email, and password. In our case, 2FA adds another layer of security by requiring you to provide **something you have**, for example, a code from an authenticator app or SMS on your phone. Instead of using a code, you can use a device such as your Yubikey. In other words, **2FA is the process requiring a user to verify their identity in _two unique ways_** before they are granted access to a system. [It's a form of Multi-Factor Authentication.](https://www.okta.com/blog/2021/07/what-is-two-factor-authentication-2fa/)

## How Does a Yubikey Work?

Yubikeys use [U2F (Universal 2nd Factor)](https://auth0.com/blog/the-working-principles-of-2fa-2-factor-authentication-hardware/#How-The-U2F-Protocol-Was-Created), an open standard for two-factor authentication based on [public-key cryptography.](https://auth0.com/blog/how-to-explain-public-key-cryptography-digital-signatures-to-anyone/#The-Keys) 

With your Yubikey, you must first register it into your account to authenticate later. 

### Register your Yubikey

1. First, you must authenticate using another method, like your email and password. 
2. When you plug in your Yubikey and signal that you want to register a security key, the server you want to authenticate with sends a challenge and an AppID to the Yubikey. 
3. When the Yubikey receives this information, you'll be prompted by the browser to tap the Yubikey to confirm the request. 
4. Your Yubikey will generate a [nonce](https://en.wikipedia.org/wiki/Cryptographic_nonce) and hash it together with the AppID and the secret key to create a private and public key. 
5. The nonce and public key are sent back to the server to be stored so they can be used later when the user wants to authenticate.


### Authenticating with your Yubikey 

1. The server remembers you had registered a Yubikey, so it generates a new challenge to send back along with the AppID and nonce created when you first registered your Yubikey. 
2. The browser prompts you to tap the Yubikey, and the Yubikey will use the information received in step 1 to re-create the same key pair created when you registered your Yubikey. 
3. If everything goes well, your Yubikey encrypts the challenge sent by the server with the private key and sends the challenge back. 
4. The server decrypts the challenge using the public key it already has, and if the challenge matches the one the server sent, it means the user authentication was successful. 

## Benefits of Using a Yubikey 

One of the advantages of using a Yubikey is that they **protect against phishing attacks**. Registering a new key to a server sends an AppID that could be the website URL you're trying to authenticate. Therefore, **the credentials you create in a server are linked directly to a single website**.  

Yubikeys provide **one-touch login** without requiring a mobile phone to complete an authentication challenge.

You can also register as many Yubikeys as you want to minimize the chances of account lockout. You should have more than one key and register them simultaneously; **that way, if you lose any, you'll always have a backup.**

As a developer, using a device like a Yubikey might make your life easier, especially if you use [**WebAuthn**](https://webauthn.me/). It's a specification for an API that enables browsers to **create and use** strong public-key credentials so you can authenticate your users on your web applications. **In the WebAuthn process, the authenticator can be a Yubikey.**


## Set Up Your Yubikey with Auth0

You can set up your Yubikey with most mainstream websites like Google, Facebook, Instagram, etc .[Yubico provides an extensive list](https://www.yubico.com/es/works-with-yubikey/catalog/?sort=popular) of all the  applications that support Yubikeys.

In this case, you will set your Yubikey with your Auth0 application to allow your users to log in with a tap!


### Requirements 
- A [**Yubikey**](https://www.yubico.com/products/)
- **An Auth0 account ** <a href="https://a0.to/blog_signup" 
  data-amp-replace="CLIENT_ID" 
  data-amp-addparams="anonId=CLIENT_ID(cid-scope-cookie-fallback-name)">
  which you can get by signing up here
</a>

### Enable and define an MFA Factor 

First, head up to the [Auth0 Dashboard](https://manage.auth0.com/dashboard). On the left-hand menu, click **Security** and under this section, **Multi-factor Auth**. You will see a list of [Factors](https://auth0.com/docs/secure/multi-factor-authentication/multi-factor-authentication-factors):  

![Auth0 MFA Factors](https://images.ctfassets.net/23aumh6u8s0i/18uOwO0agDCb0gfQc9nmKC/61533e04f9b7bbedf7c67a2232dfef4b/Screenshot_2023-01-05_at_4.30.56_PM.png)

Click the factor called **"WebAuthn with FIDO Security Keys"**. It will navigate to the factor configuration page, where you can enable it by using the toggle button on the top right as follows: 

![MFA Factor WebAuthn with FIDO Security Keys config page](https://images.ctfassets.net/23aumh6u8s0i/6oH5pOPesYN4HC26M4hzui/24974cde91e7d132c09122d83ab731ea/Screenshot_2023-01-09_at_6.17.22_PM.png)

### Define an MFA policy 

Once you have enabled your MFA Factor, click **"Back to Multi-factor Authentication"**, next, scroll down to find the **Define Policies** section. 

A policy determines when to prompt users to complete to prove they own a particular account. For the sake of this tutorial, you can select **"Always"** and click **"Save"**

![MFA Policies](https://images.ctfassets.net/23aumh6u8s0i/1LnK0IMESXmCtY7p7fPFEa/cc38bef3e4d43b4c777d81ecbce59ce2/mfa-policies-always.png)

### Test your MFA strategy with your Yubikey 

First, **plug your Yubikey into your laptop**. Make sure it lights up when you do it to make sure it's plugged in correctly.

Next, head to the [Auth0 Dashboard](https://manage.auth0.com/dashboard) and find the **"Try your Login box"**, then click **"Try it out"**.

![Try your Login Box](https://images.ctfassets.net/23aumh6u8s0i/6x1ti069gOiQQEfKMxJOkA/1a574fcaa21a63c27af49c46f945ac5d/auth0-try-login-box.png)

The Universal Login page should open, so **go ahead and Sign Up** with either an email and password or with Google.

<img src="https://images.ctfassets.net/23aumh6u8s0i/1qNiYSkRJ2LV9ofWcmilUi/67d360f73933aeab8af3b1f6ff665891/universal_login_try_it_out.png" alt="Universal Login Page" width="500"/>

After you Sign Up, **your browser will detect that you have a Yubikey**, and it will take you to the following page so you can register your Yubikey:

<img src="https://images.ctfassets.net/23aumh6u8s0i/1o0j38TBwuyW7NoqQJUk9k/c0600bbf6ad4561c2e5d9fc52a606b95/Screenshot_2023-01-05_at_5.07.06_PM.png" alt="Add your Security Key" width="500"/>

Click "Use security key". A modal will pop up; select "USB Security Key": 

<img src="https://images.ctfassets.net/23aumh6u8s0i/4aGvztvwh1NH15CBhmmWHn/ab1ca9633bcf26c2c3dc6a7bc6626010/Screenshot_2023-01-05_at_5.09.29_PM.png" alt="Select your Security Key" width="500"/>


At this point, you'll be asked to **tap your Yubikey**:

<img src="https://images.ctfassets.net/23aumh6u8s0i/bo8pyABsZITlIghPPmWNV/04af1578bec8ca62d2f2562cb041c4f5/tap_key.png" alt="Tap Yubikey" width="500"/>


Next, you'll need to **add a name for your Yubikey**. Make sure to use a name that will help you identify which Yubikey you need to use.

<img src="https://images.ctfassets.net/23aumh6u8s0i/4sX3zXNfxEGWeb9TyXV6QA/a20804c8bfd843b299b9e32fd3cb69f1/Screenshot_2023-01-05_at_5.16.15_PM.png" alt="Name Yubikey" width="500"/>

And that's it! You have set up your Yubikey with Auth0! 🎉 You'll see a success message like this one:

<img src="https://images.ctfassets.net/23aumh6u8s0i/5MamqbabTSGXTwVkpoqtDb/6889544b4747fd3f2b73d3bab34c375e/yubikey_added.png" alt="Security key success message" width="500"/>

## Summary

In this post, you learned about Yubikeys and how to set them up with Auth0.

Yubikeys are a type of security key made by Yubico that makes two-factor authentication easier. Yubikeys use U2F, which is based on public-key cryptography. 

Using a Yubikey allows you to do a one-touch login and have as many Yubikeys as you want. 

Setting a Yubikey with Auth0 is a relatively straightforward process; all you need is the Yubikey and an Auth0 Account. 

What do you think? Will you be using a Yubikey in the future? Let me know in the comments. 

Thanks for reading!

What is a Yubikey and how to set it up with Auth0?

Robert Panasiuk 

Deduce CTO Robert Panasiuk has worked on the front lines of the fight against fraud for nearly a decade. He's helped deliver risk, fraud, and security solutions for clients across retail, travel, banking, and payments, including Mastercard and large online retailers. As a technology leader, Panasiuk balances a passion for revenue with a commitment to helping organizations succeed, grow, and solve challenges even in the most fast-paced environments.

Deduce's CTO

Robert Panasiuk

Deduce Intelligent MFA reduces false positive MFA challenges

Despite its overall effectiveness, multi-factor authentication (MFA) can sometimes feel like [“More Frustrating Authentication”](https://www.deduce.com/why-mfa-translates-to-more-frustrating-authentication/).

Many MFA solutions trigger far too many false positives and burden legitimate users with circuitous verification processes. This often leads to churn and potentially a costly hit to the company's reputation.

[A recent CMO Council report](https://cmocouncil.org/thought-leadership/reports/authentication-frustration) validated this point, indicating that 81% of users preferred companies that enabled easy and secure account verification, with more than 60% have canceled a transaction due to an inefficient authentication process.

To mitigate the friction caused by false positives, [Deduce](https://www.deduce.com/) launched its Intelligent MFA. After garnering praise from Fast Company as [the most innovative security solution of 2022](https://www.deduce.com/fast-company-names-deduce-the-most-innovative-security-solution-of-2022/), Deduce’s Intelligent MFA is now available on the [Auth0 Marketplace](https://marketplace.auth0.com/integrations/deduce-intelligent-mfa), delivering increased security and real-time identity insights to deliver a better user experience to a large swath of customers.

## A Smooth User Experience

Using augmented risk models with 75 risk and trust signals that curtail false positive challenges by more than 50%, Deduce helps customers ensure that real account takeover (ATO) threats—not legitimate users—are flagged.

Powering these risk signals is the Deduce Identity Network: a real-time identity graph for online fraud in the US. With over [500 million anonymized user profiles and upwards of 1.4 billion daily activities at its disposal](https://www.deduce.com/resource/idv-solution-brief/), the Deduce Identity Network and its Intelligent MFA application provide a critical layer of identity fraud defense to your Auth0 Identity Platform.

![A Smooth User Experience](https://images.ctfassets.net/23aumh6u8s0i/5xWnzpfcpngSdaYGqM6mGE/5afd01ce0ba9b66c2a95d860e976502e/Uploaded_from_Deduce_Hits_the_Auth0_Marketplace)

Deduce’s Intelligent MFA accounts for the following risk signals, sourcing real-time data to enable a smooth user experience:

* **New IP Found:** Is this IP new to this identity?
* **New Device Found:** Is this a new device for this identity?
* **Suspicious Activity—Time of Day:** Is this time of day not normal or suspicious for this identity?
* **Impossible Travel Detected:** Would it be impossible for a user to travel to a new location from the last known location in the given timeframe?
* **IP / Account Cycling Detected:** Has this IP frequently cycled over many different accounts?
* **Malicious IP Detected:** What malicious activity was observed for this IP across our network?
* **Network Proxy:** Is this identity using a malicious proxy?
* **Network Hosting:** Is this identity using a hosted network?

[Deduce’s](https://www.deduce.com/) Intelligent MFA allows Auth0 Identity Platform customers to benefit from the collective intelligence of the Deduce Identity Network. The eight most significant risk signals listed above increase ATO fraud capture at authentication for returning customers.

Considering [one in three consumers](https://www.pwc.com/us/en/advisory-services/publications/consumer-intelligence-series/pwc-consumer-intelligence-series-customer-experience.pdf) abandons a brand after a negative user experience, these risk signals play a crucial role in mitigating false positives and the resultant friction. Deduce’s Intelligent MFA unclutters the user experience via real-time insights that identify legitimate customers who otherwise might have been flagged for logging in at an unfamiliar location or on a new device.

## Easy Setup

With a no-code integration, Auth0 customers can deploy the Deduce Intelligent MFA solution without building custom code. Simple drag and drop tools enable users to add Deduce to any Auth0 workflow and choose the appropriate risk signals for their needs.

[Check out our solution brief](https://www.deduce.com/resource/deduce-intelligent-mfa-for-auth0/) to see how integrating Intelligent MFA into Auth0 can help you reduce friction, improve conversions, combat fraud, and keep customers happy. Additionally, [this guide](https://marketplace.auth0.com/integrations/deduce-intelligent-mfa) walks Auth0 users through the Intelligent MFA activation process.

The video below shows just how easy it is to set up.

<NonAmpContent>
<div style="padding:65.4% 0 0 0;position:relative;"><iframe src="https://player.vimeo.com/video/679349956?h=5b9b416be9" style="position:absolute;top:0;left:0;width:100%;height:100%;" frameborder="0" allow="autoplay; fullscreen; picture-in-picture" allowfullscreen></iframe></div><script src="https://player.vimeo.com/api/player.js"></script><br>
</NonAmpContent>

As for prerequisites, there aren’t many: an Auth0 account and tenant (sign up for free [here](https://auth0.com/signup)); an API Key and a Site ID (reach out to [support@deduce.com](mailto:support@deduce.com)); and a tenant with [MFA enabled](https://auth0.com/docs/secure/multi-factor-authentication/enable-mfa).

To learn more about our partnership with Auth0, read [the official press release](https://www.prweb.com/releases/2022/3/prweb18555208.htm).

Deduce Hits the Auth0 Marketplace

Mikhael Chammaa

As the Marketing Lead at Haventec, Mikhael is responsible for communicating the value of passwordless authentication to developers and product managers worldwide. Based in Australia, Mikhael is focused on the technology sector and has led the marketing function at several cybersecurity organizations.

Marketing Director at Haventec

As cyberattacks become more sophisticated and demand for seamless user experiences grows, developers and technology leaders must evaluate whether the traditional password approach is going to fit in a modern digital era.

Offering your customers single-step passwordless multi-factor authentication (MFA) can reduce the risk of credential theft.

Haventec Authenticate, a winner of cybersecurity awards at the Australian Technologies Competition and InnovationAus, enables you to:

* Decentralize identity 
* Remove passwords from your environment
* Leverage advanced cryptography to validate users
* Seamlessly onboard existing users to single-step passwordless MFA 

![Haventec Authenticate](https://images.ctfassets.net/23aumh6u8s0i/1yGSn7oCqMLJCPAkglA1ab/b53b65ab2eec2dd9f38f14fbdbfb6b01/haventec_image.png)

For application owners and developers, this eliminates unsecured usernames and passwords and the need to store them. The platform makes it easy to transition existing users to an improved authentication experience without disruption while empowering them with a seamless and consistent digital experience across all devices.   

---

## How Haventec Authenticate Works

Haventec Authenticate provides a genuinely passwordless technology that eliminates passwords and shared secrets. This significantly reduces risk while providing customers with a seamless and secure passwordless MFA experience. All they need is a simple PIN or Biometric factor to authenticate.

A PIN is a secret between a user and their device, so an application does not need to hold or protect it. In fact, the PIN is not stored anywhere and is known only to the user.

Haventec Authenticate breaks access to the user's identity into multiple parts, separated into multiple locations. Two sets of keys (public and private) are changed and re-encrypted for every Haventec Authenticate transaction, and the architecture is quantum computer resistant.

The best part is that the user never sees any of this – all they know is that they were able to access the application securely in a split second.

Customers with an application registered with Auth0 can utilize Haventec as their identity provider by leveraging the OpenID Connect standard. Start by setting up your application in Haventec to receive a unique identifier that allows you to create, enable and test your enterprise connection in Auth0 with Haventec Authenticate as the IDP. Please see the [installation documentation](https://marketplace.auth0.com/integrations/haventec-authenticate) for step by step guidance. 

See a demo video for an overview of Haventec's technology.

<AmpContent>
<amp-youtube
    data-videoid="2Z0OjLWg4zM"
    layout="responsive"
    width="480" height="270">
</amp-youtube>
</AmpContent>
<NonAmpContent>
<div class='embed-container' style="position: relative; padding-bottom: 56.25%; height: 0; overflow: hidden; max-width: 100%;margin-bottom:40px;"><iframe style="position: absolute; top: 0; left: 0; width: 100%; height: 100%;" src='https://www.youtube.com/embed/2Z0OjLWg4zM' frameborder='0' allowfullscreen></iframe></div>
</NonAmpContent>

---

## A Phased Approach to Achieving Passwordless Authentication

Your journey towards passwordless authentication will largely depend on your product's maturity and development lifecycle.

Developers of a greenfield application can easily forgo the decades-long paradigm of UserIDs and passwords. Considerations at this stage will revolve around the features, benefits, and scalability of a passwordless solution. In particular, how it can improve customer experience and lifetime value.

For mature applications, developers looking to leverage the security and experience benefits of passwordless authentication should consider a phased approach that minimizes customer disruption. After all, your customers may have been conditioned to authenticate with UserIDs and passwords and see this method as familiar and secure. 

Haventec Authenticate supports a phased approach to passwordless authentication by enabling you to offer your customers:

* **Traditional username and password authentication but with MFA silently enabled to reduce risk.**

 MFA is now a common practice to mitigate against identity theft, phishing attacks, account takeovers, and other digital threats. However, the effort and support required to educate and onboard users are one of the reasons MFA remains optional in many consumer applications. Haventec is solving this challenge through the introduction of Silent MFA.

 Product leaders can activate 'silent' (invisible to the end-user) MFA for their customers without disruption. Customers do not need to install authentication apps, switch devices or apps for another authentication factor, or worry about physical tokens. MFA becomes a single-step experience offering strong customer authentication and peace of mind.

* **Elimination of UserIDs and passwords**

 Organizations looking to further reduce risk, simplify the user experience, and differentiate their product, can leverage Haventec Authenticate's passwordless technology by integrating it with their Auth0 subscription.

 Customers will have the option to use a PIN or Biometric to replace username/password combinations and enjoy a genuinely passwordless MFA experience that is consistent across devices. 

## There's Never Been a Better Time to Go Passwordless

With its optimized user experience and easy integration with your existing Auth0 infrastructure, Haventec Authenticate enables you to make an effortless and customer-centric shift to passwordless for a consistent and secure access experience every time.

To learn more, check out our integration at [marketplace.auth0.com](http://marketplace.auth0.com/)

Seamless and Secure Passwordless MFA from Haventec

Brittney

Brittney Liburd has been helping teams go to market with SaaS and security technologies for over 12 years. An avid researcher and writer, Brittney has a passion for artificial intelligence, machine learning, and the #goodIDmovement. She also has a near-encyclopedic knowledge of George RR Martin's “ A Song of Ice and Fire” book series.

Sr. Product Marketing Manager at authID

Brittney Liburd

Advanced facial biometrics can enhance Auth0 MFA workflows to provide secure authentication experiences that simplify common challenges for technical roles.

On a daily basis, CIAM professionals battle data breaches, account compromise, ransomware, and fraud. In 2021, digital fraud rates increased 22%, ransomware rates increased 62%, data breach rates increased 17%, — and cybercriminals shifted to softer targets with more valuable data and motivation for ransom payout. Huge shifts in remote work, distance learning, telemedicine, and BYOD trends also added layers of complexity as organizations struggled to protect systems and data.  

These trends illustrate the complex CIAM challenges facing technical roles in B2B, B2C, and B2E environments. Developers, engineers, systems architects who are responsible for CIAM and fraud prevention will find this post most valuable, as we will discuss how facial biometric authentication can strengthen identity assurance while simplifying challenges in implementation, operations costs, security needs, and CX expectations.  

## Facial Biometric Authentication

> Facial Biometric Authentication can help technical roles secure enterprise assets while simplifying the user experience.

Finding the right balance between user convenience, privacy, and security is today’s biggest challenge for developers. CIAM is a convergence of IAM, fraud detection, and authentication tools that are used for controlling user access by both internal users (your workforce) and external users (your customers). However, according to Gartner, no single tool can deliver on all the identity administration, fraud detection, access management, content management, and analytics needed to build out a holistic solution.

As a result, technical roles are left cobbling together solutions that may leave gaps in security or may increase friction in user experience that requires additional investment to remedy. Advanced facial biometric authentication seamlessly woven into the Auth0 login workflow can provide the needed balance between a frictionless user experience and protection against password-related fraud, phishing, and account takeover. 

## 4 Ways to Leverage Auth0 and Advanced Facial Biometric Authentication to Strengthen CIAM

Auth0 simplifies biometric multi-factor authentication for the technical teams responsible for implementing CIAM strategies and tools. This simplification is delivered in four main areas.  

* Easy Implementation with Broad Solution Support
* Operational Efficiency and Cost Reduction 
* Improved Security and Fraud Reduction  
* Enhanced User Experience 

### Easy Implementation with Broad Solution Support

Users today shop, play and work using a broad range of mobile devices and desktop computers, and operating systems. So technical roles need a strong authentication solution that is device-agnostic and capable of supporting everyone interacting with your platform. Biometric authentication that offers portability without being tied to a specific device, an authenticator fob, or an authenticator app also provides the right balance between enhanced platform security and increased user satisfaction and adoption.

### Operational Efficiency and Cost Reduction

Operational inefficiencies caused by complex authentication experiences impact customer loyalty and workforce productivity, with negative impacts on revenue and profits as businesses move slower and customers are lost. B2B, B2C, and B2E focused organizations using Auth0 can improve operational efficiencies and reduce related costs with authentication solutions that are applicable for many use cases across multiple devices. To simplify CIAM for technical roles - focus on finding a solution for user authentication that can serve internal, external, and developer use cases. Facial biometrics can support authentication use cases, including online or mobile app login, chat or call center support, as well as strong authentication for valued transactions and account activity. Also, remember solutions that require complex maintenance should be avoided in lieu of a solution that simplifies administration requires no additional hardware, training, or mental burden on behalf of the user. 

### Improved Security and Fraud Reduction

Advanced facial biometric authentication reduces the risk of account misuse and takeover by requiring the live face of a registered user as a factor for authentication and a condition for access. Even in the event of password or credential compromise, advanced facial biometrics will stop unauthorized access from occurring. Facial biometric multi-factor authentication addresses many fraud-related concerns, including the ability to stop account takeover and quickly authenticate the validity of transactions flagged for manual review. 

### Enhanced User Experience

Including advanced facial biometrics as a factor for authentication within your Auth0 workflow delivers a sophisticated digital experience by balancing strong authentication with customer expectations of low friction authentication and easy access. Today’s users—whether they are shopping, working, or banking – sitting on the train or at their desks are demanding portability with less friction. Advanced biometric authentication eases the user burden as there is no need to download additional software or employ multiple devices for authentication. 

## Conclusion

When evaluating CIAM tools to reduce friction in or further secure your MFA workflow, consider Verified CloudConnect—the ideal bolt-on integration for Auth0. Verified™ CloudConnect delivers fortified, in-browser biometric authentication—supported across all mobile and desktop devices used to access enterprise data and resources. At login or for any transaction you deem to require additional identity assurance, the Verified browser-based UX adds an additional factor of authentication – a live selfie. Verified analysis of the selfie in real-time for biometric matching and liveness, defending user accounts from deep fakes and other spoofing attempts. 

Verified CloudConnect is a flexible, drop-in solution that seamlessly extends the Auth0 Identity Platform to secure B2B, B2C, and B2E environments without additional authentication hardware, mobile apps, or single-use pin-codes. As Gartner has noted – no one single vendor can deliver for all aspects of identity and access management. Adding a tool like Verified CloudConnect for Auth0 will improve user experience, thereby increasing user adoption and retention. Deployed easily with a simple line of code, Verified enhances your current security stack while reducing operational costs and overall solution complexity.  

Ready to get started with Verified CloudConnect for Auth0? Visit [authID.ai listing](https://marketplace.auth0.com/integrations/verified-biometric-mfa) on the Auth0 Marketplace for more information.

4 Ways to Strengthen Identity Authentication for Technical Roles

william_johnson

  Will Johnson is a Developer Advocate at Auth0. He loves teaching topics in a digestible way to empower more developers. He writes blog posts, records screencasts, and writes eBooks to help developers. He's also an instructor on <a target='_blank' rel='noopener noreferrer' href='https://egghead.io'><strong><b>egghead.io</b></strong></a>.


Developer Advocate

Will Johnson

Quickly integrate Twilio for SMS-based multi-factor authentication

Your users' most trustworthy interaction with your business is when they type each letter on their keyboard to enter their username and password into your login box. After they hit enter and send this confidential information through the internet tubes, they trust that your application has done everything possible to keep their data safe from bad actors.

Even with proper protocols, expert attackers still find shortcuts and backdoors to access users' credentials and confidential information. The good news is you can add another layer of protection for your users by adding Multi-factor Authentication (MFA) to your Application. MFA lets you add another factor to verify so users can prove who they say they are. There are several types of MFA methods. Some of them are SMS-based, One-time passwords (OTP), Authenticator apps, and Biometrics, to name a few. 

> To learn more about MFA methods, [check out this MFA Guide](https://auth0.com/blog/multifactor-authentication-mfa/).

Today, you will add SMS-based MFA with Auth0 using Twilio as the SMS provider. Twilio is a popular customer engagement platform that you can easily integrate with Auth0.

If you prefer, you can also watch this video on the same topic:

<AmpContent>
<amp-youtube
    data-videoid="lF7stm2nUHQ"
    layout="responsive"
    width="480" height="270">
</amp-youtube>
</AmpContent>

<NonAmpContent>
<div
  class='embed-container'
  style="position: relative; padding-bottom: 56.25%; height: 0; overflow: hidden; max-width: 100%;margin-bottom:40px;">
    <iframe
      style="position: absolute; top: 0; left: 0; width: 100%; height: 100%;"
      src='https://www.youtube.com/embed/lF7stm2nUHQ'
      frameborder='0' allowfullscreen>
    </iframe>
</div>
</NonAmpContent>

## What Will You Need?

* An Auth0 Account. If you don't have one, <a href="https://a0.to/blog_signup" data-amp-replace="CLIENT_ID" data-amp-addparams="anonId=CLIENT_ID(cid-scope-cookie-fallback-name)">you can register for free</a>
* A Twilio Account
* A mobile phone

## Set Up and Configure Auth0 React Demo Application

> If you already have a Single Page Application registered in your Auth0 dashboard, you can skip to [Create Twilio Account and Get Credentials](#Create-Twilio-Account-and-Get-Credentials).

### Clone the demo application

Start by cloning the [Auth0 React SDK Sample Application from GitHub](https://github.com/auth0-samples/auth0-react-samples/tree/master/Sample-01). This is a sample React app set up and connected with Auth0. Once you have the Application installed on your machine `cd` into `auth0-react-samples` then again into `Sample-01`, use npm to install the project's dependencies.

```bash
npm install
```

Once the dependencies are finished installing, run `npm run dev` in your terminal and in your browser visit `http://localhost:3000`, if it doesn't automatically start. Now you'll see the React sample project with a login button in the upper right corner of the screen.

![Auth0 Sample Project Login Screen](https://images.ctfassets.net/23aumh6u8s0i/4B7KxXicKfMF4SS7an6RxB/9c29ccdcc08572b11dd9691923c328c5/React_SDK_Local.png)

In the project's `src` folder, you'll find the `auth_config.json.example` file. There's a JSON object with placeholder values inside this file. Copy it, then create a new file in the same folder named `auth_config.json`. With this file created, you need to replace the placeholder values with your own credentials from the Auth0 dashboard. 

![Auth0 Config File](https://images.ctfassets.net/23aumh6u8s0i/6cM6y7s5CqxfC4DpMbDI8r/0b22c0cdc5ed736bc0631b52e2028080/Screen_Shot_2021-12-02_at_7.44.45_PM.png)

## Get Credentials from Auth0 Dashboard

Now go to your Auth0 Dashboard; click _Applications_, then click _Applications_ again when the options dropdown on the right-side panel. Click _Create Application_ if you don't already have an application in your Auth0 account.

![Auth0 Dashboard Application Page](https://images.ctfassets.net/23aumh6u8s0i/3IP95iBgYyz7XJ62rwqbyW/f6862e32b8169566bbd7343ff892966c/Screen_Shot_2021-12-02_at_8.19.52_PM.png)

On the Create Application screen, you'll give your Application a name. You can use "Twilio MFA Test." 

Next, you'll choose the application type; select _Single Page Application_ since this is a React application. Then click _Create_.

![Auth) Dashboard Create Application Page](https://images.ctfassets.net/23aumh6u8s0i/5ZxkkuVUS3nmhqWvQuu8aZ/67bef7be2b4cca5460f8311c2be69655/Screen_Shot_2021-12-02_at_8.45.53_PM.png)

Since you already have the sample application on your machine, skip Quick Start and click _Settings_. This is where you will find the Domain and Client ID, that you need to replace the placeholder values in the `auth_config.json` file. You can copy the values from the dashboard into your code editor.

![Application Settings Page](https://images.ctfassets.net/23aumh6u8s0i/nQMYVh3ZDtMSYUCog7e5r/e8b8b471b7097d36918547037c78ce5f/Screen_Shot_2021-12-02_at_9.11.39_PM.png)

Next, scroll down to the Application URIs section to fill in Allowed Callback URLs, Allowed Logout URL, and Allowed Web Origins. This example is running locally, so enter `http://localhost:3000` into each field. When you're finished, scroll to the bottom of the page and click _Save Changes_.

![Application URIs](https://images.ctfassets.net/23aumh6u8s0i/6kXeY9LVo5sincLcxSdrk1/e25a7bfd89bcda641f6c6625ad143aa5/Screen_Shot_2021-12-03_at_8.37.26_AM.png)

You can now run the Application locally again and click Login; enter a username and password, and the user will be successfully authenticated with Auth0. As you may have noticed the username and the password are the only factor being used to authenticate users. Make your application more secure by adding another factor for the user to verify. Twilio can add SMS-based authentication. You'll set that up next.

## Create Twilio Account and Get Credentials

If you don't have a Twilio account already, you can create one [here](https://www.twilio.com/try-twilio). Once you have created an account and logged in, you'll see the Twilio console. Here you'll see your Account SID and Auth Token, which you'll use later. The next step for a new Twilio account is getting a Twilio phone number. This will be the number that will send a one-time passcode to your user to verify and complete their authentication after they've logged in with their username and password.

### Get a Twilio trial phone number

In the Twilio Console, click _Get a trial phone number_. You'll automatically get assigned a number click Choose this Number. This number will now show on the Project Info section under Phone Number.

### Configure Auth0 to use Twilio for MFA

Back at your Auth0 dashboard, look at the ride side menu, click Security, then Multi-factor Auth. On this page, you'll be shown all the factor options that you can use with Auth0. For this Application, click on _Phone Message_.

The first thing you need to do on the Phone Message page is click the toggle button on the upper left side corner to enable Phone Message MFA. You'll see a pop-in notification confirming it has been enabled.

Next, you'll need to Choose a delivery provider; you'll see that Twilio is one of the listed options making it easy to connect Twilio to your Auth0 account.
For _Choose a delivery method_, you have SMS, SMS, and Voice, or Voice to choose from. For simplicity, select SMS.

![Phone Message Settings Page](https://images.ctfassets.net/23aumh6u8s0i/1Rhy8cNvQn76y81MQ9b81j/59ae57cdd0300d658456ef03b5ff0af9/Screen_Shot_2021-12-03_at_11.40.16_AM.png)

When you select Twilio as the delivery provider, you will have some new fields appear to enter the Twilio SID, Twilio AuthToken, and the From phone number. You'll see all of those values in the Twilio console.

![Twilio Console](https://images.ctfassets.net/23aumh6u8s0i/4SO3LiFDt5wt4MdOZFuFR1/446d53076c18666ac2d705de50b3f7f4/Screen_Shot_2021-12-03_at_10.59.05_PM.png)

Copy each value to the matching field in the Auth0 Dashboard. The two template fields can customize the message the user gets sent. You'll leave these as they are in this example. Now click _Save_.

![Phone Message Twilio Settings](https://images.ctfassets.net/23aumh6u8s0i/12Xd2Mg7Twq6Nk7eV5Ra1s/cfd809f4a460dca1c5c3ee4c82424971/Screen_Shot_2021-12-03_at_11.26.55_PM.png)

Now you have everything configured to use Twilio as an SMS MFA provider, but there is still one more step left to actually make everything work!

## Enable MFA in the Auth0 Dashboard

Back on the Multi-factor Authentication page, there are two sections Factors, which we just completed, and Define Policies. Define Policies will tell Auth0 when you want to prompt the user to use MFA. In the Require Multi-factor Auth section, the default is Never, which is the exact opposite of what you wish to do after doing all that work of configuring MFA.

The second option is an add-on called Adaptive MFA. This takes a look at the user's environment and determines if it's risky and requires another authentication factor. For this example, you'll choose _Always_, then click _Save_.

![Define Policies Section](https://images.ctfassets.net/23aumh6u8s0i/62TwidbXDP7luY9XQHeECD/25425b0cc1c9638401c40922cf61b371/Screen_Shot_2021-12-03_at_11.41.27_PM_1.png)

You'll get a prompt asking if you want to continue and let you know all new and existing users are now required to enroll in MFA click _Continue_. That will update your MFA policy, and now, when a user registers or logins, they will be met with a prompt to add their phone number to enroll in MFA.

Now that everything MFA is enabled in your Application, you want to test it out to ensure everything goes smoothly.

## Test MFA on Login

With your sample application running, click _Login_ and enter your email and password. Next, you'll be prompted to add a phone number to secure the account. This is what your users will see the next time they log in after you enable MFA.

You can select the code for your country on the first line, then type in your phone number and click _Continue_. You'll then have an SMS message come to your phone with a verification code. Enter that code into the input box on your application. 

Now you're successfully logged in, and your users have another layer of protection from their data being compromised. All thanks to you, pat yourself on the back!

## Summary 

You just added Multi-factor authentication to your application using Twilio as the provider. You entered your Auth0 credentials to the `auth_config.json` in the project files of your application. Then, you enabled Phone Message MFA in the Auth0 Dashboard and added your Twilio credentials. 


Enable Multi-factor Authentication with Auth0 and Twilio

Use Auth0 Actions to enable SMS-based MFA with Plivo.

Logging into a website with your username and password is a straightforward way to log in and access your content. You've been doing it for years, you've created several passwords, and it works. Logging in with **just** a password isn't as secure for your users as it used to be. Hackers can steal passwords from one site and use [credential stuffing](https://auth0.com/blog/what-is-credential-stuffing/) to pose as your user and gain access to other sites. It's common for your users to re-use passwords since they have several to remember across all their applications. You can help keep your users' data secure by offering another layer of protection by enabling Multi-factor Authentication (MFA).

> To learn more, read [this guide about MFA and its different methods on the Auth0 blog](https://auth0.com/blog/multifactor-authentication-mfa/).


You've likely experienced MFA in real life. For example, if you start working for a new company, they may ask for your ID card and a birth certificate. Those are two different *factors* of identification. It helps verify you are who you say you are to make sure your paycheck goes to you and lowers the success rate of someone posing as you.

In this blog post, you'll learn how to implement SMS-based MFA with Auth0 Actions and [Plivo](https://www.plivo.com/).

## Prerequisites

- An Auth0 account
- A Plivo account
- A Plivo phone number

If you do not have a Plivo account or an Auth0 account, you can sign up for a [free Plivo account](https://console.plivo.com/accounts/register/) and a <a href="https://auth0.com/signup" data-amp-replace="CLIENT_ID" data-amp-addparams="anonId=CLIENT_ID(cid-scope-cookie-fallback-name)">free Auth0 account</a>.

If you already have an application created in your Auth0 account, you can skip to [Create Action for MFA](#Create-Action-for-MFA).


## Set up & Configure a React App Application with Auth0

In the Auth0 dashboard, create a new application by clicking on **Applications > Applications > Create Application**. On the next screen, create a name for your application and select **Single Page Web Applications** since you're using a React app. 


![Auth0 Create Application Page](https://images.ctfassets.net/23aumh6u8s0i/7ffrE0TIKPuvwAmyAHETGV/3704b624e8b568fba9288b1c6236872d/auth0-create-application-page.png)


The next screen will ask you, "What technology are you using for your web app?" Select **React**.


![Auth0 Technology Selection Page](https://images.ctfassets.net/23aumh6u8s0i/3Is0KXk07ueIJadkrrHnbl/804f4ad53e8af5b28916481b92778fdc/auth0-technology-selection-page.png)


To get up and running quickly, you can download a sample [React application integrated with Auth0 on GitHub](https://github.com/auth0-samples/auth0-react-samples/tree/master/Sample-01).
Once it is downloaded, type `cd auth0-react-samples` on your terminal, then run `npm install` to install the dependencies.

## Configure Auth0 Credentials

For the authentication flow to work, the project needs your Auth0 domain and client ID. In your code editor, copy the content of `src/auth_config.json.example` into a new file in the same src folder called `auth_config.json`, and replace the values with your own Auth0 application credentials:

```js
{
  "domain": "{YOUR AUTH0 DOMAIN}",
  "clientId": "{YOUR AUTH0 CLIENT ID}",
}
```
You can get the client ID and domain from the settings tab on your new application page.

![Auth0 Application Settings Page](https://images.ctfassets.net/23aumh6u8s0i/1GFtgZeJursgHKHzNXQFVh/7496cb3bc06a7411096386c3109be8ed/auth0-application-settings.png)

Next, scroll down to the Application URIs section to fill in Allowed Callback URLs, Allowed Logout URL, and Allowed Web Origins. This example is running locally, so enter `http://localhost:3000` into each field. When you're finished, scroll to the bottom of the page and click _Save Changes_.

![Auth0 Dashboard Application URIs section](https://images.ctfassets.net/23aumh6u8s0i/6kXeY9LVo5sincLcxSdrk1/e25a7bfd89bcda641f6c6625ad143aa5/Screen_Shot_2021-12-03_at_8.37.26_AM.png)


## Create Action for MFA

With an application linked to the Auth0 dashboard, you can create an Action that will run globally for all applications in your Auth0 tenant. Actions are functions written in Node.js that you set to run at specific events based on your users' actions. Actions let you write custom code that fits your needs and integrates third-party vendors with Auth0 to work together. This post is going to focus on integrating with Plivo. 

To get started with Actions, you need to add an Action to your library. On the Auth0 dashboard side menu, click **Actions > Library**.

![Auth0 Actions Selection](https://images.ctfassets.net/23aumh6u8s0i/6q9LRH1DvQMiF3mU7t6Wy7/8481bc4376718299a2806a165e49ed56/auth0-action-selection.png)


On the Library Page, click **Add Action**. On the Browse Actions page, search for **Plivo** and click on it. On the next page, click on **Add Integration**.
You'll then be met with a prompt telling you, "Plivo will need access to: Read and share user profile information" if you agree, click **Continue**.

## Access and Add Plivo Credentials

This will bring up a page to enter your Plivo credentials such as Plivo authorization ID, Plivo phone number, and Plivo authorization token. You can find the authorization ID and Token on the Account and Payments section of your Plivo dashboard.

![Plivo Accounts and Payments Page](https://images.ctfassets.net/23aumh6u8s0i/3Dttg4mSQ9R20tnFzsRuVr/01c5fe787a262c6e5793642703785064/plivo-accounts-and-payments.png)

Access your Plivo phone number by clicking on **Phone Numbers** on the left side menu. If you don't have a Plivo phone number, you can rent one [following these instructions on the Plivo Docs](https://www.plivo.com/docs/numbers/guides/buy-a-number/).

> Make sure you add the phone number in the E.164 format(ex. +15554443232)

Then click **Create**, and you'll go to the Library page. You can create an Action Flow from here. You'll learn how to use flows next.

## Create Send Phone Message Flow

You should now see the Plivo Action on the installed tab of the Library page. Click the three dot menu on the right and select **Add to flow**. 

![Actions Library Page](https://images.ctfassets.net/23aumh6u8s0i/5IbEG0QKPAbyIoi9buA2NL/ba6df3e83c1cc498b248eafd48fc5362/auth0-add-to-flow.png)


This will take you directly to the **Send Phone Message** flow. Flows are the steps your application takes when using Auth0 as your identity provider. You'll see the **Start** and **Complete** trigger points in the flow in Action flow visualizer in the middle of the screen. On the ride side of the screen, you'll see the **Add Action** section. This will show a list of installed Actions like the Plivo one we created, and there is also a tab for custom Actions.

![Auth0 Actions Visualizer](https://images.ctfassets.net/23aumh6u8s0i/ITasqHfe5OIyRImhGGxis/0a125823cda2f4ee84c2f19d5f6b97ae/auth0-actions-flow-visualizer.png)

You can drag and drop the Actions to the point in the flow that you want them to trigger. Grab the Plivo Action and drop it in between **Start** and **Complete**, then click **Apply**.

![Auth0 Actions Flow Visulizer](https://images.ctfassets.net/23aumh6u8s0i/YYUxv5wmVMjjcFA6ictqN/0683342bf45d6a9e0661e7cbd0febd7e/auth0-actions-added.png)

Now, when an SMS message is requested, your application will signal Pilvo to send an SMS message. But how do you trigger the message request? You have to turn on SMS-based Multi-factor Authentication.

## Turn on MFA in Auth0 Dashboard

On the left side menu in the Auth0 dashboard, click **Security > Multi-factor Auth**. 

![Auth0 MFA page](https://images.ctfassets.net/23aumh6u8s0i/4UUXYlr7UjlSqt3mxPoyrq/17d0e5470369da629062de484fb59862/auth0-mfa-page.png)


In the **Factors** section, scroll down and click **Phone Message**. Click the toggle on the upper right side of the screen to enable Phone Message. With this turned on, it requests a phone message be sent to your users with a code to verify their login. 

Under **Choose a delivery provider**, select **Custom**, since you created the Plivo "Send Phone Message" hook to handle sending an SMS to users. For **Choose a delivery method**, choose **SMS**. 


![Auth0 Phone Message Screen](https://images.ctfassets.net/23aumh6u8s0i/3lfkktB82h2DkLrnl8OCBy/1fa9fb6ec90eb3519b6cc48546cbaeae/auth0-phone-message-screen.png)


Scroll to the bottom of the page and click **Save** to save these settings.

Return to the **Multi-factor Authentication** page and scroll down to the **Define policies** section. This section tells Auth0 when you want the Phone Message MFA request to trigger. For this example, select **Always** to ensure your users have an extra layer of protection each time they log in. Then click **Save**.

You will then be asked, "Are you sure you want to continue?" This prompt also lets you know that all users will be required to enroll in MFA and that all applications in your Auth0 tenant will now use MFA. Click **Continue**. 

You have everything set up to require your users to receive an SMS message with a verification code from Plivo after logging in. But it's always a good idea to test out new features after you add them.

## Test Your MFA Login Flow

Run your sample application locally by launching the `npm run dev` command in the project's root folder. Then, head your browser to the [http://localhost:3000](http://localhost:3000) address and click **Login** on the home page. On the login page, enter your email and password. Next, you'll be prompted to add a phone number to secure the account. This is what your users will see the next time they log in after you enable MFA.

You can select the code for your country on the first line, then type in your phone number and click **Continue**. You'll revieve an SMS message with a verification code. Enter that code into the input box on your application.

You've successfully added another factor of protection for your users!

## Test MFA flow in Auth0 Dashboard

Another way you can test the MFA flow is by using the Auth0 dashboard. You can test Actions you created without having to run your entire application.

Click **Getting Started** at the top of the left menu on the Auth0 dashboard. You'll go to the **Getting Started** page, where you'll see the option to **Try your Login box**. Clicking **Try it out** will bring you to the login box that your app will use. 

![Auth0 Dashboard Getting Started page](https://images.ctfassets.net/23aumh6u8s0i/6x1ti069gOiQQEfKMxJOkA/1a574fcaa21a63c27af49c46f945ac5d/auth0-try-login-box.png)

Log in as one of the users in your tenant (If you don't have any users, click **Sign up**).

Once logged in, you'll be asked to provide a phone number. Enter the number for your mobile phone. You'll receive an SMS message from your Plivo phone number with a six-digit code. Enter this code into the Auth0 login box and click **Continue**. You'll be greeted with the **It Works** page, confirming that your MFA Action worked!

![Auth0 It Works web page](https://images.ctfassets.net/23aumh6u8s0i/2TPUwfu11Te9Yb27M3920C/34f3bc3c726eeb0b76cc971c7fd1f5c3/auth0-it-works-screen.png)

## Conclusion

Congrats! You just added another layer of protection to keep your users' data safe. First, you included the Plivo integration from Actions Library. You then created a "Send Phone Message" flow using the Plivo integration and the Actions drag and drop interface. After that, you enabled the Action by turning on MFA in the Auth0 dashboard. Finally, you tested everything out using "Try your Login box" in the Auth0 dashboard.


Enable SMS MFA with Plivo and Auth0 Actions

andres

I’ve been at Auth0 since 2017. I’m currently working as a Product Manager for the Auth0 FGA and OpenFGA products. Previously, I worked in the teams that owned the Login and MFA flows. <br>
I spent my entire 20+ year career building tools for developers, wearing different hats. When I'm not doing that, I enjoy spending time with my family, singing in a choir, cooking, or trying new kinds of local cheese.

Product Manager

Andrés Aguiar

WebAuthn Authenticators offer a streamlined user experience and enhanced security

In the last few years, the [FIDO Alliance](https://fidoalliance.org/) has been working relentlessly towards the vision of helping users authenticate with maximum security and minimum friction. The resulting [WebAuthn standard](https://www.w3.org/TR/webauthn-1/) provides the foundation for that to happen. Now it is up to the industry to make that technology available to end users. 

WebAuthn is the only standard-based authentication method that makes phishing impossible, as it binds the public/private key to a specific web domain. You cannot mistakenly authenticate into a phishing website.

A few weeks ago, [we announced](https://auth0.com/blog/fido-security-key-support-comes-to-auth0/) the support for [FIDO Security Keys for MFA](https://auth0.com/docs/mfa/fido-authentication-with-webauthn) using WebAuthn. Security Keys are a great way to secure access to your account, but their adoption is mostly limited to tech-savvy users or corporate environments with relatively high-security requirements.

We are now announcing support for [**FIDO Device Biometrics for MFA using WebAuthn**](https://auth0.com/docs/mfa/fido-authentication-with-webauthn). This makes the security and convenience of WebAuthn-powered flows available to anybody who has a device and browser who can support the biometric challenge, not just those who have security keys. Now all users can reap the benefits of this technology, regardless of how tech-savvy they are. 

<include src="WebAuthnMeCTA" group="A"/>

Enabling users to authenticate using their device biometrics has two benefits: it **greatly reduces friction** during the authentication challenge, which impacts user **retention and revenue**, and **it increases security** since the flow is not phishable by bad actors. 

The data we collected during Beta testing shows biometrics performing much better than other MFA options:

![Internal Auth0 study, March 2021](https://images.ctfassets.net/23aumh6u8s0i/wD2JeWObWymymRv7Xs7gf/8d5c021776667b1e87d691cf7429e37a/graphics.jpg)
<p align="center"><i>Internal Auth0 study, March 2021</i></p>
<br>

The Y axis shows time to complete, and the X axis represents the % of users that can complete the MFA challenge. WebAuthn platform authenticators have the highest passing rate (94%) and the shortest time to complete (5 seconds).

## WebAuthn With Device Biometrics Availability

For users to take advantage of biometric authentication on the web, they need to have devices that support WebAuthn. It’s hard to know precisely how many devices are capable of WebAuthn Device Biometrics, as there is no specific information. We can only approximate with operating system and browser usage statistics, as in Android and Windows, it depends on the device in addition to the OS/Browsers.

<table border="1">
<tbody>
<tr>
<td><b>Operating System & Browsers with WebAuthn Device Biometrics Support</b></td>
<td><b>OS Adoption March 2021 Source: <i>StatCounter</i></b></td>
</tr>
<tr>
<td>Mac OS Catalina (Chrome, Edge, Brave)</td>
<td><a href="https://gs.statcounter.com/os-version-market-share/macos/desktop/worldwide#monthly-202103-202103-bar">67%</a></td>
</tr>
<tr>
<td>Mac OS Big Sur (Chrome, Edge, Safari, Brave)</td>
<td>Unknown</td>
</tr>
<tr>
<td>iOS 14+ (Safari)</td>
<td><a href="https://gs.statcounter.com/os-version-market-share/ios/mobile-tablet/worldwide#monthly-202103-202103-bar">76.24%</a></td>
</tr>
<tr>
<td>Windows 10 + (All modern browsers)</td>
<td><a href="https://gs.statcounter.com/os-version-market-share/windows/desktop/worldwide#monthly-202103-202103-bar">78.28%</a></td>
</tr>
<tr>
<td>Android 7+ (Chrome)</td>
<td><a href="https://gs.statcounter.com/android-version-market-share/mobile-tablet/worldwide/#monthly-202103-202103-bar">82.08%</a></td>
</tr>
</tbody>
</table>
<br>

You can get additional information about browser support on our [webauth.me](https://webauthn.me/browser-support) site.

## Enrolling With Device Biometrics

Authenticating using WebAuthn with Device Biometrics presents two unique challenges:

* Given the authentication method is bound to a specific device, it cannot be **the only** authentication method the user has, or they will be unable to log in from a different device. 
* Users would want to use biometrics to login from all of their devices, and applications should make it possible to enroll all of them.

Auth0’s solution addresses both problems. It will always ensure that users’ have another way to authenticate. When MFA is enabled, users can only enable biometric authentication if they also enable another option.

The enrollment flow would be as follows:

![The enrollment flow](https://images.ctfassets.net/23aumh6u8s0i/skfRYpG6f4PbJAfT5jcji/98afcec8e1653c389b6344099a2ff003/unnamed-2.png)

* The user authenticates with a username and password.
* Enrolls in any other MFA Factor (e.g., a security key, a TOTP application like Google Authenticator, Push, SMS)
* If the device is capable of using Webauthn Device Biometrics, users will get the option of enrolling with it.
* If they do, the next time they login from that device, they can use Device Biometrics as the second factor.

#### Progressive Enrollment

Auth0 employs progressive enrollment to aid users in authenticating from different, WebAuthn-capable devices. Whenever a user presents this type of device for authentication, they will first be prompted to enroll it. This is a progressive process that is only activated once new, WebAuthn-capable devices are used so that they will be able to authenticate with biometrics in all of their devices capable of this functionality. 

For example, when a user initially authenticates from a MacBook with a Touchbar, they authenticate with their username and password and enroll in another MFA factor. However, since the MacBook has biometric capabilities, they will be prompted to enroll if they like. Later, if they wish to use their iPhone with FaceID capabilities, they will be automatically asked to use Face ID before proceeding. This process guides users through a progressive enrollment flow that is easy, seamless, and friction-free.

Here’s a quick demo of WebAuthn with Auth0:
<include src="Vidyard" id="CPw4UfSZxmTPkFvJSEC1x2" />

## Enabling WebAuthn With Device Biometrics

If you are currently using MFA with Auth0, biometrics can be enabled from the Auth0 dashboard. 

![Auth0 dashboard](https://images.ctfassets.net/23aumh6u8s0i/4UC4NaiiciIpjLGBPwab9h/07ea4d71950ba229bd3be05d8fb48696/unnamed-3.png)

After you enable it, users will receive prompts from enrolling their devices when authenticating; no code change is necessary.

Please refer to our documentation to learn more about [Auth0’s WebAuthn implementation](https://auth0.com/docs/mfa/fido-authentication-with-webauthn) in general and [WebAuthn for Device Biometrics](https://auth0.com/docs/mfa/configure-webauthn-device-biometrics-for-mfa) specifically.

## What’s Next

WebAuthn with Device Biometrics combines two authentication factors in one: something you have (the device) and something you are (the biometrics). In case you can’t use biometrics in the device, e.g., if you are wearing a mask, you’ll use something you have plus something you know (the passcode). As it’s stronger than a password and simpler to use, the next step is bringing it to passwordless authentication. Auth0 will support this in the same way we are doing it for MFA by letting users progressively enroll all of their devices. Stay tuned!

MFA With WebAuthn for FIDO Device Biometrics Now Available

arthur-bellore

I’m a tech content creator. I enjoy breaking up seemingly complicated topics into easy-to-understand pieces for people to read. When I’m not in front of a computer, you’ll usually find me reading books.

Cybersec Writer

Arthur Bellore

Why hardware-based Two-Factor Authentication makes the user much more secure over other multi-factor alternatives

When I wrote about how software 2FA is a step-up from SMS 2FA, I also mentioned how there’s one attack vector that software 2FA is still vulnerable to phishing. It’s the **user** who must verify they are entering the passcode into the legitimate website, and bad actors exploit that.

Phishing is a hard problem to solve because the bad actor exploits human behavior that has been ingrained in all of us for the last couple hundred thousand years and will probably continue to be for a long time in the future.

Everybody is prone to fall for phishing campaigns, even security-conscious people, because these attacks are never head-on, explicit attacks, but sneaky ones and when you aren’t expecting them.

And if we look at types of attacks over the years, there is a clear trend: the number of websites containing malware has been declining, while the number of phishing websites skyrocketed in the last few years. You can see that in the chart below:

![01_bleeping_computer](https://images.ctfassets.net/23aumh6u8s0i/5Z7X9Z3Dm07lEvbjtubPO1/6c57ba7fc4b4458c6a995463e6a39ee6/01_bleeping_computer.jpg)
<p align="center">Source: <a href="https://www.bleepingcomputer.com/news/security/google-chrome-uses-safe-browsing-to-improve-phishing-protection/">Bleeping Computer</a> via <a href="https://transparencyreport.google.com/safe-browsing/overview">Google Transparency Report</a> (archive)</p>

<p align="left"></p>
Attackers are becoming more **proactive** and trying to **force errors**. With more devices connected to the Internet, these attacks become more profitable (we’ve seen a [surge during the last few years](https://www.f5.com/company/news/features/phishing-attacks-soar-220--during-covid-19-peak-as-cybercriminal)), and now more companies are starting to pay attention to phishing attacks.

Taking the human element out of security is not an easy task, but that is what Universal 2nd Factor, or U2F, tries to do — it’s an open protocol for second-factor hardware keys that doesn’t rely on the user to make sure he’s on the right website; there is a built-in mechanism on the key itself to verify that.

## How The U2F Protocol Was Created

In 2011, the founders of Stockholm-based Yubico would relocate to Silicon Valley to be in close contact with tech companies to further develop the protocol used by the YubiKey into a universal standard.  

> Note: many hardware tokens, such as the YubiKey 5, support more types of authentications on top of U2F (e.g., TOTP), but references to hardware tokens throughout this article refer specifically to U2F.

In that same year, they started discussions with Google’s internal security team and together identified YubiKey as the best solution to solve the employee phishing problem Google was having at the time.

One year later, in 2012, Google and Yubico signed a partnership to co-create the U2F — an open standard for two-factor authentication based on public-key cryptography that would remove the need for the user to verify that they were, in fact, at the intended website. 

They tested the USB token Yubico had created with Google employees, and one year later, they joined the FIDO Alliance board and brought along with them the technical specifications to the protocol. The protocol continued to be improved over the years, being released publicly for Chrome and Gmail, along with many other products.

In 2019, the World Wide Web Consortium (W3C) announced Web Authentication API (WebAuthn), the new global standard comprising the implementation of FIDO U2F security keys in most modern browsers. By that time, [Google already eliminated phishing attacks by having its 85,000 employees use hardware tokens](https://krebsonsecurity.com/2018/07/google-security-keys-neutralized-employee-phishing/). 

## How Hardware 2FA (or U2F) Works

When you think of a real-world key, you probably imagine that the same key you use to _lock_ something is also used to _unlock it_. If you have a chest with all of your passwords stored inside, this setup works because you’re the only one who needs to access it.

But what would happen if you wanted to share a password securely with me (and only me)?

Well, here’s an option. I could get a chest and put it outside my door. Then I could leave the key on a key holder outside, and you would come over, put the password inside the chest, lock it, and put the key back on the key holder. As soon as I get back home, I would take the keys, open the chest, and pick up the password you put in there.

This approach is far less than ideal because we can’t be sure who else used the key to open the chest and read the password. I also can’t be sure that you, or anyone else, didn’t make copies of my key to open my chest.

The solution to this problem is **public-key cryptography**, and it’s the principle used by U2F tokens to authenticate users. In public-key cryptography, instead of using just one key, we use a pair of keys — if you lock the chest with a certain key, only the other key can unlock it.

![02_How_hardware_2fa_works](https://images.ctfassets.net/23aumh6u8s0i/1DZ5lxj8zLE6vu3vluVADj/1f79e96a559d9b0eecdce2603be22efa/02_How_hardware_2fa_works.jpg)

Now I can keep one key — my private key — and put the other one outside for you to use — the public key. And since only my private key can unlock the chest, once you lock it, no one else can use the key I left outside to peek inside the chest.

In cryptography, these keys are called a **key pair** and are mathematically linked. I could create as many public keys from a private key as I wanted, but you can’t recreate my private key from a public key.

Key pairs can be created using software, but in the case of U2F, the private key is **generated using a unique secret that is embedded during the manufacturing process and can never leave your U2F token**, which is what makes it so secure.

The process to start using U2F in an account is simple and happens in two steps: registration and authentication.

## Registration

This step involves four parties:

- the user,  
- the hardware token,  
- the client (e.g., a browser),  
- and the remote server. 

To register a security token, the user needs first to authenticate through another method, e.g., with username and password, or while he’s creating the account for the first time. After the user signals they want to register a U2F token, the server sends a challenge — a random number — and an AppID to the user’s device.

The AppID is a unique identifier for the app — on a browser, the AppID is the URL, like `auth0.com`. On Android, it’s going to look something like `android:apk-key-hash:<hash-of-apk-signing-cert>` and on iOS, something like `ios:bundle-id:<ios-bundle-id-of-app>`.

Once this information is received, the user will be prompted to press a button on the hardware token to confirm the request. This will prevent remote attacks even if the key is inserted into the user’s device.

![03_registration](https://images.ctfassets.net/23aumh6u8s0i/2mGwrM5SqnQ6Jz8S5EQXCo/d1ae6f4bfae43541bae86596dfa8fe43/03_registration.jpg)
<p align="center">Source: <a href="https://www.yubico.com">Yubico</a></p>


The hardware token will generate a [nonce](https://en.wikipedia.org/wiki/Cryptographic_nonce) and hash it together with the AppID and the secret key on the token using HMAC-SHA256 to create a private key. From this private key, a public key is derived, along with a checksum. Check the diagram below:

The nonce and public key are sent back to the server to be stored for later when the user comes back to authenticate.

## Authentication
<p align="left"></p>
The user will normally authenticate with their login and password. The server will remember that this user has a security token registered and will generate a new challenge to send back along with the AppID and nonce created on the registration phase.

The browser will once again ask the user to press a button on their physical token, and the token will use the received information to re-create the same key pair is created during the registration phase.

If the information was sent from a legitimate server, it should result in the same public key since the secret inside the device didn’t change. The device will then encrypt the challenge sent by the server with the private key and send it back to the server.

However, because the domain is hashed together with the device secret, if you’re on a phishing website, the token will generate a different key, and the checksum will fail.

The challenge can only be decrypted by the public key created with that same private key, which the server already should have stored from the previous phase. The server will try to decrypt it using the public key it already has, and if the challenge matches with the one the server sent, the user is authenticated.

## What Makes Hardware 2FA Better than Software 2FA?

Hardware 2FA brings several security benefits over software 2FA. The most obvious one is phishing resistance. By using the website domain in the key generation process, the token assumes what normally would be a user responsibility — that of verifying that the website they are logging in to is legitimate.

It’s also more leak-resistant than software 2FA. We’ve seen that software 2FA works on the basis of a shared secret between user and server ahead of time, from which the passcode is derived. But if the shared secret is leaked from the server, anyone can use it to generate the correct passcodes.

If the user has secured their account with U2F, however, and the public keys and key handle on the server get leaked, the attacker still won’t be able to take over the account because he’d still need the private key to sign the payload and authenticate themselves.

Not only that, a U2F token can’t be exploited remotely by automated bots. Most keys require a physical touch on the device to sign the payload, so they aren’t vulnerable to the [brute-force attacks that can occur in improperly implemented TOTP systems](https://www.miknet.net/security/the-trouble-with-totp/) (e.g., not taking into consideration user behavior, geolocation, number of bad attempts before locking down the account for a determined amount of time).

In a scenario where the attacker has acquired a list of compromised passwords, brute-forcing any individual account by going over all possible 1,000,000 passcode possibilities is increasingly trivial with a big enough list:

![04_what_makes_hardware_2fa](https://images.ctfassets.net/23aumh6u8s0i/6ovPCcvrlpLnrKCviq4Ukw/8ed6038cb3408a799f5fa6cb54f1ac04/04_what_makes_hardware_2fa.jpg)
<p align="center">Source: <a href="https://www.miknet.net/security/the-trouble-with-totp/">The trouble with TOTP</a>.</p>
<br />
An automated attack like that can’t happen on U2F-enabled accounts. Also, all cryptographic operations happen inside the token. By the time the private key leaves the token, it already has been hashed using SHA-256, so even if the user doesn’t know that the client is compromised, it’s still safe to use the token.

In terms of usability, in an [internal study at Google](https://research.google/pubs/pub45409/), they found that U2F allowed employees to authenticate as much as four times as fast as using an authenticator app.

And as with software 2FA, users can assign multiple tokens as backups in case they lose one — the only problem here is that each key additional key will cost money (presuming the user already had multiple devices in where to store the TOTP seeds), and considering the already low 2FA adoption rates, it’s something to be considered carefully.

In some cases, though, there might be a decrease in costs by mandating hardware tokens.

It’s what the study above found: initially, Google tested the YubiKey internally with 50,000 employees, and they found that not only internal accounts protected with YubiKey were much more likely to be secure, they also saw a 92% reduction in support incidents.

In the end, this allowed Google to _save money_ in support hours and costs related to compromised accounts by issuing multiple backups per employee.

In fact, requiring backups may also be one of the downsides of hardware 2FA: having no backups can be _extremely problematic_ if you lose your token. You’ll be at the mercy of the admins to let you in again — and in some cases, like in that of password managers where your vault is end-to-end encrypted, not even they can help you recover your account.

## Driving Up The Adoption Of U2F

The biggest problem with U2F right now is adoption — it’s low even among users who use any 2FA (according to [this 2018 report](https://www.theregister.com/2018/01/17/no_one_uses_two_factor_authentication), less than 10% of Gmail users enabled any kind of 2FA), and 2FA adoption overall is already low. In this case, it’s a two-sided adoption problem:

1. Users need to buy a hardware token to use U2F.
2. Applications need to implement the protocol to allow users to use them in the first place.

And as you can see [here](https://2fa.directory), U2F is not nearly as well-supported as SMS and software 2FA. Surprisingly, even applications you would expect to support U2F still don’t, such as some of the password managers.

If you want to incentivize your users to use U2F, Auth0 now supports WebAuthn with FIDO (U2F) security keys, so you can easily offer it as an option for your users. For more information, visit [Auth0 Docs](https://auth0.com/docs/mfa/configure-webauthn-security-keys-for-mfa).

The Working Principles of 2FA (2-Factor Authentication) Hardware

With modern computers capable of testing millions of password combinations per second, securing your online accounts with only a password may not be sufficient anymore.

The Working Principles of 2FA (2-Factor Authentication) Software

Nabeel-Saeed

Nabeel is a product marketer focused on all things security and identity. He has contributed to publications like Wirecutter, Information Age, and Professional Security. He has also been a guest speaker at the Bay Area Cybersecurity Meetup, and delivered talks on IAM across the US, Canada, Israel, and Singapore. He is passionate about helping build secure auth experiences that amaze users and delight businesses.

Product Marketing

Nabeel Saeed

Common cognitive biases may be impacting your MFA adoption rates; here are some ways to counter those impacts.

Multi-factor Authentication (MFA) has been shown capable of blocking up to [99.9% of brute force attacks](https://www.zdnet.com/article/microsoft-using-multi-factor-authentication-blocks-99-9-of-account-hacks/). Yet a recent IBM/Ponemon Institute study found that only [36% of responding organizations require it](https://www.ibm.com/security/data-breach). And adoption numbers for the general public aren’t encouraging either, with a report from LastPass finding that only [37% of respondents](https://www.lastpass.com/resources/psychology-of-passwords-2020) use MFA for their work accounts. When you add the finding by Verizon that [80% of data breaches](https://enterprise.verizon.com/resources/reports/dbir/) involves the use of stolen credentials, these numbers beg the question, why?

If MFA has been proven so effective as a defense against data theft and brute force attacks, why are adoption numbers still so low? A common set of issues revolve around what are called cognitive biases. We’re going to look at some of the most common cognitive biases, why they’re so effective at keeping adoption of new security measures down, and how you can turn the tables and work with these same psychological ideas to counter their impact and potentially increase MFA adoption. 

![Cognitive Bias Overview](https://images.ctfassets.net/23aumh6u8s0i/3X31s04spm3rcZHMbsjkli/3d974e2b7075f5c5ffc3cf4c37fe4f89/adaptive-mfa-sep2)

## Cognitive Bias Overview

Before we dive in and look at the ins and outs of cognitive biases, it would be helpful to ensure we’re all on the same page about just what is meant by that phrase. A cognitive bias is a subjective reality that we all create for ourselves, most often based on available information and our own life experiences.

Cognitive biases are often the result of using [heuristics](https://www.behavioraleconomics.com/resources/mini-encyclopedia-of-be/heuristic/), a type of mental shortcut or rule of thumb, to speed decision making amidst uncertainty. People walking through the steps of creating a new account, for example, will know, based on experience, if the process seems to contain too many, or too few, actions. If they don’t find what they expect, they may abandon the process in favor of one that feels like it has a better mix of ease-of-use and security.

With all of that in mind, we turn to a sampling of the cognitive biases that may be impacting the adoption of security features like MFA. We will also address how each cognitive bias has a flip side or a way to approach it that can flip its effect from detrimental to beneficial for your adoption rates. A quick note: more information on each bias/heuristic discussed here can be found on [Decision Lab’s list of cognitive biases](https://thedecisionlab.com/biases/).

## 1. Optimism Bias

**What it is &mdash;** People tend to overestimate the chances of positive events while simultaneously underestimating the chances of negative ones. This has the result of giving us a feeling of control over situations where, in fact, we may have little to no control. 

**How it can impact adoption &mdash;** The basic argument looks like this: “data theft happens to other people; it will never happen to me.” Therefore, people who feel this way don’t see the point in adopting additional security measures such as MFA, especially if doing so feels at all invasive or time-consuming. This feeling was verified in a recent report from cybersecurity company Balbix which found that [99% of enterprise users](https://www.balbix.com/resources/state-of-password-use-report-2020/) reuse their passwords, either across work accounts or between corporate and private logins. 

**How to work with it &mdash;** The underlying shortcut being used here says that since something has never happened before, it won’t happen now. Remember that you’re asking people to take steps to protect themselves and your organization. You can use their optimism in your favor by offering an incentive for adoption. For example, the online game Fortnite offered a [free victory dance emote](https://www.epicgames.com/fortnite/en-US/news/2fa) for everyone who opted into their new MFA feature. Other companies like Google are deciding to [require users to enable MFA](https://www.cyberscoop.com/google-multifactor-authentication-2sv-default/). For most companies, this strong-arm tactic may not be the best route to take for customer satisfaction, especially when you can work with these psychological ideas to achieve the same goal while maintaining a great CX.

## 2. Fundamental Attribution Error

**What it is &mdash;** The habit of attributing dispositional factors, rather than situational ones, for other people’s behavior. For example, when someone cuts you off in traffic, our instinct is to assume they’re just a bad person, instead of taking into account the possibility of their being late for an interview or on the way to the hospital because a loved one was injured.

**How it can impact adoption &mdash;** People will think, “I don’t need the extra security because I’m not like those other people who don’t know how to create good passwords.” This thinking combines the fundamental attribution error with its opposite, the actor-observer bias, which states that we overemphasize situational factors to our own behavior over dispositional ones. 

**How to work with it &mdash;** Use the actor-observer effect to your advantage by showing customers how quick and easy it is to set up and use MFA. This eliminates the primary situational excuse of “I’m too busy.” Adaptive MFA allows you to only confront your customer with additional verification steps when the situation calls for it. At the same time, variable options for that authorization keep the additional step as low-friction as possible. For example, using the biometric features of the visitor’s smartphone is an extremely secure and low-friction second verification method that users already trust.

## 3. Status Quo Bias (Psychological Inertia Effect)

**What it is &mdash;** A basic preference for the current state of affairs. Psychological inertia further describes our reluctance to make changes to the systems we see as working just fine, despite the appearance of disconfirming evidence. 

**How it impacts adoption &mdash;** Thinking that “how I do it has worked for years, why should I change now?” can lead to things like reused passwords and a general lack of willingness to adopt new processes despite the mounting evidence that factors like MFA are key to slowing down or stopping data theft.

**How to work with it &mdash;** The need to maintain control is often at the root of status quo bias. That means that a gentle reframing of the ask (enable this new feature) may be called for. Wording like “keep control of your account with MFA” can be enough to sway users who are on the fence. Point out that with adaptive MFA, the user won’t even see the additional step on every login, only in situations where a special circumstance is detected. Circumstances like impossible travel, where a login attempt makes it look like the user has traveled farther than possible in the time since their last login, for example. 

## 4. The Framing Effect

**What it is &mdash;** Choices can be presented in ways that highlight positive and/or negative aspects of the decision being made. The context in which the options are presented can make the difference in how the decision-maker feels and which option they ultimately choose.

**How it can impact adoption &mdash;** If MFA looks like an extra step in what is already viewed as an overly complicated process that you’re imposing on your audience, they’re less likely to be willing to adopt it.

**How to work with it &mdash;** Most of us frame our decision-making based on availability and affect (how we feel in the moment). If you can slow down the process just enough for people to realize the importance of the decision, they’re more likely to take more aspects into consideration and will therefore be more willing to take the extra moment or two to set up added security for the peace of mind it will give them down the road. Reframing the decision as being about maintaining control over your personal information by removing mention of the organization or data breaches overall can also help here. Another step you can take is to leverage Auth0 features like Breached Password Protection (BPP). With this enabled, users will be notified should their credentials be found in a data leak; you can use that to encourage adoption of MFA to block a possible attack on their information. Now they know you’re watching out for them, making them more receptive to doing their part by enabling MFA protection.

## 5. Dunning-Kruger Effect

**What it is &mdash;** This bias states that people with limited knowledge of a topic tend to overestimate their ability in that area. This effect is often misinterpreted as saying something about the intelligence of people in general, which is unfortunate because that means it’s often used incorrectly. In our scenario, this effect will most often look like someone saying, “my password is uncrackable,” or “I’m smarter than some criminal.”

**How it impacts adoption &mdash;** Once someone is overconfident in their ability to maintain security over their information, they are not likely to think they need what they now view as unnecessary added steps. The thinking is that since they’re so much smarter than criminals and have created an uncrackable password, why should they bother setting up additional protection?

**How to work with it &mdash;** Slow down and make MFA the default.[ David Dunning](https://www.vox.com/science-and-health/2019/1/31/18200497/dunning-kruger-effect-explained-trump), one of the psychologists credited with the effect’s discovery, has this to say, “The first rule of the Dunning-Kruger club is you don’t know you’re a member of the Dunning-Kruger club.” In essence, we all suffer from this bias at some point and likely have no idea that it’s happening. The way to combat this is to add just enough friction to the account creation process that people take the time to realize the importance of MFA. Add to that making MFA an opt-out feature, rather than opt-in, so it becomes faster and easier to leave the default setting and enable it.

![Cognitive Biases Need To Be Accounted For](https://images.ctfassets.net/23aumh6u8s0i/40V8USPBHCJ0K9SxZHISMw/b7488bb599ce8d9f83a3aeea0e4334fa/adaptive-mfa-sep1)

## Cognitive Biases Need To Be Accounted For

Keeping in mind the possible cognitive biases at play allows you to design customer experiences (CX) that encourage your audience to make safer decisions. Paying special attention to your CX, along with the content and specific wording used, can go a long way toward increasing customer adoption of MFA.  By using framing to encourage adoption, remembering to keep things positive, and showing how MFA use enables the user to maintain control over their own personal information — you’re setting yourself up for better adoption rates.

Auth0 provides the flexibility to A/B test different CX designs and content so you can find the right way to frame the decision for your audience. And the scalability we offer means that as more users opt-in, the infrastructure will be there to support your growing user base. Adaptive MFA will also play a large role in the success of your MFA adoption efforts. With features like Bot Detection, impossible travel, and IP reputation scoring, your users will only be presented with the MFA window when the situation warrants it. When you’re ready to learn more about how Auth0 can help you create a CX environment that fosters better MFA adoption, start with our [MFA Guide blog post](https://auth0.com/blog/multifactor-authentication-mfa/), then[ reach out to our experts](https://auth0.com/contact-us) to start the conversation. 

<include src="asides/AboutAuth0" />

How to Use Psychology to Increase MFA Adoption

Announcing support for WebAuthn with FIDO Security Keys for Multi-Factor Authentication in Auth0



Companies of all sizes are under attack, targeted by numerous phishing attacks that are coming at an ever-increasing rate. Even if the tech industry continues to improve how organizations identify and defend against those attacks, the problem is bigger than ever. According to ProofPoint's [2020 State of The Phish Annual Report](https://www.proofpoint.com/sites/default/files/gtd-pfpt-uk-tr-state-of-the-phish-2020-a4_final.pdf), 88% of organizations faced a targeted phishing attack in 2019, and 65% of US organizations experienced a **successful** phishing attack.

There are options for decreasing the chances of successful phishing attacks targeting your company. Things like employee training and security policies, such as using password managers and enforcing multi-factor authentication (MFA), are all steps in the right direction. 

However, if you want to neutralize the threat completely, you need to enable authentication methods that cannot be phished. That's [what Google did](https://krebsonsecurity.com/2018/07/google-security-keys-neutralized-employee-phishing) in 2017 to neutralize phishing of its employees. Google now requires all employees to use U2F Security Keys to authenticate to corporate websites. 

U2F evolved into the WebAuthn specification, which is now supported by the latest versions of browsers and operating systems. Auth0 is now supporting WebAuthn with FIDO security keys for multi-factor authentication. You can start protecting your users with Auth0 today, using the same technology as Google.

## About WebAuthn

The Web Authentication API (also known as WebAuthn) is a [specification](https://www.w3.org/TR/webauthn/) written by the World Wide Web Consortium (W3C) and The Fast IDentity Online Alliance, known as FIDO, with the participation of Google, Mozilla, Microsoft, Yubico, and others. The API allows servers to register and authenticate users with public-key cryptography instead of a password.

When it comes to security, many people think you have to sacrifice security in the name of user experience, and vice versa. However, the key to maximizing both variables is to reduce the number of times we prompt the user for authentication and to allow the user to authenticate with secure factors that provide low friction. WebAuthn promises to be the holy-grail of authentication factors, as it accomplishes exactly that by combining maximum security with a low-friction user experience.

WebAuthn allows users to authenticate using one of two options:

* **Roaming authenticators** — These are removable and cross-platform devices, like a [Yubikey](https://www.yubico.com/products/) that can be used on multiple devices. To authenticate with a roaming authenticator, you simply connect it to the device (through USB, NFC, or Bluetooth), provide proof of presence (e.g., touching it), and optionally an additional authentication factor like a PIN or fingerprint recognition.

* **Platform authenticators** — This option includes the MacBook's TouchBar, Windows Hello, iOS Touch/FaceId, and Android's fingerprint/face recognition. Integrated into the device being used, these only work on that device.

When doing multi-factor authentication, we want to challenge the user with something they know (like a password), something they have (like a security key), and something they are (e.g., their fingerprint).

Note that a Roaming Authenticator + PIN **combines two factors in one** (you have the key, and you know the pin), and a Platform Authenticator also does (you have the device, you are the person with that fingerprint/face, or you know the passcode).

In recent months the WebAuthn API has been implemented in major browsers and operating systems, enabling support for both options.

<include src="WebAuthnMeCTA" group="A"/>

## The Case for Security Keys

Using a Security Key allows you to authenticate users with the strongest possible authentication factor. This helps you to solve several problems at once by:

* Protecting sensitive data and employee accounts
* Providing secure access from outside the corporate network
* Allowing your employees to authenticate to shared computers
* Enabling MFA in scenarios where users cannot carry their mobile phone

It also offers several advantages when compared with using a smartphone only authenticator for MFA:

* Protects against phishing and man-in-the-middle attacks
* Strengthens user privacy as it doesn't require a personal device
* Provides one-touch login without having to take your mobile phone to complete an authentication challenge
* Has no battery or signal dependency
* Has no moving parts, so it's practically indestructible
* Allows users to register multiple keys, minimizing business disruption and the chances of account lockout

## WebAuthn With Security Keys for Multi-Factor Authentication

Auth0 with WebAuthn support for Security Keys is available starting today. You can enable the factor in the WebAuthn with Security Keys MFA configuration section of the admin dashboard:

![Multi-Factor Authentication 1](https://images.ctfassets.net/23aumh6u8s0i/5LAUWUPRO5gvYQ9t56rNPa/f9c2d823965b8070c22e6ab3151d2665/01-factors-updated)

After it is enabled, users will go through the enrollment flow below. At some point, their browser will show a native dialog to ask users to engage the security key. In the example below, we show the Android dialog:

![Multi-Factor Authentication 2](https://images.ctfassets.net/23aumh6u8s0i/4l0n2zVBk0Byf8P2MfWvaf/51a1b3ebb7248719a7cc17b32a4765a4/02-welcome)

The next time they login, the flow will look like this:

![Multi-Factor Authentication 3](https://images.ctfassets.net/23aumh6u8s0i/5f9tqz1pR3RgrkFZSOcp2F/41df6128ee37f040c0389dbd7db9dda8/03-waiting-for-your)

## Stay Tuned!

In addition to supporting WebAuthn with roaming authenticators, we are currently working on a unique approach that will greatly improve the usability and adoption of WebAuthn platform authenticators. Check out Vittorio Bertocci's session "[Democratizing WebAuthn for Developers and End Users](https://authenticatecon.com/session/democratizing-webauthn-for-developers-and-end-users/)" from FIDO's Authenticate conference for the scoop!

WebAuthn is an exciting technology, and Auth0 is committed to providing the best possible implementation, maximizing security without sacrificing user experience. Check out our new [WebAuthn](https://auth0.com/docs/mfa/configure-webauthn-security-keys-for-mfa) offering and let us know what you think on our [Feedback page](https://auth0.com/feedback) or in the [Auth0 Community](https://community.auth0.com).

<include src="asides/AboutAuth0" />


FIDO Security Key Support Comes To Auth0

andrew-akers

I'm a product marketing manager who loves learning about technology, information security, and identity. My goal is to turn that knowledge into positive outcomes for our customers. Before Auth0, I was a product marketing manager at Cisco in the network security division. In my spare time, you can find me spending time with my family, reading, writing, and working on endless home improvement projects.

Product Marketing Manager

Andrew Akers

Learn how to use step-up authentication to strike a balance between security and friction.



Ideally, your new service or app is easy to use and access, and customers—who you want using your product as quickly as possible — can start using it with minimal friction. 

Your core value proposition is just on the other side of a login screen, and making that entrance even marginally more difficult can risk sending those potential customers elsewhere. 

Step-up authentication is a way to strike a balance between security and friction. It ensures users can access some resources with one set of credentials but will prompt them for more credentials when they request access to sensitive resources. 

We'll go over three emblematic use cases for step-up authentication:

1. Users want seamless access to certain resources, but organizations want to verify their identities before they access anything more sensitive.
2. Employees need access to data to complete everyday work, but occasionally need access to private data that would cause damage if exposed. 
3. You have or want to deploy a membership model that limits complete access to your site or service to paying users.

Step-up authentication enables you to provide easy access to one layer of resources and secure access to another layer of resources. This makes authentication work for you and your users and unlocks new ways to run your business.

<include src="TweetQuote" quoteText="Learn about the different use cases for which step-up authentication is essential to deliver a secure and frictionless user experience."/>

## What Is Step-Up Authentication?

The goal of step-up authentication is to adapt identity requests to the importance of the resource and the risk level if it were to be exposed. Asking for too little gives your users (or whoever might be posing as them) a dangerous amount of freedom, whereas asking too much, especially up front, creates obtrusive friction.

You can't assume every user that offers a matching username and password is actually who they claim to be. Identity theft is a growing problem —[_for people and the businesses they use_](https://auth0.com/blog/business-identity-theft-is-on-the-rise/). Identity thieves can send phishing emails to steal credentials from unsuspecting users or pose as authority figures and request credentials or access. If users repeat passwords across services, a separate breach might leave their credentials—and your resources — exposed and up for sale for the _[low price of $50](https://securelist.com/hey-there-how-much-are-you-worth/88691/)_.

The fear this threat inspires causes some businesses to barrage users with security steps, but the best security is simple. Simple security keeps users happy and businesses safe. This is hard to implement on your own, but it’s easy when you have _[identity as a service](https://auth0.com/blog/identity-as-a-service-in-2018/)_. 

The risk with step-up authentication is in the implementation. Target made itself vulnerable in 2013 by giving too many people [_access to data_](https://auth0.com/blog/4-security-measures-after-data-breach/) that they didn’t need. Though most employees couldn’t access sensitive data without two-factor authentication, Target let some vendors maintain access to their networks without it. Once the hackers controlled vendor credentials, they could then access Target’s point-of-sale system, eventually [_stealing 40 million credit cards_](https://www.sans.org/reading-room/whitepapers/casestudies/case-study-critical-controls-prevented-target-breach-35412). 

Effective step-up authentication requires careful planning about who has access and who you ask to step up.

![A Shield protecting important data](https://images.ctfassets.net/23aumh6u8s0i/3paapE2hcTo1eyT78RXxFM/752dc01ee7dff5988c5f7b93e9d3e120/2fa_security_header)

## Step-Up Authentication vs. Multi-Factor Authentication vs. Adaptive Authentication

Step-up authentication is frequently in the same conversation as multi-factor authentication (MFA) and adaptive authentication, but there are important differences. 

Step-up authentication and adaptive authentication are authentication systems, whereas MFA is a term that covers authentication factors both systems use.

MFA refers to authentication methods that go beyond username and password, _[such as biometrics](https://auth0.com/blog/3-critical-trends-in-biomeric-authentication-in-2019/)_, physical cards, and [emailed links](https://auth0.com/docs/multifactor-authentication/api/email). You might require all users to submit multiple factors of authentication, or only some if you’re using adaptive or step-up authentication. 

[Adaptive authentication](https://auth0.com/docs/mfa/adaptive-mfa), also known as risk-based authentication, is similar to step-up authentication but is dynamic instead of static. Adaptive authentication systems automatically trigger additional authentication factors, usually via MFA factors, depending on a user's risk profile. A risk profile is determined by assessing:

* IP reputation: Is someone attempting to login from an IP address associated with previous dubious requests?
* Impossible travel: Frequency of requests from different geo-locations
* Known device: Whether the device is recognized or not

Risk profiles can also be informed by user role, resource sensitivity, and other variables. Adaptive authentication systems then prompt credentials that should be appropriate to the risk level of a request and its source.

With Auth0's [Adaptive MFA](https://auth0.com/blog/auth0-introduces-adaptive-mfa/), users are prompted for a secondary factor only when the primary factor login appears unusual or suspicious based on the three risk dimensions mentioned above — in other words when the login appears high-risk. For instance, a login request from a new device or an unfamiliar geo-location suggests that the login attempt may be fraudulent and that the user should be asked to authenticate with a second factor.

Step-up authentication is generally static and is based on predefined risk levels of resources and users. It focuses on the sensitivity and value of different resources, limiting them to users who can provide credentials that prove their claims for access.

## When Should You Use Step-Up Authentication?

Any resource or data exposure can create a vulnerability, so effective use of step-up authentication requires care. It's generally best to keep all resources as secure as possible, but there are a few cases where it's useful to give many users some access, and some users more access. 

### Users need access to high-risk resources

In many cases, users don’t always need access to high-risk resources, but when they do, step-up authentication can make sure they are who they say they are. 

For instance, mobile apps for banks often allow customers to make small changes and access limited information with only minor authentication. If customers want to check their balances or scan and deposit checks, the risk level is relatively low and the bank can let them proceed with only usernames and passwords. 

If customers check their balances and decide to move funds around, the bank can then prompt them for more credentials if the moved money exceeds a certain amount. A one-time code, sent to a phone number or email address, can verify the identity behind the request. 

![Web app login modal - enter phone number to send verification code for logging in](https://images.ctfassets.net/23aumh6u8s0i/3NSrVTFIW3N3NrfnSwcuKF/d804d7800bc5dabfc0b469582233f6e6/passwordless-sms-enter-phone-web)

![Image of text message with verification code to complete web app login](https://images.ctfassets.net/23aumh6u8s0i/da3GovAMfxRryWMG61OzN/421cba3cbbe589690aa6592d985fffa8/sms-verification-code-small)

While a security measure like that might annoy customers if they just want to see if their paycheck came through that week, they’ll likely be more patient authenticating an action known to be riskier. 

Organizations often encounter similar use cases for their employees. For example, if your company has a GitHub Enterprise Server instance, you might want to enable your employees to easily review code and create new branches but limit them from committing code or changing repository settings. 

This way, organizations can control who has the authority to commit code to production, which protects them from employee mistakes and bad actors posing as employees. 

### Users want to interact with sensitive data

With step-up authentication, employees can access the data they need every day without automatically getting access to sensitive resources. Once they do need access, step-up authentication can verify them as necessary. 

For instance, a company’s intranet service might enable streamlined access to limited subsets of customer information. That same service might also connect to more sensitive resources, such as salary data about fellow employees or private payment information from customers. 

Below, you can see how Auth0 would prompt step-up authentication as users from Fabrikam, a fictional corporation, access the Intranet. 

![Illustration of architectural flow of set-up authentication with Auth0](https://images.ctfassets.net/23aumh6u8s0i/6J4Bcs9nXFHLU0SFI9pAgM/f0cbae4aba7184c198029428f51c1e83/step-up-flow)

Even if a phishing campaign or data breach gave identity thieves your employee’s credentials, step-up authentication would block them from accessing sensitive data. 

### Businesses want to Privilege access for paying users

If you keep up with the news online, you’ve likely encountered a step-up authentication prompt. Major publishers like *The New York Times *and *The Washington Post* allow anyone to read articles from their sites—up to a certain point. 

After reading a number of articles set by the site, a pop-up prompts you to log in to or create a paying account.

![Image of NYTimes prompt to log in/create account to access paid, gated content](https://images.ctfassets.net/23aumh6u8s0i/1cLEEObzFbawY3weAgl0tO/0a050b36b4b5c58a6740494838276784/prompt-to-log-in-or-create-paid-account-2)

In this use case, step-up authentication encourages distribution and incentivizes new readers to pay for further access. When an article goes viral on Twitter, it can attract new readers who might enjoy the article and convince more experienced readers to pay so they can stay informed.

<include src="TweetQuote" quoteText="What is step-up authentication and when should you use it? Find out in this blog post."/>

## How to Implement Step-Up Authentication

Identity management looks simple, but the [_consequences of getting it wrong are dire_](https://auth0.com/blog/what-is-a-data-breach/). Data breaches can damage businesses, hurt reputations, and expose the private information of the very users you’re trying to serve. 

Outsourcing identity enables you to keep working on your core service and [_implement authentication protocols and systems as necessary_](https://auth0.com/learn/build-or-buy-20-identity-management-questions/). 

Auth0 makes it easy to add step-up authentication with [_extensible MFA support_](https://auth0.com/docs/multifactor-authentication/step-up-authentication). With Auth0, your app or site can verify whether a user has already logged in via your selected MFA factors, and prompt a credential request if they haven't. 

![Auth0 Dashboard showing available factors when setting up multi-factor MFA](https://images.ctfassets.net/23aumh6u8s0i/7bJg0kmGGU8S3cjK9S1R3F/2256a9c6fae756f9b29adeededce305d/auth0-mfa-factors)

By setting policies with [_Auth0 rules_](https://auth0.com/docs/multifactor-authentication/custom), you can customize which MFA factors are necessary for different contexts and for different users. You can do this with application programming interfaces (APIs) or web apps. 

If a user wants to transfer money with a bank’s app, for instance, and the app includes Auth0 step-up authentication, the app will send an access token that includes different permissions, such as the ability to view account balance or transfer funds. If the request doesn’t have the second parameter, the API [_redirects the user to Auth0_](https://auth0.com/docs/multifactor-authentication/step-up-authentication/step-up-for-apis), which prompts the user to enter more credentials. Once the user verifies their identity via MFA, the token will receive that parameter and the user will have access. 

If you’re [_designing a web app_](https://auth0.com/docs/multifactor-authentication/step-up-authentication/step-up-for-web-apps), you can configure it so that when users go from one view to another, the web app prompts MFA. When users log in, a JSON web token will indicate their allowed access levels. If the MFA parameter isn’t present, Auth0 can redirect users and prompt them to input more authentication factors. It can be as simple as third-party authenticator like DUO, email, SMS, or with [_Guardian_](https://auth0.com/multifactor-authentication) — push notifications. 

## Step up Security with Step-Up Authentication

Authentication doesn't have to feel like a barrier — you can adapt it, without sacrificing security, to the needs of usability. 

Separating users with step-up authentication gives customers and employees the ability to complete minor tasks easily and access more important data smoothly. If you want to implement a membership or subscription model, step-up authentication can provide access privileges exclusively to paying users. 

With an outsourced identity provider like Auth0, implementing advanced authentication methods like step-up authentication and MFA is simple. Auth0’s extensible tools give you the freedom to make authentication work for you and your users. 

<include src="asides/AboutAuth0" />


What Is Step-Up Authentication, and When Should You Use It?

df6c864847fba9687d962cb80b482764?size=200 avatar

df6c864847fba9687d962cb80b482764?size=200

Martin Gontovnikas, a.k.a Gonto, is a software engineer at heart who moved to the ‘dark side’ and became VP of Marketing at Auth0. He considers himself lucky to have found a way to combine his two passions and apply his engineering thinking model to marketing.<br/><br/> Gonto’s analytical thinking is a huge driver of his data-driven approach to marketing strategy and experimental design. He is based in the Bay area, and in his spare time, can be found eating gourmet food at the best new restaurants, visiting every local brewery he can find, or traveling the globe in search of new experiences.

Former SVP of Marketing and Growth at Auth0

Martin Gontovnikas

Retailers are embracing eCommerce but are vulnerable to fraudsters impersonating real users.



Holiday shopping looks a lot different this year. As a result of the pandemic, shoppers are avoiding brick-and-mortar stores and ordering online, with [eCommerce sales up 37%](https://www.digitalcommerce360.com/article/quarterly-online-sales/) over 2019. Unfortunately, the eCommerce boom has created a similar spike in eCommerce fraud. [One study found](https://www.digitalcommerce360.com/2020/07/27/the-cost-of-fraud-is-up-7-for-us-merchants/) that in 2020, mid-sized to large merchants experienced 14% more fraudulent transactions per month than the year before.

These dueling forces put retailers in a difficult position: they need to provide eCommerce options to customers without exposing themselves to attack. Retailers can balance these needs by putting strong fraud-prevention tools in place to maximize their eCommerce trade while locking out fraudsters.

## Bot-Based Fraud Is Rampant in Ecommerce 

Retailers trying to guard against cybersecurity threats must first understand what those threats are. This list is constantly evolving, and in 2020, while there are several types of attacks, most of them use armies of automated bots.

In a [2020 survey](https://kount.com/wp-content/uploads/2020/10/Bot-Landscape-and-Impact-Report-2020-Kount.pdf) from cybersecurity company Kount, 81% of businesses reported that they dealt with malicious bots often or very often, and 25% reported that a malicious bot attack cost their organization over $500,000.

Bot attacks on retailers can take multiple forms. In one variation, armies of bots buy up all the inventory for in-demand items for later resale at a markup. For years, that’s been a popular trick for coveted concert tickets and sneakers, but it’s equally effective for hot-ticket gift items. The risk for retailers is that customers will come to your site looking for a product, and when you don’t have it, they’ll switch to your competitors.

Many bot attacks use identity as their vector, meaning they break in through the login box by impersonating legitimate users. [In credential stuffing](https://auth0.com/blog/what-is-credential-stuffing/) attacks, hackers take user login credentials that were stolen in one data breach and use them to break into other sites. Credential stuffing attacks have become much more widespread in recent years because people tend to reuse passwords, and [billions](https://www.wired.com/story/collection-leak-usernames-passwords-billions/) of these stolen credentials are currently circulating on the dark web.

Ecommerce retailers are at particular risk of these attacks, especially with the booming popularity of “buy online, pick up in store” (BOPIS). In the past, fraudsters had to get stolen merchandise mailed to them, increasing the likelihood that the transaction would be stopped or they would be caught. But with curbside delivery, they can order goods and pick them up before anyone catches on.

Even if bot attacks aren’t successful in conducting fraudulent transactions, they can still crash your website by flooding it with requests. [Auth0’s research](https://auth0.com/blog/auth0-reveals-50000-credential-stuffing-attempts/) has found that in a credential stuffing attack, a site’s traffic can spike by as much as 180-fold.

![Critical Tools in the Fight Against Ecommerce Fraud](https://images.ctfassets.net/23aumh6u8s0i/5CBZ47YCilUVHG1F0gf9om/a5893de32934cc5d60a561a9282d2217/prevent-ecommerce-fraud-separator)

## Critical Tools in the Fight Against Ecommerce Fraud

Fortunately for retailers, there are effective methods to deter bots without creating unnecessary obstacles for legitimate users. Since most eCommerce fraud takes the form of [broken authentication attacks](https://auth0.com/blog/what-is-broken-authentication/) &mdash; meaning that fraudsters impersonate legitimate users&mdash;the fixes all relate to being able to more accurately verify user identities.

### MFA

[Multi-factor authentication (MFA)](https://auth0.com/docs/mfa) demands that users prove they are who they claim to be by providing an additional form of verification beyond the classic username-password combination. Common MFA methods include one-time codes sent to a user’s email address and [biometric scans](https://auth0.com/blog/3-critical-trends-in-biometric-authentication-in-2019/), such as fingerprints. While MFA is the single most reliable defense against identity-/authentication-based attacks, it is not a silver bullet. If retailers want to defend against automated attacks, they have to think about security in layers. 

In 2019, [NIST started recommending](https://auth0.com/blog/why-nist-recommends-mfa-to-fight-ecommerce-fraud/) that retailers implement MFA to fight eCommerce fraud, but adoption has still been slow. That’s partly because retailers worry that MFA will introduce too much friction and will make customers abandon their carts. [But MFA standards are constantly evolving to be more seamless and secure](https://auth0.com/blog/auth0-introduces-adaptive-mfa). For instance, [Microsoft recently told](https://www.zdnet.com/article/microsoft-urges-users-to-stop-using-phone-based-multi-factor-authentication/) its customers not to use SMS as an MFA delivery mechanism because cell phone lines are vulnerable to multiple forms of attack. (They recommend [hardware keys as the least susceptible to attack](https://auth0.com/blog/fido-security-key-support-comes-to-auth0/).)

### Attack Protection

You want to find out about eCommerce fraud before you get a call from a customer’s bank asking you to reverse fraudulent charges. To stop these transactions from ever taking place, you need tools that automatically flag suspicious behavior.

**Brute force protection** is one such tool, which prevents bot armies from overwhelming your site or app with login attempts. Enabling brute force protection locks out IP addresses after a certain number of failed login attempts.

[CAPTCHA](https://auth0.com/blog/captcha-can-ruin-your-ux-here-s-how-to-use-it-right/) (and its assortment of bot-catching descendants) helps to lock out bots at the account creation stage by having human users prove “I’m not a robot” and, occasionally, tricking bots into proving that they are.

**Breached password protection** protects against credential stuffing attacks by monitoring databases of compromised credentials and alerting users if they need to change their passwords.

It’s important to note that none of these technologies are foolproof, and none are designed to work in isolation. Some hackers have learned how to spoof fake IP addresses to mask brute force attacks. CAPTCHA always struggles to stay ahead of sophisticated bots that can mimic human behavior. And while retailers can force users to change their passwords in the event of a breach, they can’t change the underlying problem of password reuse. Even MFA, the bedrock of a sensible security strategy, works only if you convince or compel your customers to sign up for it.

But even though there’s no single silver bullet to prevent eCommerce fraud, implementing these features together offers superior protection. Scammers generally seek out the path of least resistance, and when you have all these tools, you don’t present your business as a soft target. 

![Prevent Fraud by Updating Customer Access Controls](https://images.ctfassets.net/23aumh6u8s0i/1MzswDFUmttHgwNE85rxY2/cc3066d34b3cc682703051845d44b7fc/prevent-ecommerce-fraud-separator-2)

## Prevent Fraud by Updating Customer Access Controls

We’ve talked about the threats to eCommerce retailers and the tools to protect against them, so the question now is, how do you go about putting those tools in place? For many retailers, the solution is to partner with a third-party [customer identity and access management (CIAM)](https://auth0.com/blog/what-is-ciam/) provider. That’s because building fraud-preventing tools in-house is time-consuming for any business, and it’s out of reach for most small to medium-sized retailers. But sticking with the simple login solution you’ve had in place for years is clearly no longer an option.

But as we’ve discussed, all fraud-prevention tools are not created equally. Here’s what retailers should look for when analyzing potential CIAM partners.

### Customizable MFA

There’s no reason to challenge every loyal customer to prove their identity every time they make a purchase, so retailers need [step-up or adaptive MFA](https://auth0.com/blog/what-is-step-up-authentication-when-to-use-it/), which requests additional credentials only in the event of suspicious or high-risk behavior. For example, you may want to verify a customer’s identity if they log in with a new device or place an order above a certain dollar amount.

![Adaptive MFA](https://images.ctfassets.net/23aumh6u8s0i/1NOHOVPjLZsNsuklb3Cw2e/c5ac893b034e2bf9df235deacb04966f/adaptive-mfa-graphic-1)

Auth0’s Adaptive MFA analyzes every login attempt and assesses its risk level. This assessment included a user’s IP reputation, whether the login is coming from a known device, or whether its geographic location indicates so-called “impossible travel.”, Based on these factors, it then determines whether the login can proceed uninterrupted, triggers MFA, or blocks the account altogether.

![Customizable MFA](https://images.ctfassets.net/23aumh6u8s0i/7CKjaRixRDYnypIFL2cTiA/85fd1e38bda162575c1fdd7016738526/use-adaptive-mfa)

### Comprehensive Attack Protection

Likewise, retailers need anomaly detection that lets them combine the strongest tools available to deter scammers. [Auth0’s Attack](https://auth0.com/docs/anomaly-detection) Protection offers an arsenal with which businesses can protect themselves. That includes Bot Detection, which forces suspicious logins to take a CAPTCHA test. Suspicious IP Throttling and Brute Force Protection block IP addresses from trying to break into user accounts. And Breached Password Protection notifies customers if a user’s credentials have been compromised in a known data breach.
Lets customers implement CAPTCHA and enable brute force protection, and notifies them about breached passwords.

![CAPTCHA](https://images.ctfassets.net/23aumh6u8s0i/7KwQQhPVnPr15lr3S73mdz/dc8846b93ba9384500c0bc155928ad84/attack-protection-04)
<p align="center"><i>Here’s a look at Auth0’s Attack Protection tools.</i></p>

### Developer-friendly documentation and support

Finally, in order to put safeguards in place as quickly and easily as possible, retailers should look for a CIAM solution that provides a high level of documentation and support. While many identity providers have similar suites of tools and services, the time it takes to implement them can vary widely depending on what kind of instructions they give to developers. Having clear documentation and customer support is particularly important to smaller businesses, who don’t have dedicated authentication professionals on their teams.

## An IAM Partner Can Get You Holiday-Ready

It’s been an indisputably challenging year, but retailers have risen to the occasion by embracing eCommerce solutions. And as 2020 comes to a close, it’s increasingly clear that eCommerce isn’t just a stopgap solution for the pandemic &mdash; it’s the new status quo. That means that updating security is a worthwhile investment for the entire coming year, not just the holiday rush. To learn more about how state-of-the-art identity can protect your customers and your business, [reach out to the team at Auth0](https://auth0.com/en/contact-us).

<include src="asides/AboutAuth0" />


How Retailers Can Prevent Ecommerce Fraud This Holiday Season

auziros:jeana-tahnk

Jeana has been in the tech industry for 15+ years, both as a communications professional and writer. As Director of Global Communications at Auth0, she works with her internal team and external agencies to amplify the company's visibility worldwide and establish its leadership in the identity industry. When she is not working, she can most likely be found on a field watching one of her three kids playing sports, or cleaning up after her one-year-old retriever who chews everything.

Senior Director, Global Communications

Jeana Tahnk

Advanced contextual-based feature only triggered by risky logins, mitigating hacking attacks, and reducing threat of data breaches while preserving user experience.



**BELLEVUE, Wash. – Dec. 15, 2020 –** The [Auth0](https://auth0.com/) Identity Platform, a product unit within Okta, today launched [Adaptive Multi-factor Authentication (MFA)](https://auth0.com/blog/auth0-introduces-adaptive-mfa), a sophisticated security feature that helps reduce the threat of hacks and data breaches. Adaptive MFA is an important addition to Auth0's expanding security portfolio&mdash;which also includes Bot Detection, Breached Password Detection, Brute Force Protection, and Suspicious IP Throttling&mdash;and is one of the platform's most advanced context-based security features.

Adaptive MFA is designed to help companies address the inherent challenges of enabling security while preserving user experience. Unlike traditional MFA, which is triggered upon every login attempt and creates an additional step for the end user, Adaptive MFA only appears when a login is deemed risky. This is calculated by an overall risk score that measures abnormal behavior from known devices, impossible travel, and/or IP reputation. Customers can have the confidence that with Adaptive MFA, their end users are asked for secondary authentication only when behavioral signals don't conform to usual patterns for a particular user. 

For example, for a user who normally signs into their account at the same time every morning in San Francisco from a personal laptop, Adaptive MFA would only present a second-factor authenticator if login was attempted outside of the region, usual timeframe, or from a different computer or IP address. Developers can determine how much weight each signal is given to define the risk score that sets off the trigger. 

Many companies are reluctant to implement MFA&mdash;proven to be an effective defense against account hacking attacks&mdash;out of fear of negatively impacting user experience and thus their conversion and retention performance. However, additional friction during the signup, login, or checkout experiences can affect user conversion/retention, resulting in lost sales, and can potentially increase support incidents. Forrester predicts that the MFA market will grow to $2 billion by 2023[1], and this anticipated growth signals the need for a more intelligent and contextually-based MFA solution.   

"Auth0's mission is to provide secure access for everyone. Securing identities is core to that mission, and this new capability adds to the already powerful features in our security profile, designed to counter a variety of sophisticated threats, such as automated attacks, account takeovers, and phishing attacks," said Shiven Ramji, Chief Product Officer at Auth0. "Adaptive MFA should be a key consideration for any enterprise that has previously had to make a tradeoff between security and user experience. The ability to reduce friction while increasing security is a competitive differentiator for our customers."

More detailed information on Adaptive MFA can be found here: [When is MFA the Right Choice?](https://auth0.com/resources/whitepapers/is-mfa-the-right-choice) (whitepaper) and on Auth0's [Multi-factor Authentication](https://auth0.com/multifactor-authentication) page.

<include src="asides/AboutAuth0" />

### Media Contacts
Global Communications <br />
Auth0 <br />
[press@auth0.com](mailto:press@auth0.com) <br />

Matter for Auth0 <br />
[auth0@matternow.com](mailto:auth0@matternow.com) <br />

(1): Forrester Analytics: IAM Software Forecast, 2018 to 2023 (Global)


Auth0 Launches Adaptive MFA to Increase Security and Reduce Friction for End Users

randy_nasson

Director of Product Management for Customer Identity Cloud (formerly Auth0) in our Identity and Access Management (IAM) domain. I joined Auth0 in 2018 and assembled a world-class IAM product team dedicated to delivering customer value and enabling developers to quickly implement secure, robust, and seamless identity solutions. In addition to my current work with CIC, I regularly work with our Auth0 Lab team on greenfield initiatives and with our Strategic and Technical Partner teams on opportunities to drive revenue.

Director, Product Management (IAM)

Randy Nasson

antoniofuentes

Antonio is a Product Manager in charge of features and functions used by thousands of customers implementing identity systems to keep their users safe and prevent malicious activity.

Product Manager, Continuous Auth

Antonio Fuentes

Adaptive MFA Improves Security and Customer Experience



## Key takeaways

* [Multi-factor authentication (MFA)](https://auth0.com/docs/mfa) provides added security for protected content, but usability concerns can adversely affect the user experience.
* Using [custom MFA options](https://auth0.com/docs/mfa/customize-mfa-user-pages) can help reduce friction, but custom MFA requires [writing rules](https://auth0.com/docs/rules) (coding) or explicit user opt-in to minimize prompts for secondary factors.
* Auth0 now offers Adaptive MFA, which only prompts users for secondary authentication factors if the login or authorization attempt is considered risky.

## The Password Problem

The rapid growth of internet and software services means that user accounts are growing at a dizzying rate. According to [Dashlane](https://blog.dashlane.com/world-password-day/), the average US internet user has over 150 online accounts, with that number projected to double by 2022. That’s a ridiculous number of passwords to remember and an equally ridiculous amount of personal data to protect. 

Given the [rampant password reuse problem](https://securityboulevard.com/2020/04/8-scary-statistics-about-the-password-reuse-problem/) (65% of people reuse passwords across multiple sites), when data breaches occur, a vast number of accounts are vulnerable. While protective measures like [Breached Password Detection](https://auth0.com/docs/attack-protection/breached-password-detection) can help minimize risks associated with known stolen credentials, there nevertheless remains a substantial risk for potential credential theft in the future.

### Securing accounts with MFA

Fortunately, [MFA](https://auth0.com/docs/mfa) offers an excellent defense against password-related account compromise. [According to Open Web Application Security Project (OWASP)](https://cheatsheetseries.owasp.org/cheatsheets/Credential_Stuffing_Prevention_Cheat_Sheet.html), MFA is “by far the best defense against the majority of password-related attacks.” 

MFA is used to protect accounts and resources across a variety of industries and comes in myriad forms to accommodate various use cases. However, it remains woefully under-adopted in many areas, especially in consumer products and services. With some solutions, MFA can be overly complex or prohibitively costly to implement. And even when it is offered, many end-users reject it because they don’t want to worry about having access to the secondary factor when they are just trying to shop online, access an article behind a paywall, play a game, or stream music. Even for developer tools like NPM, [fewer than 10% of developers use secondary factors](https://www.zdnet.com/article/only-9-27-of-all-npm-developers-use-2fa/).

Balancing security and usability has historically been very difficult, with industry trends often overcompensating in one direction, then the other, causing even more user frustration. Fortunately, Auth0 makes it easy for you to provide the security of MFA without the poor user experience of having to provide a second factor with each login attempt.

![Introducing Adaptive MFA](https://images.ctfassets.net/23aumh6u8s0i/40V8USPBHCJ0K9SxZHISMw/b7488bb599ce8d9f83a3aeea0e4334fa/adaptive-mfa-sep1)

## Introducing Adaptive MFA

Adaptive MFA bridges the gap between user experience and account security by providing a secondary factor for end-users but only prompting them for secondary verification when the primary factor login looks suspicious or unusual. For example, if the user logs in from a new device or logs in from previously unseen geolocation, these signals can indicate low confidence that a login attempt is legitimate and that the user should be prompted to authenticate via the second factor.

![AMFA How it works](https://images.ctfassets.net/23aumh6u8s0i/1NOHOVPjLZsNsuklb3Cw2e/c5ac893b034e2bf9df235deacb04966f/adaptive-mfa-graphic-1)

By only prompting for second-factor authentication when confidence is low, users who access applications on a regular basis from the same device and location never have to be interrupted with a second-factor prompt.

Auth0 is pleased to announce that Adaptive MFA is available for all hosted customers as of December 15, with Private Cloud availability in the first quarter of 2021. 

### How it works

Traditional MFA prompts users to authenticate using first a primary factor, often a username/password, and then a secondary factor, such as a code sent via SMS or push notification. This ensures that the individual logging in using the primary credentials has possession of or access to the secondary factor as well.

Adaptive MFA assesses the confidence level of each login and, based on that level, decides whether to prompt the user for a secondary factor or not. The confidence level is assessed using:

* The reputation of the requesting IP address
* The frequency of requests from differing geolocations (impossible travel)
* Whether the device is known or not

Assessing these data points for every login attempt, Auth0 determines the confidence of a legitimate login attempt and then:

* Allows the primary authentication to succeed, or
* Challenges the user with an additional factor, or
* Prompts the user to enroll a secondary factor if they currently don’t have one, or 
* Denies the login and blocks the user account

![AMFA How to enable it](https://images.ctfassets.net/23aumh6u8s0i/34gC9R0va1Kd15JtBNdHUd/ec80c9b34f6232ee44410027d8e7aaf4/adaptive-mfa-graphic-3)

### What’s included

With Adaptive MFA, you will have access to a number of tools to help you define flexible policies and make the right tradeoff between security and user experience:

* An Adaptive MFA flow that triggers MFA only when a login attempt appears to be risky
* Risk assessments that can be used to build your own rules to trigger MFA
* Support for managing the feature programmatically via the Management API
* Rule templates to get you started in case you want to write your own custom business logic
* Tenant log metadata to help you understand the risk levels and impact on user experience

### How to enable it

Using Auth0’s updated Admin Dashboard, you can easily configure Adaptive MFA for applications by selecting the **Use Adaptive MFA** option in the **Security > Multi-factor Auth > Define policies** section.

![Use Adaptive MFA](https://images.ctfassets.net/23aumh6u8s0i/7CKjaRixRDYnypIFL2cTiA/85fd1e38bda162575c1fdd7016738526/use-adaptive-mfa)

### Supported configurations

Adaptive MFA can be enabled for all MFA-supported flows and applications where an email address is available. This is because an email address is required to keep the login flow safe in scenarios where the risk is high, and an end-user has no registered additional authenticators. Most connection types fit this category.  

Connection types where an email address is not available are not supported:

* Social connections, if the email claim is not requested
* Azure AD, if the identifier is a username and no email is available
* Passwordless connections, which do not use email

Adaptive MFA is supported in the most commonly used login configurations:

* New Universal Login
* Classic Universal Login (except for passwordless flow)
* Web or Native apps using the latest SDKs
* Flows hosted by a customer using cross-origin authentication

### Fine-tuned control with policies and rules

Auth0’s Adaptive MFA lets you define how to handle low-risk and high-risk login scenarios, including whether to prompt for an additional factor or prompt the user to enroll an additional factor if they don’t have one. In addition, Auth0 enables customization of those policies through the use of rules.

![Adaptive MFA rule](https://images.ctfassets.net/23aumh6u8s0i/3X31s04spm3rcZHMbsjkli/3d974e2b7075f5c5ffc3cf4c37fe4f89/adaptive-mfa-sep2)

#### Adaptive MFA rule templates

Auth0 provides two rule templates out of the box to enable your business to tailor Adaptive MFA behavior to support your needs. 

If you want to prompt users who haven’t enrolled a secondary factor to enroll one during their next login, you can use the **Require MFA Enrollment** rule template. 

```
function requireMfaEnrollment(user, context, callback) {

  const enrolledFactors = user.multifactor || [];
  if (enrolledFactors.length === 0) {
    // The user has not enrolled in any MFA factor yet, trigger an MFA enrollment
    context.multifactor = {
    provider: 'any'
    };
  }

  callback(null, user, context);
}
```

Let’s take a look at the **Adaptive MFA** rule template. The way this rule is written, Adaptive MFA will only be triggered when the confidence level for Impossible Travel is either `medium` or `low`. It provides an example of how you can selectively apply Adaptive MFA to particular assessors and confidence levels.

```
function adaptiveMfa(user, context, callback) {
  const riskAssessment = context.riskAssessment;

  // Example condition: prompt MFA only based on the ImpossibleTravel confidence level.
  let shouldPromptMfa;
  switch (riskAssessment.assessments.ImpossibleTravel.confidence) {
    case 'low':
    case 'medium':
      shouldPromptMfa = true;
      break;
    case 'high':
      shouldPromptMfa = false;
      break;
    case 'neutral':
      // When this assessor has no useful information about the confidence, do not prompt MFA.
      shouldPromptMfa = false;
      break;
  }
```

Then, the code checks if the user is enrolled in MFA using user multi-factor. If the user is enrolled in MFA, then throw the MFA challenge.

```
  // It only makes sense to prompt for MFA when the user has at least one enrolled MFA factor.
  const userEnrolledFactors = user.multifactor || [];
  const canPromptMfa = userEnrolledFactors.length > 0;

  if (shouldPromptMfa && canPromptMfa) {
    context.multifactor = {
      provider: 'any',
      // ensure that we will prompt MFA, even if the end-user has selected to remember the browser.
      allowRememberBrowser: false
    };
  }

  callback(null, user, context);
}
```

### Let’s get started

Ready to learn more about Adaptive MFA and how to enable it to secure your applications and protected resources? Adaptive MFA is available as part of Auth0’s new [Adaptive MFA Security Bundle](https://auth0.com/pricing/). We invite you to learn more by reading the [documentation](https://auth0.com/docs/mfa/adaptive-mfa) and [contact us](https://auth0.com/contact-us) if you have any questions.

Stay safe. And keep your protected resources safe too!


Auth0 Introduces Adaptive MFA

5e074956ee8ba1fea26e30d28c190495?s=300 avatar

5e074956ee8ba1fea26e30d28c190495?s=300

Full stack developer creating content at Auth0. I love taking a deep dive into hard-to-understand concepts and creating content that makes them easier to grasp. In my free time you can usually find me reading, hanging out with my dogs, or curling in the squat rack.

Former Developer Content Manager

Holly Guevara

Learn what multi-factor authentication is and different methods for implementing MFA.


Before you can learn about multi-factor authentication, you must understand authentication itself. Authentication, simply put, is the process of **verifying that someone is who they say they are**.

When you want to sign in to your account on a website, the website must first make sure you're the owner of that account. How do they do that? They ask you for something that only you should know. Typically, this is the **username and password** that you set up when you created the account. Great! You were the one who set it up, so there's no way anyone else could have your password, right?

It turns out that someone providing the correct username and password to access a resource doesn't necessarily prove that they are who they say they are. User credential breaches have become much more prevalent in recent years, so there's a good chance that some of your username and password combinations have been involved in a breach. This means that relying only on a username and password to identify someone isn't a great practice.

This is where multi-factor authentication comes into play.

## What is Multi-factor Authentication

Multi-factor authentication (MFA) provides a method to verify a user's identity by requiring them to provide **more than one piece of identifying information**.

You have most likely encountered multi-factor authentication on some of your favorite websites already. For example, when you sign in to your banking account, you may get a screen requesting that you enter the code that was emailed to you. Once you enter this code, you're then able to access your bank account. This is an example of MFA in action!

Providing a username and password coupled with a code sent to your email is one form of MFA, but there are several other options you have for implementing MFA. Let's look at some of those now.

## Types of Multi-factor Authentication

The category that you use to identify a user is called an **authentication factor**. In general, these identification methods fall into three authentication factor categories:

**Something you know** &mdash; Something you know, such as a password, PIN, personal information like mother's maiden name, etc.

**Something you have** &mdash; A physical item you have, such as a cell phone or a card.

**Something you are** &mdash; Biometric data, such as fingerprint, retina scan, etc.

To implement multi-factor authentication, you need to cover at least two of these categories.

A common scenario would be requiring a user to sign in with their username and password. This covers the "**something you know**" category. After providing their username and password, they'd receive a text to their cell phone with a short code called a one-time password (OTP). This covers the "**something you have**" category. They'll be required to type this code into the website, and if correct, then they'll be authenticated.

<AmpContent>
![One-time password screen](https://images.ctfassets.net/23aumh6u8s0i/5RoVY86v6SZ5OAVtZzRm6B/1ee99b6f7547ece9c5fc3e7ab2563360/one-time-password)

</AmpContent>

<NonAmpContent>
<p>
<img class="img-responsive" src="https://images.ctfassets.net/23aumh6u8s0i/5RoVY86v6SZ5OAVtZzRm6B/1ee99b6f7547ece9c5fc3e7ab2563360/one-time-password" alt="one-time password screen" style="width:50%"/>
</p>
</NonAmpContent>

In this scenario, even if an attacker knows the user's password, *it isn't enough*. They'll have to also gain access to the user's phone to provide the one-time password.

### One-time passwords

In the scenario above, the application sent the user a code known as a **one-time password (OTP)**. This is one of the most commonly used forms of multi-factor authentication. Let's take a closer look at what one-time passwords are.

A one-time password, like its name indicates, is a pseudo-randomly generated password that expires after a short time period and is only valid for one login. They are typically paired with a traditional username and password to make the authentication process more secure. Even if a user has a weak or reused password, the one-time password that is sent to them is a way to indirectly strengthen their credentials.

There are a few different ways to send one-time passwords to users.

#### SMS

SMS is one of the most user-friendly ways to send one-time passwords. The user signs in to your application with their username and password, and then they receive a text message to their cell phone with their OTP. They're able to easily copy the code from the text message and send it back to the application.

While this may be simple for the user, and it's better than not having MFA at all, it's still [not the best way](https://auth0.com/blog/dont-pass-on-the-new-nist-password-guidelines/#The-SMS-Controversy) to send or receive one-time passwords.

Believe it or not, delivering an OTP through SMS carries the risk of compromise. Here are some of the ways that an attacker can gain access to your OTP through SMS:

- **Social Engineering** &mdash; An attacker that has breached a user's username and password may also have access to their phone number. Attackers have been known to obtain SMS-delivered one-time passwords by sending a text to the user telling them that they used to have the same phone number as them, and they are locked out of one of their accounts because they forgot to update the phone number listed on the account. They politely ask for the code that was just sent to the user's cell phone, so they can get back into their account. Many people want to help the person on the other end, so they text them the code without thinking much of it.

- **SIM Swap** &mdash; [SIM swapping](https://www.consumer.ftc.gov/blog/2019/10/sim-swap-scams-how-protect-yourself) (also known as simjacking) is when an attacker gains access to your cell phone number. One interesting (and terrifying) way this can happen is by an attacker calling your cell phone provider and convincing them that they lost their phone and need a new SIM card activated. The SIM card that gets activated is one that the attacker owns. If the cell phone provider obliges, then the attacker now has access to any text messages, phone calls, etc. that come through. So, if they already have your username and password, all they have to do is type in the OTP that is texted to your phone number (which they now have access to), and they're in! This [Hacking Challenge at Defcon video](https://www.youtube.com/watch?v=fHhNWAKw0bY) has an excellent demonstration of this in action.

#### Email

Another option for receiving OTPs is through email. While this does provide another step to access your account, which is great, it still has some downfalls:

- Because [password reuse is so prevalent](https://www.zdnet.com/article/44-million-microsoft-users-reused-passwords-in-the-first-three-months-of-2019/), there's a chance that a user's email password is the same as the account that's requesting the OTP. Assuming the attacker already has this password, then the extra step of the OTP is useless.

- One of the requirements for MFA is that the implemented factors come from at least two of the MFA categories: something you know, something you have, and something you are. The username and password fulfill **something you know**, and OTP is meant to fulfill **something you have**. Ideally, something you have would be a physical item, such as your cell phone. Having access to an email account doesn't necessarily mean that the cell phone is in your possession, as you could access your email from any device. 

#### Authenticator apps

Another common way to manage OTPs is with authenticator apps. Once you install the app up on your cell phone, you can set up any accounts that work with the authenticator app to send your one-time passwords to that app. The OTPs will typically regenerate every 30 seconds, so instead of waiting for an email or a text message, you simply open up the app, and you'll always find a valid OTP there.

There are a lot of authenticator app options. Some of the most popular ones are [Duo](https://duo.com/), [Authy](https://authy.com/), and [Google Authenticator](https://support.google.com/accounts/answer/1066447).

An authenticator app is an excellent choice for receiving one-time passwords. Unlike SMS, an attacker can't access your authenticator app simply by having access to your text messages or phone number. Your one-time passwords also can't be stolen if someone gains access to your email account.

There are, however, still downsides to authenticator apps. Some users may find it too much of a hassle to download a new app and set up all of their accounts on it to receive one-time passwords, especially when it's so much easier to just enter their phone number instead.

Another issue is that if you lose your cell phone, accessing those accounts that have MFA enabled can quickly become a nightmare. Most popular authenticator apps now have [safeguards, such as key backups, built-in](https://authy.com/blog/how-the-authy-two-factor-backups-work/). To enable backups, you have to create a strong password that's used to encrypt your OTPs. Then, if you ever lose your phone, you can install the authenticator app on your new phone and type in your password to decrypt your keys.

## Step-up Authentication

You may have noticed a common theme amongst the downsides to some of the OTP options: **user experience**.

One of the biggest obstacles to mass adoption of MFA is the slight hit that user experience takes. Generally, the more steps you require to sign in to your application, the fewer people will want to use it.

To manage the balance between user experience and security, some people find it best not to require MFA on every login, but instead, require it when accessing more sensitive data.

> With [step-up authentication](https://auth0.com/docs/mfa/concepts/step-up-authentication), applications that allow access to different types of resources can require users to authenticate with a stronger authentication mechanism to access sensitive resources.

For example, say you have an application that requires users to sign in with their email and password to access customer data. However, when a user wants to see employee data, an **extra authentication factor** is required.

![Auth0 step-up authentication](https://images.ctfassets.net/23aumh6u8s0i/7AkLMOctLnHeZk8BFrw3fz/7aa520a8fa86e9f485d809c0aec4f0d2/step-up-authentication-flow)

Step-up authentication is an excellent option to bridge the gap between user experience and security.

## Implementing Multi-factor Authentication with Auth0

Now that you've seen why multi-factor authentication is important, you're probably wondering *how* you can implement it into your own apps. Let's go through how you can get MFA up and running in just minutes using [Auth0](https://auth0.com).

To start, <a href="https://auth0.com/signup" data-amp-replace="CLIENT_ID" data-amp-addparams="anonId=CLIENT_ID(cid-scope-cookie-fallback-name)">sign up for a free Auth0 account</a>. Once you go through setup, leave the tab open, as you'll be returning to it soon.

Next, you're going to clone this [sample React application](https://github.com/auth0-blog/auth0-react-sample) that has already been set up to use Auth0 for authentication.

> If you'd like to know more about how this application was built, check out [The Complete Guide to React User Authentication](https://auth0.com/blog/complete-guide-to-react-user-authentication/).

In your terminal, run the following:

```bash
git clone git@github.com:auth0-blog/auth0-react-sample.git
cd auth0-react-sample
npm install
```

Next, create the `.env` file in your `auth0-react-sample` root directory:

```bash
touch .env
```

This is where you'll store your Auth0 variables so that you can connect your React application to Auth0. Paste the following into `.env`:

```
REACT_APP_AUTH0_DOMAIN=
REACT_APP_AUTH0_CLIENT_ID=
```

Back in the [Auth0 dashboard](https://manage.auth0.com/dashboard/), click on "**Applications**" and then on the "**Create Application**" button.

Name your application anything you'd like, click on "Single Page Web Applications", and then click "Create".

![Auth0 new application](https://images.ctfassets.net/23aumh6u8s0i/4qVyZ0Mpj5B9GhqeZuSc3Y/4aeab2a7cfaf7ebddf030ba9da13106f/new-auth0-application)

Click on the "**Settings**" tab. Paste the development URL for your React application (`http://localhost:4040`) into the text area under "Allowed Callback URLs", "Allowed Logout URLs", and "Allowed Web Origins".

**Allowed Callback URLs**: `http://localhost:4040`

**Allowed Logout URLs**: `http://localhost:4040`

**Allowed Web Origins**: `http://localhost:4040`

❗ Make sure you scroll down to the bottom and click "Save changes".

Next, you'll need to paste some of these values from the Settings page into your React application's `.env` file so that the Auth0 authentication server recognizes your React application.

Back in your code editor, open your `.env` file. Set `REACT_APP_AUTH0_DOMAIN` to the value for "Domain" from the Auth0 Settings page and `REACT_APP_AUTH0_CLIENT_ID` to the value of "Client ID". 

```
REACT_APP_AUTH0_DOMAIN=your-domain.auth0.com
REACT_APP_AUTH0_CLIENT_ID=yourclientidstring
```

Save this and then start your React application by running the following in your terminal:

```bash
npm start
```

Head to [`http://localhost:4040/`](http://localhost:4040/) in your browser to see your application live.

To test it out, click on the "Log In" button. You'll be redirected to the Auth0 Universal Login page (https://your-domain.auth0.com/login), where you can sign up as a new user. 

![Auth0 signup/login page](https://images.ctfassets.net/23aumh6u8s0i/6ToiqA66XF0UEs1OhYZ2Dw/66e51832bd2c5976b128ecf072927494/auth0-login-screen)

And just like that, you've successfully set up authentication on your demo React application! However, as you know from learning about MFA, this username and password approach leaves a little to be desired. Let's see how you can step up your application's security a notch by turning on multi-factor authentication.

### Enabling MFA with Auth0

Head back to the Auth0 dashboard and click on [**Multifactor Auth**](https://manage.auth0.com/dashboard/#/mfa) in the sidebar.

![Auth0 MFA](https://images.ctfassets.net/23aumh6u8s0i/7wWKd6DIOFnWafex1Iu4rT/c3df03c639a32e4679390c5b1223a7d5/mfa-dashboard.png)

There are a few options here that you can choose. To quickly see MFA in action, select "Phone Message". Scroll down a little and select "Always" from the "Require Multi-factor Auth
" dropdown, and then press "Save".

![Auth0 MFA phone number](https://images.ctfassets.net/23aumh6u8s0i/2jbVMojYAIwwnldyQBMCIY/07413d4028ea0afa75caf81f4f151969/auth0-mfa-phone-number)

Head back to your React application, sign out, and then sign back in. After entering your email and password, you'll be prompted to enter your phone number. Once you do, you'll be asked to enter the 6-digit code that was texted to you.

![Auth0 MFA text OTP](https://images.ctfassets.net/23aumh6u8s0i/4TisUePt1RFWO7GCoxiqnN/208fb3f7ab33d6be9120c862e862952c/auth0-mfa-text-otp)

![Auth0 MFA text OTP code](https://images.ctfassets.net/23aumh6u8s0i/7lCkR3RkB3XqjpIDsEk7F0/283bd91de9a1b338493df8d0361c4137/sms-otp)

Type in the code that you received to your cell phone, and then click "Continue". You'll then be asked to copy a recovery code. This is one of the safeguards that we covered back in the Authenticator Apps section that will allow you to recover your account if you ever lose your phone.

![Auth0 MFA recovery code](https://images.ctfassets.net/23aumh6u8s0i/1fK66CyrkCPmjghImTP4Hb/0e6390f24f78f7758cb8bc40b4130bbe/auth0-mfa-recovery)

Once you've copied it and pressed "Continue", you'll be redirected back to the React application, and you're now signed in!

🎉 **You just enabled MFA on your application in a matter of minutes!**

Auth0 offers several different options for MFA. This demo showed how to set up an SMS one-time password for the sake of simplicity, but if you'd prefer an even better option, you can choose from some of the authenticator apps that are offered. Feel free to experiment in the dashboard and see what works best for you!

## Wrap Up

If you need any more convincing about the need for multi-factor authentication, have a look at the popular website [haveibeenpwned.com](https://haveibeenpwned.com/). The website collects data on password breaches. You can type in your email address to see if it has been involved in any publicly known data breaches. As of writing this, there are **over 10 billion accounts** listed. So, even if you have a strong password, you're trusting the websites you use to keep that password safe, which unfortunately doesn't always happen.

While it's on your mind, take this time to go review your important accounts to make sure you have MFA enabled. Nobody wants to deal with the fallout of canceling their credit cards, dealing with stolen funds, and resetting all of their passwords because their bank account was breached due to weak credentials. Make sure you're always on the offensive by securing your accounts as much as possible! And if you run a website, take care of your users by giving them the means to secure their accounts on your application.

Be sure to reach out in the comments below or [find me on Twitter](https://twitter.com/hollylawly) if you have any questions. Thanks for reading!

Multi-factor Authentication Guide

diegopoza

System Engineer, geek, foodie, technology lover, speaker.

Sr Manager, Developer Advocacy

Diego Poza

Why more companies are entrusting identity to the experts in the name of security and growth


Every organization that uses a login box must have some form of identity and access management (IAM) system to keep track of users and control access to data and services. But in recent years, managing identity has become more complex. Today, identity management is inextricably bound to issues of security, user experience (UX), and scalability.

To cope with the challenge of maintaining IAM systems, more and more organizations are turning to Identity-as-a-Service (IDaaS) providers.

But what exactly is Identity-as-a-Service? What do these providers offer that can help businesses navigate such a challenging environment?

In this piece, we’ll define identity as a service &mdash; its core components and the reasons why it’s a rapidly growing segment of Software-as-a-Service (SaaS).

## IDaaS Defined

When an organization creates or updates an application, they have to choose which functionalities to write themselves and which to entrust to a third party. For instance, if you’re writing an application that takes payments, it’s often more time- and cost-effective to use a platform like Square rather than making your own payment system from scratch. 

The same holds true if your application requires users to log in. Given the complexities of logins and the many ways that identity management touches on analytics and security, it’s often simplest to purchase an IDaaS solution that integrates into your software and handles these issues for you.

IDaaS providers offer cloud-based solutions for IAM functions. 

When you purchase an IDaaS service, you’re essentially purchasing an API (Application Programming Interface). In the simplest terms, an API is a set of programmed rules for how software components or applications interact, like a translator or mediator. 

In the case of IDaaS, the API mediates the authentication flow between the end-user and the customer’s application(s). IDaaS may also be used to mediate Authorization to certain areas of the application or to access certain data within the application(s) your company is building.  

When we talk about managing identity, we’re referring to the identities of three basic classes of users:

* Customer identity and access management (CIAM), which applies to end-users.
* Workforce IAM, which manages your staff and their access to internal applications.
* B2B IAM, which lets businesses integrate identity with their business partners and enterprise customers.

Each of these classes requires a different approach, and an organization may subscribe to an IDaaS provider for all of them or just one.

There are a few core features common to virtually all IDaaS providers. These include:

* Multi-factor authentication (MFA)
* Biometrics
* Single Sign-On (SSO)
* User management and access control

We’ll get deeper into all those terms below.

### Multi-Factor Authentication (MFA)

[MFA](https://auth0.com/docs/mfa) is an increasingly popular way of verifying a user’s identity. It’s more secure than the traditional username/password method of logging in since [passwords are vulnerable to multiple types of attacks](https://auth0.com/blog/what-is-broken-authentication/#:~:text=Auth0%20Docs&text=Broadly%2C%20broken%20authentication%20refers%20to,to%20masquerade%20as%20a%20user.).

MFA requires users to log in with more than one piece of identifying information (i.e., a push notification in addition to a password).

Users must share some combination of the following credentials to log in:

* Knowledge: Something the user knows (such as a password)
* Possession: Something the user has (such as a cell phone)
* Inheritance: Something the user is (such as a fingerprint or retina scan)

The most common form of MFA is two-factor authentication (2FA), though you may customize an MFA solution to ask for more credentials depending on the security risk.

Despite numerous reports on [the benefits of multi-factor authentication for stopping data breaches](https://auth0.com/blog/how-two-factor-authentication-can-help-financial-institutions-reduce-data-breaches/), widespread adoption is still surprisingly low &mdash; though it has increased significantly in recent years:

![2fa-blog](https://images.ctfassets.net/23aumh6u8s0i/3UNdOb3k1qtTTy3vXU2NhJ/ca5386396ac47062473b3562d3314c9f/2fa-blog)

One of the reasons for the lagging adoption rate is that designers are wary of creating extra friction at login, especially for B2C authentication. But third-party IDaaS providers offer more customizable MFA options, like [step-up or adaptive authentication](https://auth0.com/blog/what-is-step-up-authentication-when-to-use-it/). These approaches to MFA only ask for extra credentials if a user meets a certain risk profile; for instance, logging in from a new IP address or changing payment information.

### Biometrics

Biometrics means the use of an “inheritance” criteria &mdash; something the user is as a means of verification. If you’ve ever unlocked your smartphone with your thumbprint, you’re familiar with biometrics.

![biometrics](https://images.ctfassets.net/23aumh6u8s0i/4H45r7da3K3WplJ96rXE8B/ea359f09fc4bd01419eebdc67f09f29d/biometrics)

In addition to thumbprints, other biometric authentication methods include iris or retina recognition, full [facial recognition](https://www.syte.ai/blog/brief-history-image-search/), fingerprint, hand, and DNA usage.

Many organizations are excited to use this technology and have turned to IDaaS providers to implement it rather than trying to train their in-house teams on this specialized branch of knowledge.

### Single Sign-On (SSO)

[Single Sign-On (SSO)](https://auth0.com/single-sign-on) allows users to log in to one application and then automatically be logged in to other designated applications. Most people are familiar with SSO through Google, since signing in to one Google property such as YouTube grants you access to Gmail and other applications. SSO is popular for companies with multiple brands since it allows for greater user visibility, as well as reduced friction. There are also use cases for SSO in workforce and B2B identity management.

![Single Sign-On (SSO) in action](https://images.ctfassets.net/23aumh6u8s0i/6t0LdnTcofxK6ekdSpDEja/a7376b8f04ca074a0d88dd1470d3be55/sso-desktop.jpeg)

### User management and access control

One essential element to any IAM system is the ability to control who is permitted to access data by provisioning users with different roles. IDaaS systems simplify this process by centralizing identity and putting these controls into a single location like a user dashboard. That’s a significant advantage in making sure sensitive data stays in the right hands since it’s much less prone to error than an IT team manually controlling access to individual applications.

## Why Enterprises Choose IDaaS

IDaaS is undergoing a period of exponential growth as more companies—from startups to multinational corporations—decide to outsource identity. The IDaaS market is [predicted to grow](https://www.marketsandmarkets.com/Market-Reports/identity-as-a-service-market-32235637.html) from $2.5 billion in 2019 to $6.5 billion in 2024.

Why this shift toward third-party identity solutions? The reasons include the need to meet legal requirements, manage security risks, and implement an identity solution designed around scalability and extensibility.

### Data privacy law compliance

One of the reasons that IDaaS has become so important recently is the rush to comply with new data privacy regulations. These include the [EU’s General Data Protection Regulation (GDPR), the California Consumer Privacy Act (CCPA)](https://auth0.com/resources/whitepapers/GDPR-vs-CCPA), and others.

Organizations that fail to comply with these regulations can face stiff penalties. For instance, under GDPR, organizations without secure and transparent data practices can be fined up to 20 million euros or 4% of annual global turnover &mdash; whichever is higher.

![GDPR compliance checklist](https://images.ctfassets.net/23aumh6u8s0i/4XXboWYzyp7LPl5BulfQsM/4a439e75374582bfe2a5cea60fb02120/gdpr-compliance-checklist)

Data privacy laws often grant users more rights over their data. These rights vary depending on the law, but they may include:

* A new right to data portability
* An extended right to be forgotten (also called the right to erasure)
* The right to opt in or out of data collection and sales

These rights translate to a new set of obligations for organizations. It’s now essential to have a centralized repository of user data to satisfy reporting requirements and protect sensitive data according to current best practices. Data privacy laws are rapidly evolving, and managing compliance can be a full-time job, especially for organizations with uses in multiple jurisdictions.

Managing compliance is a major undertaking for any company. However, relying on an IDaaS partner can keep track of even siloed identity stores. A centralized identity solution can deliver lower maintenance costs and greater peace of mind. Although an IDaaS provider can’t ensure your organization will be fully compliant, IDaaS tools can certainly help.

### Increased security With IDaaS

In recent years, identity has become a major source of [high-profile hacks and data breaches](https://auth0.com/blog/the-11-biggest-data-breaches-of-2020-so-far/). In fact, Verizon’s [2020 data breach report](https://enterprise.verizon.com/resources/reports/2020-data-breach-investigations-report.pdf) found that over 80% of breaches from hacking involved brute force attacks or the use of lost or stolen credentials.

The best protection against [broken authentication attacks](https://auth0.com/blog/what-is-broken-authentication/) like [credential stuffing](https://auth0.com/blog/what-is-credential-stuffing/) are the features IDaaS providers specialize in: MFA, brute force and anomaly detection, and rigorous access control.

### Extensibility, adaptability, scalability

Legal and security concerns are the most frequently mentioned benefits of partnering with an IDaaS provider, but a sophisticated approach to identity can also help growing companies boost their bottom lines. Organizations with custom-built IAM solutions frequently find that maintaining these systems and adapting them to new needs and partners takes months of developer time.

For instance, in 2019, Apple mandated that [every app on the App Store had to include “Sign in with Apple” as a login option](https://developer.apple.com/news/?id=09122019b). Companies with bespoke IAM systems scrambled to meet this requirement, and many found that their systems were rigid and full of legacy code. Most IDaaS providers, on the other hand, included this as a simple update.

Having an extensible identity platform is also essential to integrating users during [Merger and Acquisition (M&A) deals](https://auth0.com/blog/why-your-ma-strategy-has-to-include-an-iam-solution/) and in deals between enterprises. Two organizations with IAM systems that can’t talk to one another can’t benefit from each other’s data, but an IDaaS provider can act as a translator between different back ends.

## What’s Ahead For IDaaS

IDaaS is an increasingly important segment of SaaS, propelled by new regulations, heightened security risks, and excitement about new technology.

Even organizations that typically adopt a "Do it yourself" (DIY) attitude about building their own features are beginning to recognize the value of relying on third-party identity providers. They can make that switch at any stage: during initial product development, prior to release, or at an inflection point at which they see the limits of their in-house IAM system.

The definition of IDaaS will continue to evolve as providers add new features, but the need for specialized expertise to handle these matters will remain constant.

<include src="asides/AboutAuth0" />


What Is IDaaS?

Learn how an authentication server works and how it compares with an authorization server.



## What is an Authentication Server

An authentication server is used to verify credentials when a person or another server needs to prove who they are to an application.

To better understand *what* an authentication server is, let's look at what it *does* by taking a peek into what happens when an authentication request is made.

## Day in the Life of an Authentication Server

Authentication, in short, is the process of identifying a person or computer to make sure they are who they say they are.

An application or device may ask for several different identifiers to verify this. Each identifier generally falls in one of these three categories:

- **Something you know** &mdash; Usually something like a username and password or PIN. It is the most common identification method.

- **Something you have** &mdash; This covers physical things that you possess, such as a smartphone, key, etc.

- **Something you are** &mdash; This category involves verifying through [biometric methods](https://auth0.com/blog/3-critical-trends-in-biometric-authentication-in-2019/), such as a fingerprint or retinal scan.

There are several different types of authentication, but for brevity, we'll go through what happens in two scenarios: single-factor authentication and multi-factor authentication.

### Single-factor authentication

Single-factor authentication is the process of verifying an identity using only **one factor**. The different factors generally fall into one of the categories above: something you know, something you have, or something you are. The most common form of single-factor authentication is simply a **username and password**.

Let's look at what happens when a user authenticates with a username and password.

<blockquote style="font-weight:300;font-style:normal;">
<p><strong>User:</strong> <i>Navigates to a website and types in username and password</i></p>
<p><strong>Authentication Server:</strong> Whoa, what's this? Who are you??</p>
<p><strong>Authentication Server:</strong> <i>puts on glasses</i></p>
<p><strong>Authentication Server:</strong> Ahh yes, bobbysmith3. Let me verify that your secret password is correct. 🧐</p>
<p><strong>User:</strong> <i>Waiting</i></p>
<p><strong>Authentication Server:</strong> I have run my checks, and I can confirm you are indeed bobbysmith3! Welcome!</p>
</blockquote>

In this scenario, what was the authentication server checking for when the user entered their username and password? Here's the more in depth flow about what happened behind the scenes while the user was waiting to be authenticated:

* The username and hashed password are sent to the server.
* The server accesses its database of users that holds the username and [hashed/salted password](https://auth0.com/blog/hashing-passwords-one-way-road-to-security/).
* It checks the provided username and hashed password against the one in the database.
* If the credentials match, the user's identity is verified, and the application decides what's next.
* If not, a [generic error message](https://cheatsheetseries.owasp.org/cheatsheets/Authentication_Cheat_Sheet.html#authentication-and-error-messages) is returned.

> Note: The error message should not reveal too much information about why the request failed. For example, messages such as "This username does not exist" can also be used by an attacker to determine if a username *does* exist, as they would get a different error message if they try a valid username. 

While this may seem like a foolproof method of verifying a user's identity, there's a lot left to be desired. What happens if someone figures out your password?

Over the years, there has been a huge increase in the number of [credential stuffing attacks](https://auth0.com/blog/what-is-credential-stuffing/). When a data breach occurs, and usernames/passwords are leaked, they're compiled into huge lists that attackers can use to try to sign into several different websites. Since [password reuse](https://www.pandasecurity.com/mediacenter/security/password-reuse/) is so common, there's a decent chance that some of the usernames and passwords leaked from one application may be valid for another.

<include src="TweetQuote" quoteText="Single-factor authentication just doesn't cut it anymore."/>

This is where **multi-factor authentication** comes into play. Unlike single-factor, which relies on just one form of identification, multi-factor authentication requires more than one identifier to verify a user.

### Multi-factor authentication

Let's look at what happens when an authentication request is made using **two identification factors**.

<blockquote style="font-weight:300;font-style:normal;">
<p><strong>User:</strong> <i>Navigates to a website and types in username and password</i></p>
<p><strong>Authentication Server:</strong> Ahh, it's you again, bobbysmith3! Let me check that your password matches the one I have on file.</p>
<p><strong>Authentication Server:</strong> Well, it checks out. But I'm still skeptical. I'm sending a code to the phone number I have on file. Please type in the code once you receive it.</p>
<p><strong>User's phone:</strong> <i>DING!</i></p>
<p><strong>User:</strong> <i>Receives a text message and types in the code</i></p>
<p><strong>Authentication Server:</strong> The code matches! Since you have bobbysmith3's password and phone on hand, I'm confident that you are indeed bobbysmith3! Welcome!</p>
</blockquote>

One of the most common forms of [multi-factor authentication](https://auth0.com/docs/mfa) is a **username and password combined with something sent to a device or account you own**.

For example, you have probably signed into an application with your username and password, and then received a text message or email with a code that you have to provide back to the application to be authenticated. This code is called a [one-time password (OTP)](https://auth0.com/docs/mfa/guides/configure-otp).

The process for authenticating a user with username/password and an OTP is the same as above, but there's an additional step &mdash; the authentication server must send the OTP to the user's registered device and verify that the code is correct.

To do this, the authentication server must perform the following actions:

* Generate the OTP.
* Send it to the application where the user is attempting to sign in.
* Once the application sends the OTP back that the user submitted, verify that it's correct.
* If so, the user is authenticated.
* If not, return an error and allow them to regenerate another OTP. To prevent brute force attacks, there should be a [limit to how many times a new OTP can be requested](https://auth0.com/docs/anomaly-detection#brute-force-protection) before the user is blocked.

With this additional requirement, an attacker's attempt to fake their identity is greatly stunted! Let's revisit the question that was posed with single-factor username/password authentication.

> What happens if someone figures out your password?

In this case, simply having someone's password isn't enough. The attacker must also gain access to the real user's OTP to verify the identity.

As you can see, multi-factor authentication [greatly reduces](https://auth0.com/blog/why-nist-recommends-mfa-to-fight-ecommerce-fraud/#Why-E-Commerce-Needs-MFA) the chances of an attacker impersonating a user.

## What an Authentication Server Doesn't Do

An authentication server does a lot of work in the background, but it's also important to understand what it's *not* responsible for doing.

### Authentication vs. authorization

In the examples so far, the authentication server has taken steps to verify a user's identity and return it to the requesting application. What happens next is up to the application.

Once the application knows who the user is, it usually has to decide *what the user can access*. This is known as [**authorization**](https://auth0.com/docs/authorization).

**Authorization** &mdash; Authorization refers to the process of verifying what a user has access to.

**Authentication** &mdash; Authentication refers to the process of confirming identity.

It's easy to confuse authentication and authorization, but it's important to understand the difference. The authentication process **does not** determine what a user can access.

<include src="TweetQuote" quoteText="The authentication process does not determine what a user can access."/>

The authentication server simply verifies the identity of the user and then passes that information back to the application. The application then uses this identity information to determine what the current user can access.

To manage access control, an **authorization server** will issue [access tokens](https://auth0.com/docs/tokens/concepts/access-tokens) to the client that lists what permissions the current user has. If you'd like to learn more about access tokens, please check out the free ebook below. It goes in-depth about a popular web token standard, JSON Web Token (JWT). 

<include src="ebook-ads/JwtHandbook" />

So even though these two terms have entirely different meanings, the authorization process depends on authentication. Authorization cannot be granted unless the identity of the user is verified.

Because these two processes go hand-in-hand, it's common to see a solution that can handle both ends: authentication and authorization. [Auth0](https://auth0.com), for example, is an all-in-one solution that serves as both an authentication server and an authorization server.

<include src="asides/AboutAuth0" />

## Conclusion

Although the authentication process may seem simple to an end-user, what goes on behind the scenes is very complex. Every time you sign in to a website, there's a lot happening behind the scenes to verify that you are who you say you are.

Hopefully, this article was able to shed a little bit of light on some of the major tasks an authentication server performs, as well as tasks that it isn't responsible for performing.

Thank you for reading and reach out below if you have any questions or if you'd like to learn more about using Auth0 as your authorization and authentication service!


What is an Authentication Server

The trends defining the year and how businesses can protect themselves

The 11 Biggest Data Breaches of 2020 (So Far)

adam-nunn

I'm a security and compliance professional with a passion for emerging cloud technologies. I specialize in risk, privacy regulations, and industry-standard security frameworks.

Sr. Director of Governance, Risk, and Compliance

Adam Nunn

Privacy and security are partners joined by an IAM



_**Disclaimer:** This article is for general information purposes only and not a substitute for legal advice. Please consult with your legal counsel to obtain specific advice for any legal manner._

Any pre-teen with a journal understands the difference between data privacy and data security. If you secretly read your friend’s journal to find out their secrets, you’ve violated the principles of data privacy. But if your friend tells you their secrets, and you write it in your own journal, and then leave that journal out where anyone can read it, you’ve violated good data security.

As a pre-teen, a failure on either front can cost you your friendship. In today’s business world — in which cybersecurity threats are rampant, and data privacy laws like the EU's General Data Protection Regulation (GDPR) and California Consumer Privacy Act ([CCPA](https://auth0.com/ccpa/)) are cropping up around the world — failure can be even more costly. Knowing the difference between data privacy and data security, and the tools you must employ to protect both can help prevent breaches and achieve legal compliance. Unfortunately, too many executives think that their data security policy covers data privacy, and vice versa.

In this climate, it’s crucial for executives to understand how these concepts differ, how they overlap, and how to incorporate both into a sound data governance strategy.

## What's the Difference Between Data Privacy and Data Security?

You can imagine data privacy and data security as a Venn diagram with significant points of overlap, but businesses should have a distinct set of strategies for managing each. 

That doesn’t mean you can have one without the other, necessarily -- you can hardly protect privacy without security. But it does mean that sometimes it’s important to look at each concept separately to make sure both sides of the security/privacy coin are being properly addressed. 

### Data Privacy

Data privacy is about defining what personal information you should and shouldn’t ask for (or gather) from your users.

It concerns how and why an entity collects, stores, shares, and controls access to sensitive data. Data privacy is about the kind of information you ask from your users (or collect via cookies or from third parties), why you ask for that information in the first place, and how you plan to use the information you’ve gathered.

**Data privacy applies to the personal information of an individual.** GDPR and [CCPA](https://auth0.com/ccpa/) have [broadly similar definitions of personal data](https://fpf.org/wp-content/uploads/2018/11/GDPR_CCPA_Comparison-Guide.pdf). An individual’s full name and mailing address will typically be considered as personal data, while in some cases, browsing history could also be seen as personal data. GDPR goes further in defining special categories of data, such as health information, political affiliation, biometric data, and sexual orientation, which are all subject to stricter requirements for processing. The personal data of minors is also subject to stricter regulation under many international laws.

**Data privacy laws address both the "how" and the "why" of data collection.** These laws require companies to transparently communicate their policies with users and give users greater control over how their data is used, which may require providing users with the ability to opt in or out — that’s the “how.” But they also require companies to disclose what purpose they’re collecting data for — that’s the “why.” In other words, what is the reason for the intrusion.

For instance, prior to GDPR’s passage, the [UK fined Facebook](https://www.bbc.com/news/world-us-canada-48972327) for giving Cambridge Analytica access to user data without user consent, violating their privacy. There wasn’t a data breach or a malicious hacker involved — the company just wasn’t respecting user privacy, and that data was then used to [manipulate elections potentially](https://www.theguardian.com/news/2018/mar/17/cambridge-analytica-facebook-influence-us-election).

There are, of course, totally legitimate ways for a company to collect personal information without prior consent that doesn’t inherently violate the principles of data privacy. Most companies who do business online collect things like usernames, password hashes, bank or credit card information, and other data directly related to business operations.

If you’re a home insurance company, you may need the address of the customer’s home, the size of the home, the year it was built, etc. It may be perfectly fine to have that information, but if your insurance company shares this data with an unauthorized third party without your customers' knowledge or consent, you may be trodding into non-compliance territory.

Personal information as defined by the laws is a bit of an ever-changing and refining property, but there are [methods for keeping up with the changes](https://auth0.com/resources/whitepapers/evolving-definition-of-personal-Information). 

**Some data privacy laws, including GDPR, specifically enshrine the "[purpose limitation principle](https://ico.org.uk/for-organisations/guide-to-data-protection/guide-to-the-general-data-protection-regulation-gdpr/principles/),**" mandating that personal data can’t be used for a new purpose without specific permission. GDPR also requires “data minimization:” that entities don’t [collect more data than is needed for a particular purpose](https://auth0.com/blog/avoid-sinking-your-code-by-treating-data-as-a-liability/) for a specific purpose.

### Data Security

If data privacy concerns the personal data of individuals, data security concerns how a company protects that data from unauthorized access or corruption. Data security is what you do with the data you’ve gathered from your users — where you store the data, whether or not you encrypt it, who has access to it, and how you determine who is an authorized user.

It’s possible to have good data privacy standards while still failing on data security. Even if your data collection policies are strictly in accordance with the law, if you’re not protecting that data with adequate security measures such as authentication and access management, you still may not be in legal compliance.

![dataprivacy_vs_datasecurity-sep-1](https://images.ctfassets.net/23aumh6u8s0i/74v3Z31GvHeWlHw69QRUck/f46dcb7bc08161945d39d0f6bfa54283/dataprivacy_vs_datasecurity-sep-1)

## How the Law Regulates Data Privacy and Data Security

The [GDPR and the CCPA](https://auth0.com/resources/whitepapers/GDPR-vs-CCPA) came into being largely in response to unscrupulous data collection policies that failed to respect users’ privacy. Data privacy laws may require companies who deal in personal data to have well-maintained records of how user data was acquired, why, who had access to it, and where it was sold or shared and with whom. You may need to have all that information ready at all times, and be able to share it with users and regulators upon request.

The current crop of data privacy laws also specify, to varying degrees, the security measures that companies are obligated to adopt to protect data.

### Protecting Access and Anonymity

There are tools to help you build a stronger data privacy and security program.

**Access management is all about ensuring the user is who they say they are, that you have access to what you should have access to, and having a way to manage that access**. [Implementing multi-factor authentication (MFA)](https://auth0.com/blog/why-nist-recommends-mfa-to-fight-ecommerce-fraud/) is a major element to data security; otherwise, it would be easy for intruders to impersonate users and expose records through credential stuffing. MFA identifies users by checking who they are (a username), that they know something the user ought to know (a password), and that they have something only the user would have (a USB key, a mobile phone, etc).

Depending on which law you’re trying to comply with, **anonymization and de-identification are all about scrambling user data so it is no longer identified or identifiable**. There are varying legal and technical standards for what constitutes de-identification and anonymization, but as more laws develop, and the ones on the books have time to mature, we can expect some clarity and convergence on this front. IAM’s management can aid compliance even with ever-changing legal definitions. 

## Creating a Data Privacy Plan
A strong data privacy plan is all about knowing what data you have on the customer/client/user and why you have it.

You’ll need both an internal and external policy. Where an external privacy policy lets clients, customers, and shareholders know what kind of data your collecting and why, the internal privacy policy outlines what team members and the company can do with that information.

### Hash Out the Internal Policy

Sit down with your development team and hash out the bare minimum data you need to ask for.

A mapping app needs GPS locations, an online order needs an address, etc. Do not ask your customers (and do not _collect_ from your customers) any non-essential data. Even if it might “come in handy” due to future planned features of your business, GDPR and other laws stipulate that you cannot use data for anything beyond what it was originally gathered for. There’s no saving it “for later.”

The next step is to create a comprehensive policy for everyone that outlines what kind of data you’re collecting for your business, the related bits [of the actual regulation text](https://gdpr-info.eu/) to keep everyone on the same page, and detail who’s responsible for executing each leg of the policy.

Next, take stock of all the data you have and create a comprehensive inventory.  

An identity and access management (IAM) system can help you find and manage this kind of data. Take inventory of where the data has gone - to other businesses or people - and track how it got there and for what purpose.

### Drafting the External Policy

What do you need in your privacy policy to put customers at ease and meet compliance? 

First, find the relevant laws you’re working on in your location and business. A corporate lawyer who specializes in your industry may be a smart first investment, or at the very least seek out the advice of an expert in your field. 

Draft a privacy message that communicates what data you’re collecting and why, matching the legal requirements. Cribbing from boilerplate privacy permission forms from other companies in your industry could be a good starting point, but always work with your legal counsel to make sure your privacy statement accurately reflects your organization’s practices.

### Execute the Plan

The broadcast and execution of the internal and external privacy policy will need a multi-pronged approach. 

The internal privacy policy needs to be located in a knowledge base that all relevant team members have access too, and team members will have to be trained on the new policy. And, of course, developers will have to deploy these changes throughout the system, overhauling or tweaking how you collect customer data (and what data you collect). 

The external privacy policy will need to be broadcast wherever clients and customers will see it when giving the company data of any kind -- on a website, a mobile app, paper forms, whatever method your company uses.

## Create a Data Security Plan
Data security tackles two kinds of data: structured data and unstructured data.

**Structured data is the kind you'll find in your IAM** &mdash who is accessing what, and where, while logged into your system. Modern IAM platforms like Auth0 make handling structured data relatively easy. 

**Unstructured data is anything from emails to PowerPoint decks to paper notes on an employee's desk**: sensitive or valuable data that is outside of your IAM, that cannot be easily tracked and collated. Are employees emailing files to each other instead of sharing them via an encrypted cloud service? Are they taking data home in the form of print-outs or USB dongles?

### Make Someone Responsible for Data Security

The person in charge of these plans should be your CDO (Chief Data Officer) or an equivalent, dedicated position depending on your company’s size and resources. 

They should be in charge of compliance, data handling, and employee instruction on up-to-date data policies. 

###  Identify Your Vulnerabilities
Where are your data security vulnerabilities?

The more sensitive data you collect, the greater your security should be. If you have an online store, your IAM needs to help you manage and encrypt user names, addresses, and financial information.

For a company that controls medical information and has a greater responsibility to protect data in the eyes of the law, authorization and security must be airtight. Methods like multi-factor authentication and data scrambling become non-negotiable. Choosing a security solution with HIPAA experience that can offer BAAs is paramount.

If your organization stores messages, chat, or email from customers and clients, those messages need to be encrypted -- data pulled from seemingly innocuous communication could contain user information useful to breach financial accounts. If you offer a reward or loyalty program, those are frequent targets of fraud and require strong authentication and identification.

### Secure Every Form of Data

Your plan to secure data is going to depend on what sort of data you’re dealing with. Most, if not all, organizations deal with both structured and unstructured data. 

**In the case of structured data, your security plan should be tightly controlled permissions, multi-factor authentication, and single-sign-on policies for all sensitive data**. All passwords need to be hashed and salted in your database, as do all usernames.

**The primary weapon against unstructured data breaches is training**. To tackle unstructured data, start with a strong DLP (data loss prevention) plan to identify your most sensitive data and your most likely avenues of breach. 

Again, whoever is in charge of data security is also responsible for training team members about the danger of USB drives, sensitive information written on slips of paper, mobile phone photos and videos.

Create regular reminders and in-person training, showing all employees how to keep their communication private, and how to properly share files while keeping them in your secured Cloud. 

Detail policies of what data can go home if any, and consider tagging that data with a kind of check-out system to increase accountability.

**And don’t neglect machine-generated unstructured data**. Does your workplace have security cameras? Are those security cameras, either the live feeds or backed-up recordings, accessible online in anyway? Cameras and video storage can be hacked, and it's very easy for hackers to glean a huge amount of sensitive data from visible computer screens and conversations.

If you have a fleet of vehicles, their GPS data can be hacked. Your logistical routes for both cargo and personnel isn’t something you want a bad actor to have, but it’s the kind of unstructured data that’s easily forgotten.

![dataprivacy_vs_datasecurity-sep-2](https://images.ctfassets.net/23aumh6u8s0i/717Ex47kQdyZ5d40k3dM24/bd043d7ddbc62e50247db9b1f3399cb8/dataprivacy_vs_datasecurity-sep-2)

## How to Address Data Privacy and Security With IAM

Good data privacy and security means controlling permissions and dictating who has authorized access to user information. It means ensuring that the only people with access to user data have adequate training and are doing so for legitimate purposes. It means defining authorized access and prohibiting unauthorized access. It means knowing, at all times, who is doing what in your system and why.

One major point of overlap between data privacy and security (and subsequently the best place to address both) is IAM. With your IAM platform, you can authenticate users, protect their data from unlawful access, and create user profiles from which administrators can access and manage all the data you have on everyone in your system.

When formulating your company’s [data governance strategy](https://segment.com/resources/cdp/customer-data-management/), the right IAM solution will help you get a picture of where your data is being stored and control who accesses it. A good IAM system keeps your finger on the pulse of what’s actually happening in your system and provides up-to-date information on your user-base's data.

![IAM](https://images.ctfassets.net/23aumh6u8s0i/60gvj9w6NoByMHhxSq0wQM/95c8e6319ed6f269aee6e02a891ecf0f/dashboard)

Auth0’s IAM system creates granularity of access — you can define which users have permissions and at what level of security. It doesn’t have to be a binary choice between admins (who can access everything at all times) and users who are completely blocked. You can define different permissions for different needs: helpdesk, accounting, marketing, and your CTO would all have vastly different levels of trust and access. This not only tracks accountability better, but ensures that a breach of one account won’t necessarily expose all the data in the system.

Sophisticated IAMs also enable features like [multi-factor authentication](https://auth0.com/blog/different-ways-to-implement-multifactor/) and single sign-on, both of which [act as safeguards against breaches](https://auth0.com/blog/credential-stuffing-is-a-persistent-threat-to-your-users/) in the first place.

## Data Privacy Plus Data Security Equals Compliance

While data privacy and data security aren’t the same, they are complementary concepts, and executives must take both into account when approaching data.

Your users, your partners, and international regulators all expect you to be able to explain what data your company possesses, what you do with it, and how you protect it. They also want assurance that the data collected is only for the stated purpose, not to be sold, shuffled around, or exploited when new features or services are created.

The right IAM platform can help you find the answers to those questions, and help you design data privacy and data security policies that work together to form a cohesive whole.

<include src="asides/AboutAuth0" />


Data Privacy vs. Data Security: Why Your Business Needs Both

annybell-villarroel

Anny believes in a people-centric trust-based approach for security culture and awareness &mdash; one where we help people learn about cybersecurity in a fun way, and make them feel empowered, rather than afraid. She also leads the Madrid chapter for WoSEC &mdash; Women of Security.

Security Culture Manager

Annybell Villarroel

Here’s how you can protect your customers, your employees, and yourself



Do you remember the last time you fell, or almost fell, for a phishing email? I do.

I received an email notification while I was checking my phone: “Unlock your Amazon account”, apparently coming from an amazon.com address. Although unexpected, it was feasible, I had made a purchase on Amazon recently and had changed settings that could have locked the account. 

Concerned, I opened the email.

The design matched Amazon’s style, there were no typos, and my phone’s email app interface just showed me the sender’s name rather than their email. I inspected the link and noticed it was fake.

It was one of the best phishing emails I’ve received in recent times. It managed to make me feel concerned while reading it. That’s the key.

Phishing is both simple to implement and effective. A relatively low-effort attack that can have a high reward. According to Verizon’s [2020 Data Breach Investigations Report](https://enterprise.verizon.com/resources/reports/2020-data-breach-investigations-report.pdf), attackers used phishing in 22% of the investigated breaches. The quality of the attacks varies: we can go from the obviously fake, to sophisticated spear phishing campaigns that are fully customized.  

The most effective phishing emails are typically those that tap into strong emotions that drive action. In “[Thinking, Fast and Slow](https://www.amazon.com/dp/B00555X8OA/ref=dp-kindle-redirect?_encoding=UTF8&btkr=1)” Daniel Kahneman, Nobel Prize of Economics, proposed that humans have two modes of thought "System 1" which is fast, instinctive and emotional, and "System 2" which is slower, more deliberative, and more logical. Humans feel before we think. We are emotional beings.   

![phishing-separator-1](https://images.ctfassets.net/23aumh6u8s0i/4fRwjLa60geXQsStXAkFkv/b350326d596f0fdca3a5d650b9e35933/phishing-separator-1)

[Coronavirus presents a wonderful opportunity for cybercriminals to exploit our emotional selves](https://auth0.com/blog/coronavirus-and-cybersecurity-how-your-business-can-stay-safe/), “System 1”, much easier. It’s a situation that’s intrinsically concerning, and that demands a high level of engagement to stay updated with the latest alerts and announcements. Imagine the spectrum of campaigns that would tap into a strong emotion:

* Concern / Fear: Infected near you, new negative effects, tracking apps
* Curiosity: remote work, fake cures or vaccines, meeting requests, refunds, fake package delivery
* Despair / Necessity: Medical equipment, financial aid
* Compassion / Kindness: Charitable contributions

Imagination is the limit. 

## What’s the Landscape as of May 2020?

The [COVID-19 Cyber Threat Coalition](https://www.cyberthreatcoalition.org/about-us/our-mission), a coalition of cybersecurity experts working to protect individuals and organizations from COVID-19-related cyber threats, releases weekly threat advisories. Phishing appears constantly in these posts, as it’s one of the most prominent threats organizations face.

The phishing landscape has changed significantly since the pandemic started. Shortly after COVID-19 was officially declared a pandemic by the [World Health Organization (WHO)](https://www.who.int/) on March 11th, registrars saw a spike in COVID-19 related domain name registrations, with a peak of around 5000 high-risk domains registered per day in the week of March 16th. 

This number has gradually decreased since then, especially after domain registrars were requested to [increase scrutiny around COVID-related sites](https://www.zdnet.com/article/new-york-asks-domain-registrars-to-crack-down-on-sites-used-for-coronavirus-scams/) by the New York Attorney General.

![phishing-graphic](https://images.ctfassets.net/23aumh6u8s0i/3AwdeH8uutY4HUEDiZqn1b/ac8a8ac47f023ab5219a96729b2ae318/phishing-graphic-2)
<p align="center">Source: DomainTools</p>

However, as per the latest [advisory from the Cyber Threat Coalition](https://www.cyberthreatcoalition.org/advisories/2020-05-20-weekly-threat-advisory-domain-trends), it seems that the domain registrations shifted to the latest trend in the pandemic: masks. 

[Google’s threat analysis group reported](https://www.blog.google/technology/safety-security/threat-analysis-group/findings-covid-19-and-online-security-threats/) that they’re detecting 18 million malware and phishing Gmail messages per day related to COVID-19, with health organizations and health agencies becoming targets as a result.

## What Can We Do to Protect Ourselves And/Or Our Companies From This Constant Threat? 

Phishing attacks tend to have one of these three main goals:

1. **Credential Theft**

    Typically involving a link that sends the user to a fake look-alike website that requests credentials to login. 

    If the account is not properly secured with methods like [Multi-Factor Authentication](https://auth0.com/docs/mfa) (MFA), the credentials obtained could result in an account takeover. The compromised account could then be used to access internal systems, which could cause a data breach that could have compliance-related consequences as per the relevant data privacy laws such as [GDPR and CCPA](https://auth0.com/resources/whitepapers/GDPR-vs-CCPA).

2. [**Business Email Compromise**](https://shorturl.at/uFRU4)

    Often involving impersonating an executive to trick someone into transferring funds or buying gift cards. This could have a high financial cost to the organization if it succeeds.

3. **Malware Delivery**

    Usually involving downloading an infected document, or app that can cause a high impact disruption, like what happened with the [WannaCry ransomware attack in 2017](https://www.malwarebytes.com/ransomware/)

These goals can help us categorize the preventive measures we can take: 

![phishing-separator-2](https://images.ctfassets.net/23aumh6u8s0i/7Iis51GXOCFk18pBQBYkAk/dd3f1697da3627feb86af6643a3afc4c/phishing-separator-2)

### Security Awareness 

Empowering users to detect and report phishing attacks helps protect the organization no matter the type of phishing. It also helps the security team react faster thanks to their reports. We’re providing [a free user awareness guide]( https://cdn.auth0.com/blog/phishing/user-awareness-guide.pdf) to help you raise awareness internally, and we’ve released some of our [internal phishing training in our YouTube channel](https://youtu.be/lyF8I-xzZ_k) voiced by someone you would not expect 😉

<iframe width="660" height="315" src="https://www.youtube.com/embed/lyF8I-xzZ_k" frameborder="0" allow="accelerometer; autoplay; encrypted-media; gyroscope; picture-in-picture" allowfullscreen></iframe>

We wouldn’t recommend doing fake internal phishing campaigns using Coronavirus as bait since it can be too distressing in this situation, and it may hurt trust within your organization. We would recommend rolling out awareness material constantly, explaining what the communication style is in the organization, sending alerts, or sharing examples of real phishing emails transparently, not as a test campaign.

### [Multi-Factor Authentication](https://auth0.com/docs/mfa)(MFA)

MFA protects your employees from an account takeover in the event of credential theft. Implementing it and rolling it out is very easy with Auth0.

### Endpoint Protection

Antivirus solutions can protect your employees in the event of malware. There are plenty of options for the enterprise, so choosing one that fits your organization and culture will boost your defenses with minimal disruption.

### Verification Processes for Payments and Invoices

Establish an internal verification process that requires multiple people to approve a payment or expense before wiring the money, and define specific methods to do so (e.g., no gift cards)

On top of all of this, it’s key to have an easy way for your users to be able to report these attacks to your IT or Security team, such as a dedicated corporate email address, and that the team can [efficiently respond to these reports](https://auth0.com/blog/how-auth0-automates-phishing-response/).

**How can you stay updated on the latest COVID-related phishing trends?**

Here’s where you can more closely monitor the situation as it evolves:

* [FBI alerts](https://www.fbi.gov/coronavirus)
* [Cyber threat coalition](https://www.cyberthreatcoalition.org/): weekly advisory and town hall, IP blocklist, community
* [CISA (US)](https://www.us-cert.gov/ncas/alerts) and [NCSC (UK)](https://www.ncsc.gov.uk/) alerts

Phishing is an ever-evolving threat that’s constantly present for most companies across all industries, and for most end-users alike. Whether it’s a generic bait, or a message adapted to the circumstances of the moment, like COVID-19, tax filing season, or Black Friday, it’s almost guaranteed to be a threat to consider at all times for companies of any size. Rather than being overwhelmed by the challenge, training employees, creating and sharing clear processes, and enabling measures like enforced MFA can be the difference between a bad data breach and creating a resilient organization with the ability to adapt in an evolving threat landscape. 

<include src="asides/AboutAuth0" />


Phishing Goes Viral: COVID-19 Themes in Cybercrime

Leverage Auth0’s extensibility to send SMS MFA messages using the provider that best aligns with your business



Auth0 supports different options for enabling MFA to protect user account access: push notifications, authenticator apps like Google Authenticator, and one-time codes delivered through email, SMS, or third party products such as Duo.

Until now, Auth0 has integrated with Twilio as an SMS provider, which has been a great solution for our customers. However, some customers require additional flexibility when selecting SMS providers. For example, larger organizations may use a single provider for multiple purposes and want to leverage that provider for SMS MFA to consolidate payments and enjoy volume discounts.

Organizations have a number of SMS providers they can choose from depending on their business needs. There are a number of factors to consider when selecting an SMS provider: 

* **Cost:** Some SMS providers may offer more favorable pricing and pricing models than others based on the region or country to which you want to send messages.
* **Integration with your existing software infrastructure:** You may already have a provider that helps you consolidate a single view of all the communications with your users, and you want to keep using it.
* **Compliance:** You might require certain certifications from your SMS provider, which not all vendors can provide.
* **Quality of service:** Some SMS providers may have better deliverability rates than others based on the region or country of the receiver.

Selecting the right provider can yield considerable cost savings to your business and deliver a better user experience to your customers. With this in mind, we are pleased to announce that **you can now use _ANY_ provider** for delivering SMS MFA messages. Auth0 is **the first cloud identity product** that gives you that option.

## Extending Auth0

Auth0 has a powerful and scalable extensibility platform where you can write your own code that can be executed when needed. One of the extensibility points is Auth0 Hooks, which are serverless functions that Auth0 calls when a certain event happens.

You can write code to send SMS messages in our new "Send Phone Message Hook." 

To achieve this, you need to follow three simple steps:

* Create a new "Send Phone Message" [Hook from the Hooks Dashboard’s section](https://manage.auth0.com/dashboard/#/hooks) and give it a name. In this case, you'll be creating one to deliver messages using [AWS’s Simple Notification Service](http://aws.com/sns).

![Simple Notification Service 1](https://images.ctfassets.net/23aumh6u8s0i/4pGiT6S8Awe5kDzwsih44N/093c530a25c70d7945df5b130dc7b86a/1_create-new-hook)

![Simple Notification Service 2](https://images.ctfassets.net/23aumh6u8s0i/5k4AYgPss1iRbZmBFUaSU6/da0b0a2d2bca64872926b17be0870cd9/2_new-hook)

* Write the code to send a text message or use a [full example of how to send text messages with Amazon SNS](https://auth0.com/docs/mfa/send-phone-message-hook-amazon-sns).

![Amazon SNS](https://images.ctfassets.net/23aumh6u8s0i/2pqPsBOiS1bOBaOMX9gtzh/88c2847a5495b6620fa4b719bff6efa5/3_sns-hook)

* Configure the SMS MFA Factor to deliver messages using the Phone Message hook:

![SMS MFA](https://images.ctfassets.net/23aumh6u8s0i/2QTRc0KOhiqTxPWbxrTBWw/8fcfda5305900bf23e1280314164b9af/4_sms-provider)

## Using Your Vendor of Choice

We included documentation on how to implement SMS Delivery with [Amazon SNS](https://auth0.com/docs/mfa/send-phone-message-hook-amazon-sns), [Twilio](https://auth0.com/docs/mfa/send-phone-message-hook-twilio), [Infobip](https://auth0.com/docs/mfa/send-phone-message-hook-infobip), [TeleSign](https://auth0.com/docs/mfa/send-phone-message-hook-telesign), [Vonage](https://auth0.com/docs/mfa/send-phone-message-hook-vonage), [Mitto](https://auth0.com/docs/mfa/send-phone-message-hook-mitto), and [Esendex](https://auth0.com/docs/mfa/send-phone-message-hook-esendex). Just copy and paste the examples in your Hook code and start sending messages using your product of choice.

## Enhance Security With MFA
Auth0 provides the most usable and friction-free multi-factor authentication experience in the market. 

You get a state-of-the-art end-user experience for enrolling and authenticating with multiple factors, like push notifications and one-time password (OTP) apps, right out-of-the-box.

Just enable multi-factor authentication in the Auth0 Dashboard and immediately improve the security of your applications and users!

<include src="asides/AboutAuth0" />


Enable SMS MFA Using Any Provider

New regulation is part of a global push for MFA



At the end of April, the Australian Communications and Media Authority (ACMA) will begin requiring all telcos to implement two-factor authentication (2FA) when customers transfer their phone numbers between providers.

ACMA member Fiona Cameron was quoted in [ZDNet](https://www.zdnet.com/article/australian-government-introduces-new-telco-regulations-to-fight-phone-scams/), explaining her support for this regulation: “Mobile number fraud can have devastating effects as scammers can gain access to bank accounts, email, social media and more... [V]ictims struggle to regain control over personal and financial information, often over the years."

For Australian businesses providing telco services, including virtual networks of any size, this new 2FA requirement demands immediate attention. Telecommunications companies that fail to comply can be [fined up to $250,000](https://www.theguardian.com/money/2020/feb/28/acma-announces-new-rules-on-porting-mobile-numbers-to-tackle-identity). 

But even if you're not directly involved in telecommunications services—and don’t operate in Australia—this news is important. It represents a global movement, in which lawmakers are increasingly treating [multi-factor authentication (MFA)](https://auth0.com/multifactor-authentication) as a requirement rather than a mere recommendation.

## What Australia’s Regulation Entails
On its face, ACMA’s 2FA requirement is fairly limited in scope. The law requires that when customers switch (or “port”) their mobile phone numbers from one provider to another, 2FA must be in use to ensure that the number is not being hijacked by scammers. The telco will implement 2FA by sending a one-time SMS code to a customer’s phone number or email. 

2FA is the most common form of MFA. It’s more secure than logging in using a simple (easily stolen or hacked) password because it communicates with an account or device already associated with a user’s identity. 

However, some have argued that SMS codes aren’t the strongest 2FA choice to break the cycle of fraudulent phone porting. Australian Communications Consumer Action Network chief executive Teresa Corbin told [_The Guardian_](https://www.theguardian.com/money/2020/feb/28/acma-announces-new-rules-on-porting-mobile-numbers-to-tackle-identity), “We’d like to see the Acma require telcos to use highly secure forms of verification, such as hardware or software authentication tokens, which are generated with a mobile app.”

There may not be a perfect consensus on Acma’s solution, but no one denies that Australia’s specific focus on phone porting comes in response to a real security need. [According to Paul Fletcher](https://www.news.com.au/technology/consumer-issues/twofactor-authentication-to-be-made-mandatory-for-mobile-phone-number-transfers/news-story/845224336b099726f6a7410461ff8143), Australia’s Minister for Communications, Cyber Safety and the Arts, scammers steal the identities of thousands of Australians yearly through fraudulent porting, costing an average of AUS$10,000 per victim.

<include src="TweetQuote" quoteText="Find out why @acmadotgov’s 2FA requirement for all telcos to implement two-factor authentication (2FA) when customers transfer their phone numbers between providers is a global forerunner."/>

These attacks are often very targeted (unlike ransomware) in order to steal money by gaining access to financial accounts or bitcoin wallets. They are also used to target high-value people at companies (think admins) to access highly valuable resources. In 2018, [Reddit was breached](https://www.wired.com/story/reddit-hacked-thanks-to-woefully-insecure-two-factor-setup/) in one of these “SIM swapping” attacks, which prompted them to stop using SMS authentication in favor of token-based 2FA. 

The biggest players in Australia's telecommunications industry (Telstra, Optus, and Vodafone) already require pre-port authentication, but the government believes smaller service providers also need to implement the requirement or risk attracting scammers to their networks. Those network providers will have until April 2020 to achieve compliance with the regulation.

## Why Australia Is Getting Aggressive on Cybersecurity
Passing mandatory 2FA for telco is just one part of the Australian government’s broader effort to tighten cybersecurity. Last year, the government instituted the [Notifiable Data Breach](https://www.wired.com/story/reddit-hacked-thanks-to-woefully-insecure-two-factor-setup/) (NBD) program, requiring companies to notify individuals when their data has been compromised. Australia’s government is in the midst of overhauling its 2016 cybersecurity strategy, and MFA authentication was one of the “[Essential Eight](https://www.bit.com.au/guide/your-guide-to-the-essential-eight-security-strategies-451152)” security steps recommended by the Australian Signals Directorate in 2017.

While the telco 2FA regulation is highly targeted at phone porting, it’s still an indicator that Australia's federal government is willing to legislate 2FA in the name of consumer protection. This initial rule could be part of a regulatory framework that may spread to other industries. According to [ZDNet](https://www.zdnet.com/article/australian-government-introduces-new-telco-regulations-to-fight-phone-scams/), “the government believes there are still one million services that are yet to have these consumer safeguards implemented,” and these service providers may be under the microscope next.

However, the Australian government is clearly still weighing how forcefully to regulate businesses. The 2FA requirement is the first piece of policy to come out of Australia's [Scam Technology Project](https://www.acma.gov.au/theACMA/scam-technology-project), a partnership between industry and the government.

In September 2019, the government circulated a public survey soliciting input on the appropriate balance between industry self-regulation versus governmental intervention on matters of cybersecurity. The [survey](https://www.homeaffairs.gov.au/reports-and-pubs/files/cyber-security-strategy-2020-discussion-paper.pdf) asks, among other things: “Do you agree with our understanding of who is responsible for managing cyber risks in the economy?” and “Do you think the way these responsibilities are currently allocated is right? What changes should we consider?”

<include src="TweetQuote" quoteText="@acmadotgov’s 2FA requirement will provide better protection for people switching telco providers. Discover why it could pave the way for additional global MFA adoption."/>

### MFA Is Becoming a Global Standard
While Australia’s law is a pioneer in specifically mandating 2FA for phone porting, MFA is increasingly required to do business with private corporations and certain government agencies and in order to be compliant with broader data privacy laws.

In June 2019, [Microsoft announced](https://krebsonsecurity.com/2019/06/microsoft-to-require-multi-factor-authentication-for-cloud-solution-providers/) that all of its Cloud Solution Providers (CSPs) had to use MFA. In the United States, [the IRS requires](https://www.irs.gov/privacy-disclosure/multi-factor-authentication-implementation) that any federal, state or local employee accessing IRS data remotely must use MFA.

While the EU’s [General Data Privacy Regulation (GDPR)](https://auth0.com/docs/compliance/gdpr/features-aiding-compliance/protect-user-data) doesn’t specifically stipulate that businesses must implement MFA, it does require “appropriate security measures” to protect personal data, and it holds businesses liable for any breach. Because MFA is among the strongest safeguards available to protect data, GDPR compliance practically makes it a necessity. The European Union Agency for Cybersecurity (ENISA) published a [list of guidelines](https://www.enclave.ie/blog/multi-factor-authentication-is-recommended-by-the-european-union-agency-for-network-information-security-for-gdpr.508.html) when GDPR became law. In it, they specifically advised that any system handling personal data use 2FA.

In addition, the EU mandates [Strong Customer Authentication (SCA)](https://ec.europa.eu/info/publications/190913-safer-payment-services_en) for payment service providers, requiring that electronic payments user MFA.

The private sector is quickly recognizing that instituting MFA is critical to protecting data against breaches and staying compliant with data privacy laws. According to [Global Industry Analysts'](https://www.reportlinker.com/p03329771/Global-Multi-Factor-Authentication-MFA-Industry.html?utm_source=GNW) October 2019 report, the 2FA market worldwide is predicted to grow to US$12.1 billion by 2025, with potential growth of 14.3%.

Historically, many businesses have shied away from implementing MFA. For example, a [2018 Experian report](https://www.experian.com/assets/decision-analytics/reports/global-fraud-report-2018.pdf) found that only 44% of eCommerce businesses implemented MFA, out of concern that any demand for credentials would be a source of friction that might alienate customers and hurt profits.

However, with each new regulation that requires (and therefore normalizes) MFA, the perceived level of friction decreases. In other words, customers are becoming more accustomed to encountering MFA whenever they conduct sensitive transactions, so no individual business that implements it needs to worry about presenting an undue burden on the end-user.

That isn’t to say that businesses (in Australia or otherwise) shouldn’t be thinking about implementing MFA in order to ensure a seamless customer experience. Not every login attempt should require users to get a one-time code; [step-up authentication and adaptive authentication](https://auth0.com/blog/what-is-step-up-authentication-when-to-use-it/) tailor MFA requests based on risk.

Furthermore, a good MFA solution is designed to prioritize UX by completing authentication requests in as few steps as possible. Auth0’s [Guardian MFA](https://auth0.com/multifactor-authentication), for instance, lets users authenticate through a simple push notification on their phones.

![Multifactor Authentication Dashboard](https://images.ctfassets.net/23aumh6u8s0i/76dOMSouGVa1RG4sZHWMIl/fb3c361a75713719bef1665bc9ba185d/mfa-dashboard-1)

## Auth0 Can Ease the Journey to MFA
The legal requirements, customer expectations, and technological capabilities around MFA are evolving rapidly. Australia’s 2FA requirement for phone porting is just one sign that the prevailing winds are pushing industries toward more secure authentication solutions. In light of this, businesses who have avoided implementing MFA should take this opportunity to reconsider their stance.

Aside from any regulatory mandate, MFA is no longer an inherent source of friction for customers. When you outsource this capability to an authentication partner like Auth0, you can reap the benefits of MFA solutions that are secure and compliant and are as easy on your customers as possible.

For a deeper dive into MFA and the potential implications for your business, please check out our whitepaper [When is MFA the right choice](https://info.auth0.com/contact.html?utm_source=blog&utm_campaign=2020-03-aus-mandates-2fa)? 


Australia Mandates Two-Factor Authentication for Telcos

eugenio-pace-new-avatar

Pace co-founded Auth0 in early 2013 with CTO and “brother-in-arms” Matias Woloski while living 7,000 miles apart from each other. Since then, Pace has played an instrumental role in growing Auth0 into a leading identity management company that is loved by developers and trusted by global enterprises. He loves traveling and has visited more than 35 countries for business and pleasure. He currently lives in Redmond, Washington with his wife, two sons, and their labrador retriever. In his spare time, he enjoys the outdoors, rowing, riding bikes, spending time with his family, restoring his 1970 Karmann Ghia, writing his blog, and reading history and philosophy.

CEO and Co-Founder

Eugenio Pace

Deploy SSO and MFA to tackle the challenges being faced by millions of remote employees


  <div class="alert alert-info alert-icon">
  <i class="icon-budicon-500"></i>
  <strong>Make remote work safer and easier today — <a href="https://auth0.com/pricing/">click here</a> to get started.</strong></div>


As many organizations are discovering, remote working does not just mean providing employees with a laptop and expecting business to continue as usual. Instead, organizations are being confronted with new challenges - everything from Zoom etiquette (yes, your colleagues can tell you are reading Twitter) to their employees doubling as stand-in math teachers.  

An important challenge facing organizations now is authentication and authorization. Auth0 knows what it’s like to support a handful, all the way to hundreds, of remote workers. Having the capability and tools to verify that only the right employees are logging on is essential for improving everything from productivity to security. 

![Auth0 offers free workforce authentication](https://images.ctfassets.net/23aumh6u8s0i/1XCJWYdlEpVtx6HwzMCVtb/0374d37fe78ead6932a9d418aad0d3fa/value-transparency)

In addition to the recently announced [free tools for startups battling COVID-19](https://auth0.com/blog/auth0-startup-relief-helping-innovators-battle-covid-19/), Auth0 is doing more to help organizations reduce the stress of authentication and authorization of remote workers by offering internal employee authentication **free until August 31st** (up to 500 users).

As long as your admin email domain is the same as your employee domain, you can set up secure, remote logins for your employees and organization. We’ve got a simple and extensible ID Platform that can be adopted easily [in hours, not weeks](https://auth0.com/docs/protocols/saml/saml-configuration/auth0-as-identity-provider), making it suitable for _your_ workforce and _its_ requirements. As part of this free offer, businesses can take advantage of the following features:

* [Single Sign-On](https://auth0.com/single-sign-on) for ease and productivity
* [Multi-factor authentication](https://auth0.com/multifactor-authentication) for peace of mind
* [Connection to most identity providers](https://auth0.com/docs/connections/identity-providers-enterprise) for flexibility
<br>
<br>
<span style="color:#EB5424;"><a href="https://auth0.com/pricing/">Find out more here about how to get started today</a></span>

<include src="asides/AboutAuth0" />


Auth0 Makes Workforce Authentication Free Through August 2020

ramiro

I am an internet guy who loves reading and asking questions—those are the two things that helped me the most as an autodidact 🤓. If I am not learning about the latest trends in digital marketing or listening to house music, you can probably find me watching a tennis tournament. And also, I manage Social Media at Auth0 ✌️

Manager, Social Media

Ramiro Nunez Dosio

Companies of all sizes are pivoting quickly to remote work. Here are seven lessons from our remote-friendly culture


Due to recent events, hundreds of thousands of people globally have found themselves having to work from home. But what happens when someone now finds themselves out of their daily routine, without structure, and alienated from a lack of social interaction?

Auth0 has been a remote company from Day 1, with our two founders starting the company seven years ago while living in the USA and Argentina. We grew and scaled our workforce by hiring people from all around the world. Below are the key lessons for employers and employees to smooth the transition to remote working.

## 7 Lessons for Successful Remote Working


### Lesson 1: Trust Your Peers

There are two essential components for the success of remote working. Trust is one of them — when you can't work next to each other, trust becomes primordial. You have to trust your peers will continue to give their best while working from home,  that they are doing what they say they are doing, and will deliver quality work on time.

Trust will empower them to thrive.

### Lesson 2: Clear Communication

Communication is the other essential component. Without face-to-face interactions, ensuring clear, constant, and transparent communication is of utmost importance. Maintain regular communications with your peers, whether it's via chat or video, by setting up weekly syncs, 1:1s, or brainstorm sessions.

Tools play a key role in making this an enjoyable and efficient experience. There are plenty of options, but our communications trifecta is [Slack](https://slack.com/), [Zoom](https://zoom.us/), and [Confluence](https://www.atlassian.com/software/confluence) for chat, video, and documentation. We also use [Mural](https://mural.co/) for whiteboarding, [Figma](https://www.figma.com/) for real-time collaboration between our designers, and [Lattice](https://lattice.com/) for feedback, surveys, and 1:1 conversations, just to name a few more.

![The important of clear and constant communication when remote working](https://images.ctfassets.net/23aumh6u8s0i/1a1S0WICPdXHF78I3S3ysT/23b698a239d8a43d7d800794cae2620f/0_hero)

### Lesson 3: Respect Others' Time

Meetings can be tempting when working remotely (it's an opportunity to see a face!) but think twice before scheduling one. Ask yourself, can this be managed via message/email or maybe even a short video call? If yes, then there is no need to schedule a meeting. The meeting is needed? Ok, but make sure to set up an agenda and respect the starting and ending times.

Don't expect instant responses from colleagues. Your messages/emails don't have to be answered instantly. Everyone needs time to focus on their projects, so take into account that your requests can't be answered right away and learn to respect the 'Do Not Disturb' status.

### Lesson 4: Manage Your Time

Making the switch to remote is not easy and can have an impact on your productivity, but many things can help:

* Start by organizing your day — structure is key.
* To-Do lists are your friend.
* Plan in advance.
* Implement a time management technique — we recommend the [Pomodoro technique](https://en.wikipedia.org/wiki/Pomodoro_Technique).
* Block your calendar with focus sessions.
* Setup the don't disturb status.

### Lesson 5: WorkSpace

"It will be amazing to work from my bed or couch" is a common first thought when starting to work from home. Although the idea is very tempting, having a dedicated space for working is essential.

It doesn't have to be a fancy office with 3 screens and full of gadgets, it's about having a space that suits you, where you feel relaxed and happy, and which enables you to focus and set your creativity free.

Tips to set up a quick workspace: find a space in your house close to the internet (you don't want to lose connection during a video call) where you can work without disruptions, take your most comfortable chair and desk, order nice headphones, and you are ready to work.

### Lesson 6: Work-Life Balance

Working from home can blur the lines that divide personal and professional time. The most important thing is to set up boundaries by implementing office hours. Forget about the typical 9-5 (you are free from that), but choose what suits you best. The important thing is to divide your two lives.

Remember to take breaks during your office hours. Taking breaks doesn't come as easy when working from home, but they are important for your mental health and productivity. Try planning and scheduling your breaks in advance and most importantly: *get away from your desk*.

Another big one is exercise. Sedentarism is one of the few cons of remote working, but there are plenty of great routines you can do right there in your house.

Now you can't justify not doing exercise because of the lack of time... you have hours free because you are not commuting anymore.

![7 lessons from beignn remote working for 7 years](https://images.ctfassets.net/23aumh6u8s0i/1823ottXfMNiYotVUDWb32/8b1944d65d45be3594d1f386ddbfb79f/culture2)

### Lesson 7: Don't Overlook Security

The sudden growth of remote working comes with an increase of cybersecurity challenges: new devices to be hacked, networks to be probed, credentials to be stolen, and targeted phishing attempts, to name just a few

Here are 3 tips that can help overcome these challenges:

- *Cybersecurity Guidance*: education is the main way to overcome these challenges. Educate your organization about security by creating best practices guides and setting up training sessions.

- *Single Sign-On*: reduce password fatigue, mitigate credential theft, and make life easy for everyone by [setting up Single Sign-On](https://auth0.com/single-sign-on).

- *Multi-factor Authentication (MFA)*: the much needed extra layer of security. [Implement MFA](https://auth0.com/multifactor-authentication) and safeguard your data from unauthorized access.

## Conclusion

Welcome to the remote club. We hope these lessons based on our experience of 7 years as a remote company can help you get the best of your remote time and maintain the same productivity as working from an office.

Are you a remote worker specialist and want to share some of your lessons? Or you just started remote work and have some questions? Please go ahead and leave a comment.


Welcome to the Remote Club: 7 Lessons From 7 Years

jenny-obrien

I'm a former business journalist who's fascinated by the intersection of tech and business strategy — in particular how the right solution can transform an idea into reality. I specialize in ROI, data privacy, and identity.

Business Content Manager

Jenny O'Brien

No organization or violation is too small to avoid costly penalties.



## No Organization or Violation Is Too Small to Avoid Costly Penalties.

Since the EU’s [General Data Protection Regulation (GDPR)](https://auth0.com/docs/compliance/gdpr) took effect in May 2018, EU authorities have issued more than [370 million euros](https://www.itgovernance.co.uk/dpa-and-gdpr-penalties) in fines. The headlines about GDPR enforcement have been dominated by a few well-known companies hit with big penalties: $57 million for [Google](https://www.nytimes.com/2019/01/21/technology/google-europe-gdpr-fine.html), $123 million for [Marriott International](https://www.forbes.com/sites/kateoflahertyuk/2019/07/09/marriott-faces-gdpr-fine-of-123-million/), and $230 million for [British Airways](https://www.cnet.com/news/british-airways-faces-record-breaking-230m-gdpr-fine-for-2018-data-breach/).

If you’re an executive following these stories, you might walk away with the mistaken impression that European authorities are prosecuting only multinational corporations for massive data breaches or privacy violations. But authorities in EU member states haven’t hesitated to issue significant fines to smaller organizations, sometimes for seemingly minor infractions.

Broadly, EU data protection authorities can fine any organization (or private citizen) that collects or processes personal information of EU residents and fails to obtain appropriate consent, does not have an adequate legal basis for collection, does not have appropriate security in place to protect such data, or fails to comply with individuals’ right to access, alter, and delete their data.

Executives in the European Union and beyond can learn valuable lessons from these lesser-known GDPR fines. Here are a few particularly interesting cases of GDPR violations the EU authorities are pursuing, and ways your business can avoid being fined for noncompliance.

<include src="TweetQuote" quoteText="Doing business in the EU? Even if you’re not a Facebook or Google, there are lessons to be learned by the track record of significant GDPR fines for smaller companies."/>

## Dutch Insurers Hit With GDPR Fine for Not Using MFA
Dutch public insurance company UWV was penalized for neglecting to implement adequate security measures when processing health data. According to the [_National Law Review_](https://www.natlawreview.com/article/dutch-supervisory-authority-imposes-gdpr-security-standard-processing-broadly), UWV had a public portal where employers could submit the dates of employee absences due to illness, pregnancy, or parental leave. Though employers did not specify what medical situation employees missed work for, even alluding to the fact that someone had been sick still qualified this as “health data,” which is highly protected under the GDPR.

UWV was prosecuted under [Article 32 of the GDPR](https://gdpr-info.eu/art-32-gdpr/), which mandates that organizations “shall implement appropriate technical and organizational measures to ensure a level of security appropriate to the risk.” The Dutch supervisory authority deemed that UWV violated Article 32 by failing to implement [multifactor authentication (MFA)](https://auth0.com/learn/get-started-with-mfa/) in its portal. With MFA, logins require an additional form of authentication, such as a one-time code or a biometric credential. This form of login is more secure than simple username-password combinations, which are vulnerable to improper access and [credential stuffing attacks](https://auth0.com/resources/whitepapers/credential-stuffing-attacks).

UWV is far from the only organization to be penalized for inadequate security. According to [GDPR Enforcement Tracker’s](https://www.enforcementtracker.com/#) database, there have been 37 fines levied to date under Article 32, making it the third-most-quoted article in enforcement actions, after articles 5 and 6. While 5 and 6 are quite broad in scope and could be considered catchalls, Article 32 singles out organizations with inadequate technical safeguards on personal data, whether that data was exposed or not.

UWV was made to conduct a privacy impact assessment and was given a year to put improved security in place, after which they would be fined €150,000 per month, with a maximum fine of €900,000.

**How to avoid this type of GDPR fine:** First, determine whether your business processes information that falls under one of the GDPR’s [special categories of personal data](https://gdpr-info.eu/art-9-gdpr/), which is defined as “data revealing racial or ethnic origin, political opinions, religious or philosophical beliefs, or trade union membership and the processing of genetic data, biometric data to uniquely identify a natural person, data concerning health or data concerning a natural person’s sex life or sexual orientation.”

Any organization that engages in this type of data processing (even if, like UWV, it only obliquely alludes to it) will be held to a higher standard of data protection. That means it’s a good idea to put MFA in place to achieve GDPR compliance, and not just for your end-users but your employees as well. In a similar case in the Netherlands, a [hospital was fined](https://cloudprivacycheck.eu/latest-news/article/fine-of-EUR-460000-imposed-on-dutch-haga-hospital-by-dutch-data-protection-officer-the-first-dutch-fine-under-gdpr-july-19-2019/) €460,000 for not having two-factor authentication in place to prevent staff members from improperly accessing the medical records of a Dutch celebrity.

## Misplaced Files Earn a Hefty GDPR Fine

[Norway’s supervisory authority](https://aigine.se/en/one-file-in-the-wrong-place-price-170-000e/gdpr/) fined the municipality of Bergen €170,000 under articles 5 and 32 of the GDPR. This case came to light after a student in a local school discovered that several files, containing login credentials for 35,000 students and employees, were accessible to the public. This oversight was exacerbated by the fact that the school system also didn’t have MFA in place, so anyone who had login credentials could then access the school’s digital learning platform, which contained highly personal information, such as schoolwork and teacher evaluations.

Norway’s data protection authority, [Datatilsynet](https://www.datatilsynet.no/en/regulations-and-tools/reports-on-specific-subjects/administrative-fine-of-170.000--imposed-on-bergen-municipality/), said the size of the fine was partly due to “aggravating factors.” Specifically, they cited the fact that the majority of the data subjects were children, and that the town had been warned repeatedly, both by outsiders and “an internal whistleblower,” that it needed to improve its [data security](https://www.voicesage.com/blog/mobile-messaging-and-the-implications-on-data-security-best-practices/).

**How to avoid this type of GDPR fine:** As Datatilsynet explained in its decision: “In the GDPR, children are defined as a particularly vulnerable group that shall be given special protection.” So any business that processes the data of minors must exercise special care, both in ensuring that data is secure and in obtaining consent.

Also, this fine speaks to how imperative it is for every company to [get a clear view](https://auth0.com/blog/yes-data-privacy-applies-to-you/) of where their data is and who can access it. A good place to start is a user management system, with a [dashboard](https://auth0.com/docs/dashboard) that lets you easily grant and revoke permissions to sensitive data and delete it on request, by data subjects' rights under the GDPR.

<include src="TweetQuote" quoteText="The pace of GDPR is expected to pick up in 2020. Discover what even smaller companies need to do to avoid significant fines."/>

## Similar Data Breaches, but Very Different GDPR Fines

In the summer of 2018, German social media company [Knuddels](https://threatpost.com/knuddels-flirt-app-slapped-with-hefty-fine-after-data-breach/139384/) and EU fintech company [MisterTango](https://digitalguardian.com/blog/lithuanian-dpa-hopes-first-gdpr-fine-wake-call) each suffered data breaches that exposed personal information, but they were treated very differently by authorities.

Knuddels got away with a €20,000 administrative fine under Article 32, which [German supervisory authorities](https://www.baden-wuerttemberg.datenschutz.de/lfdi-baden-wuerttemberg-verhaengt-sein-erstes-bussgeld-in-deutschland-nach-der-ds-gvo/) attributed to its transparency, cooperation with authorities, and efforts to institute additional security measures.

MisterTango, meanwhile, was fined €61,500 under articles 5, 32, and 33. Lithuania’s data protection authority held the company to account for failing to report their security breach to the [Information Commissioner’s Office](https://ico.org.uk/)(ICO) within the requisite 72 hours. This initial misstep triggered an investigation, which revealed that MisterTango was collecting data with an insufficient legal basis and storing it for too long and had only one employee charged with handling data security.

**How to avoid this type of GDPR fine:** Both Knuddels and MisterTango made significant data security errors. Knuddels stored unencrypted versions of its users’ credentials, and MisterTango inadvertently exposed customer data in a public setting. There are lessons here about the importance of anonymizing personal information and keeping close track of data.

The biggest lesson, however, is in the vast disparity of the fines for two similar violations. Knuddels minimized the damage by coming forward about the security breach immediately and devoting adequate resources to ensure it would never happen again. [EU authorities have emphasized](https://auth0.com/blog/data-privacy-2019-the-lowdown/) that they will be more lenient with organizations that act in good faith and can show a commitment to fixing mistakes and prioritizing cybersecurity. By devoting adequate resources to data privacy—such as partnering with an expert third party like Auth0—you can prove that your business is serious about getting GDPR compliant.

## Embrace GDPR Compliance Now or Risk Penalties Later

What these fines should teach us is that no one who processes the data of EU citizens is small enough to pass under GDPR’s radar. (That even includes private individuals, like the man who was fined €300 by Austria’s data protection authority for [illegally using a dashcam](https://easygdpr.eu/gdpr-incident/strafe-gegen-privatperson-wegen-dashcam/).)

The pace of regulatory actions under the GDPR is expected to only increase in the coming year, and all it takes is a single individual’s complaint to trigger an investigation. Given the potential costs of GDPR infringement, along with the new data protection laws coming into effect around the world, now is the time to put appropriate security measures in place and prove that you’re serious about protecting personal information. If you’d like to learn how the right identity management partner can be part of the solution, don’t hesitate to reach out to [Auth0’s experts](mailto: sales@auth0.com) today.


GDPR Fines Hit These Companies Hard. Here’s How to Avoid Them.

Breached Password Detection and Multifactor Authentication Critical for Prevention



**BELLEVUE, Wash., November 18, 2019 —** The [Auth0](https://auth0.com/) Identity Platform, a product unit within Okta, today revealed data insights showing the staggering amount of credential stuffing attacks attempted on its platform on a daily basis. Auth0 detects attacks from more than 50,000 unique IP addresses every day, reflecting the growing sophistication and frequency of cybercrime. Credential stuffing attempts are constantly multiplying, with absolutely no slowdown in sight.

The sheer number of attempts is due largely to the ease and inexpensive manner in which credential stuffing attacks can be orchestrated. Getting access to breached passwords is the first step for attackers, and unfortunately, there are billions openly available on the internet. Auth0's database contains more than one billion breached email/password combinations which are used for its [Breached Password Detection](https://auth0.com/breached-passwords) feature, the first line of defense against credential stuffing. Breached credentials, in combination with 65% of people [reusing passwords across accounts](https://services.google.com/fh/files/blogs/google_security_infographic.pdf) (Google), enables hackers to architect botnets — networks of exploited devices — to direct large-scale attacks in a coordinated manner.

Whereas targeted attacks have a specific and designated entry in mind, large-scale attacks like credential stuffing are automated and intended to attack as many entry points as possible. There is also a proliferation of 'botnets-for-hire' where services are traded among hackers, even rented for nominal fees for use in widespread attacks. And their destruction can oftentimes go unnoticed because these botnets steal insignificant amounts of money from services (like Spotify or Netflix) that actually add up to billions of dollars every year.

Between July and September 2019 alone, Auth0 determined that during a credential stuffing attack, traffic for a particular website may surge as much as 180x the usual volume, with traffic related to the attack itself accounting for 70% of overall activity.

"Unfortunately, it has become very easy and cheap for bad actors to quickly rotate the IP addresses used in an attack. Nearly all of the attacks we detect appear to originate from botnets," said Matias Woloski, CTO and co-founder of Auth0. "Many major brands have fallen victim to credential stuffing attacks this year — causing a significant impact on IT resources, account takeovers, and brand reputation. Even the largest companies are vulnerable if they don't have the right preventative measures in place." 

Auth0 is at the front door to stop credential stuffing attacks. [Breached Password Detection](https://auth0.com/breached-passwords) (part of Auth0's [Anomaly Detection](https://auth0.com/learn/anomaly-detection/)), with its internal database of more than one billion breached passwords, enables customers to block user accounts that try to login with compromised information, and only grants access when the password has been reset. This is instrumental in blocking credential stuffing attacks, since hackers rely on people reusing email and password combinations that have already been breached.  

In addition, [Multifactor Authentication](https://auth0.com/multifactor-authentication) (MFA) is one of the best ways to prevent account takeovers, whether from a credential stuffing attack or something else. In order to compromise an MFA-protected account, attackers would need to access not only a set of breached credentials used across accounts, but also the device used for the second factor. Combatting MFA drastically increases the time and effort needed for bad actors to compromise an account, which makes it infeasible to do at scale. Auth0 is working on additional features to reduce the perceived friction end users experience when MFA is implemented.

"Breached Password Detection and MFA functionality are the critical barriers for preventing credential stuffing attacks. We are continuously improving our features to detect and prevent, and will be rolling out new functionality to have even greater visibility into attacks," added Woloski.

<include src="asides/AboutAuth0" />

### Media Contacts

Alex Plew <br>
Matter for Auth0 <br>
auth0@matternow.com <br>

Deepika Zafar <br>
Racepoint Global for Auth0, EMEA <br>
auth0@racepointglobal.com


Auth0 Reveals 50,000 Unique IP Addresses Make Credential Stuffing Attempts on Daily Basis

MFA adoption urged to fight e-commerce fraud


Fraudulent purchases and data breaches are an incredibly costly problem for online retailers, and they are on the rise. A [ThreatMetrix report](https://www.signifyd.com/blog/2018/06/26/ecommerce-fraud-grow-threatmetrix/) found that in the first quarter of 2018, the growth of e-commerce fraud attempts outpaced the growth of overall e-commerce transactions by 83%.

According to the latest data from [IBM](https://digitalguardian.com/blog/whats-cost-data-breach-2019), the average cost of a data breach is currently $150 per compromised record, and the costs of data breaches will only increase with the passage of new privacy legislation.

For business leaders concerned about protecting profits and customer data from attacks the National Institute of Standards and Technology’s (NIST) [recent guidance for e-commerce businesses](https://www.nccoe.nist.gov/projects/use-cases/multifactor-authentication-ecommerce) to implement multi-factor authentication (MFA) can offer some relief.

<include src="TweetQuote" quoteText="According to the latest data from IBM, the average cost of a data breach is currently $150 per compromised record"/>

When deployed properly, MFA is one of the strongest defenses against fraudulent purchases and administrative data breaches, yet e-commerce has been [slow to adopt it](https://www.experian.com/assets/decision-analytics/reports/global-fraud-report-2018.pdf). [Experian’s research](https://www.experian.com/assets/decision-analytics/reports/global-fraud-report-2018.pdf) found that only 44% of businesses currently employ MFA, which they attribute to concerns about it negatively impacting customer experience.

Yet modern MFA solutions allow businesses to balance [security and convenience](https://auth0.com/blog/security-vs-convenience/). The NIST’s guidelines offer actionable advice for e-commerce to catch up to current security standards and what to look for when embracing MFA.

In this piece, we’ll go over what MFA is, how the NIST defines sound MFA solutions, and how e-commerce businesses can effectively implement MFA while balancing their other business needs.

## MFA in a Nutshell

In the simplest terms, [MFA](https://auth0.com/learn/get-started-with-mfa/) is a protocol for determining if individuals using your system are who they claim to be. MFA demands more than one (usually two) types of credentials:

* Something someone knows (like a password or their mother’s maiden name)
* Something they have (such as a phone on which they can receive a one-time SMS code)
* Something they are (biometric ID such as a fingerprint or facial scan)

![Multi-Factor Authentication Auth0](https://images.ctfassets.net/23aumh6u8s0i/4VTHSpJTsDhLuAyznJK2BE/27185cb5d398e5f1dc609141c781d57b/mfa-auth0)

A business using MFA can request additional verification at any point in a user’s session: login, purchase, or when navigating within a site or app.

Developers generally consider MFA to be the safest form of authentication, but there are a wide variety of MFA solutions available, and [they are not all created equally](https://auth0.com/blog/is-multifactor-authentication-the-best-way-to-secure-your-accounts-myths-and-reality/).

Finally, while most of us are familiar with MFA from our own online shopping experiences, it isn’t just for end users. The NIST emphasizes that requiring MFA for e-commerce admins is crucial for preventing data breaches rising from admin phishing attacks.

## Why E-Commerce Needs MFA

The continually-evolving digital threat landscape makes e-commerce businesses particularly vulnerable. As the NIST’s guide explains, 2015 saw the introduction of security improvements to credit cards and in-store terminals. These improvements reduced traditional credit card fraud but had the unintended effect of pushing more theft online.

E-commerce businesses are vulnerable to several types of attack, including [brute force attacks](https://www.scmagazineuk.com/brute-force-dictionary-attacks-400-percent-2017/article/1473168), [phishing](https://www.vadesecure.com/en/ecommerce-security-issues/), and [credential stuffing](https://auth0.com/blog/credential-stuffing-is-a-persistent-threat-to-your-users/), which the NIST gives particular focus to in its guidelines.

In credential stuffing, user IDs and passwords stolen from one site are used to log in to another, preying on the tendency of users to recycle the same few passwords. Credential stuffing is arguably the [most dangerous and prevalent](https://blog.barracuda.com/2019/04/02/is-2019-the-year-credential-stuffing-dominates-the-threat-landscape/) security threat of 2019. An [Akamai report](https://www.akamai.com/us/en/multimedia/documents/state-of-the-internet/state-of-the-internet-security-retail-attacks-and-api-traffic-report-2019.pdf) found that retail was the single most vulnerable vertical for this attack, with over 10 billion credential abuse attempts in 2018.

<include src="TweetQuote" quoteText="Developers generally consider MFA to be the safest form of authentication"/>

Credential stuffing is difficult to combat, and will likely worsen as hackers develop more sophisticated bots that can combine data from multiple breaches in their attacks. Successful credential stuffing can lead to account takeover. For customers, account takeovers can result in fraudulent purchases being shipped to strangers.

For admins, they can lead to even [more serious data breaches](https://www.zdnet.com/article/anatomy-of-the-target-data-breach-missed-opportunities-and-lessons-learned/).

So how do you know if your current authentication system is at risk for these types of breaches? NIST lists the following common traits of vulnerable systems:

* Allow multiple incorrect logins without account lockouts
* Purchasers have reused the same password on multiple systems
* Accept weak passwords

If any of those describe your company’s authentication system, implementing MFA can quickly patch those leaks to project you and your customers while you strengthen your identity solution.

## What Makes a Good E-Commerce MFA Solution

MFA is open-source technology, but there’s a great deal of variance between implementation methods. NIST specifies a few “must-haves” for MFA solutions to protect your business effectively.

* **Customization**: Not every transaction should require additional authentication, so a good MFA solution allows you to tailor your system to your needs. NIST lists the most common parameters to trigger verification as cost threshold (a purchase above a certain dollar amount) and risk threshold. You can customize your definition of risk any number of ways, such as a customer using a new shipping address, paying with a new card, buying an item commonly associated with fraud, or making a purchase at an unusual time of day.
* **Require MFA for admin tasks**: A criminal with fraudulent admin credentials can do incalculable damage to your business, so NIST recommends that any administration activity requires verification.
* **Dashboards for suspicious activity**: The NIST report specifically mentions that e-commerce businesses should “enable system-activity situational awareness by providing dashboards that display account lockout and authentication activity.” Auth0’s dashboard does just this: giving you a high-level look at your users, allowing your admins to spot patterns and being aware of new threats as they evolve.

![Auth0 Dashboard](https://images.ctfassets.net/23aumh6u8s0i/7sbXQ9SWpmPS7HuKh9pGhE/427d1c43629461957d5c506e8e9e535d/auth0-dashboard)

Auth0 also offers [breached password protection](https://auth0.com/docs/anomaly-detection), which tracks security breaches at third-party sites and flags potentially stolen credentials. Taken together, these features are a proactive way for e-commerce teams to detect and prevent fraudulent transactions.

## How an IDaaS Partner Manages Your MFA Needs

Many e-commerce executives have been slow to push for MFA because they feared alienating customers with irritating demands for credentials. However, online shoppers are increasingly reassured rather than irritated by such measures.

In [Experian’s 2018 Global Fraud and Identity Report](https://www.experian.com/assets/decision-analytics/reports/global-fraud-report-2018.pdf), 66% of surveyed customers reported that they “like all the security protocols when I interact online because it makes me feel protected." Yet customer tolerance isn’t infinite, and in the same survey, a third of customers reported that security demands caused them to make fewer online purchases.

E-commerce businesses have to find an MFA solution that provides both effective fraud prevention and positive user experiences. By partnering with an identity management platform like Auth0, you can reap the benefits of increased security without taxing your developers or frustrating your customers.

* **Balance of ease and customizability**: Auth0’s MFA solutions can be turned on by flipping a single toggle, so you don’t have to wait weeks or months for your developers to secure your system. However, Auth0 also gives your team the freedom to write customized rules for MFA around any of the parameters discussed above.
* **Reduced friction for users**: Auth0’s MFA lets developers choose which factors for authentication suit their needs, whether that’s SMS, a token generator app, or Guardian, which lets users authenticate via a push notification.This allows users to utilize the MFA method they want while maintaining proper security practices.

![Multi-Factor Authentication Auth0](https://images.ctfassets.net/23aumh6u8s0i/4VTHSpJTsDhLuAyznJK2BE/27185cb5d398e5f1dc609141c781d57b/mfa-auth0)

Guardian doesn’t require your customers to install an app or even have a smartphone, so it’s a truly universal solution that meets both security and UX needs.

* **Evolves with and for you**: Keeping on top of current security standards can be a full-time job. But it’s not your full-time job, so outsourcing MFA to a highly respected and [accredited IDaaS partner](https://auth0.com/blog/the-real-roi-of-auth0-part-3-security/) like Auth0 can provide peace of mind to your customers and yourself.

## NIST Guidance Can Offer Immediate Protection

Though NIST’s guidelines are voluntary suggestions, their very existence points to the urgent need for MFA adoption to protect online shopping as a whole. As the guide says: “fraud impacts the e-commerce ecosystem by decreasing purchaser confidence...and by increasing costs to offset the e-commerce fraud.”

Business leaders are under pressure to protect their customers from identity-based attacks without sacrificing revenue through excessive security measures. Finding this balance requires expert help, so reach out to an [Auth0 resource](mailto: sales@auth0.com) to talk about how you can put NIST advice into practice.

<include src="asides/AboutAuth0" />

---


Why NIST Recommends MFA to Fight E-Commerce Fraud

Email MFA powered by Universal Login is here to help you improve your user's experience.


Ever try to log into an application with multi-factor authentication, only to realize that your phone was dead? It is incredibly frustrating to realize you either need to find a phone charger or dig up your MFA recovery code just to check your email.

The problem is even worse for the app owner. When a user can't log in, they can't interact with your app. This can result in lower adoption, engagement, and money, especially for consumer-facing applications.

[With the latest release of Universal Login](https://auth0.com/blog/introducing-the-new-auth0-universal-login-experience/), Auth0 can solve this problem with email as a backup MFA factor.

<script src="https://fast.wistia.com/embed/medias/kfdckzkaiu.jsonp" async></script><script src="https://fast.wistia.com/assets/external/E-v1.js" async></script><div class="wistia_responsive_padding" style="padding:92.5% 0 0 0;position:relative;"><div class="wistia_responsive_wrapper" style="height:100%;left:0;position:absolute;top:0;width:100%;"><div class="wistia_embed wistia_async_kfdckzkaiu videoFoam=true" style="height:100%;position:relative;width:100%">&nbsp;</div></div></div>
<br>
## How Does it Work?

When a user tries to authenticate and is prompted for MFA, they can click try another method and select Email. Auth0 will then send an email to the user's verified email address with a one-time password, which they can use to authenticate.

There are a few prerequisites for email MFA:

-   The app must be using Auth0's [New Universal Login experience](https://auth0.com/docs/universal-login/new)

-   Email must be enabled in the Auth0 [management dashboard or via the management API](https://auth0.com/docs/multifactor-authentication/api/email)

-   The user's email address must be verified

-   The user must have some other method of MFA enabled

![Auth0 Management Dashboard showing Email MFA enabled](https://images.ctfassets.net/23aumh6u8s0i/5JBvrPGUYW7qfri402dz7p/dfcbc655b59756dfb2f6dbf54f041cca/jgwxzr97i321lfas4aav)

## What about Email as the Only MFA Factor?

Currently, email MFA is only available as an optional backup multi-factor method. The user must have another method as the primary form of multi-factor authentication. Enabling email MFA as a standalone multi-factor method is on the Auth0 roadmap.

## How Do I Get Started?

To try email MFA with the New Universal Login experience out, sign up for Auth0 for free and click on Multifactor Auth in the management dashboard. [Follow these instructions for enabling Email MFA.](https://auth0.com/docs/multifactor-authentication/api/email)

<include src="asides/AboutAuth0" />


No Phone? No Problem! Email MFA Is Here

Enable your upmarket strategy with the right technical infrastructure



Enterprise customers are demanding.

Long sales cycles, filled with requests for custom features and integrations, can monopolize your developers and your sales team. If a contract falls through, a lot of time and money will fall through with it.

But the [_move upmarket_](https://auth0.com/blog/how-to-go-upmarket-and-grow-your-revenue-by-20x/) doesn't need to be such a struggle. If you're willing to slightly alter your sales strategy, you can quickly impress new clients and close enterprise deals.

Enterprise clients present three primary challenges to growing B2B companies:

1. **Legacy technology stacks**: Enterprises prioritize stability and often favor products from companies that have long histories in their industries.
2. **Intensive security demands**: Enterprises handle large volumes of data that make security breaches especially risky.
3. **Unique needs**: Enterprises have numerous stakeholders who need to be satisfied, some of whom will demand simplicity and others customization.

With Auth0's [_B2B federation_](https://auth0.com/b2b-enterprise-identity-management/), you can shorten the sales cycle with compatible infrastructure, ensure that the connections between your product and their employees are secure, and address their unique needs with custom configurations.

![Auth0 helps B2B companies grow](https://images.ctfassets.net/23aumh6u8s0i/76cbcjek9FIZY6nxQmvdZR/f0a096097a955ecfb53f099394e91092/b2b_1)

## Offer Compatibility Options to Shorten Your Sales Cycles with Enterprise Customers

The bigger an organization gets, the more internal and third-party tools — all potentially built on different stacks with different protocols — are likely to be in use. The person you're initially selling to might not even know all the infrastructure complications lying in wait.

A primary example is identity and access management (IAM) providers. Your ability to integrate with whichever provider your customers use can drastically shorten or lengthen the sales cycle. If they use Active Directory (and _[hundreds of thousands do](https://auth0.com/blog/analysis-of-enterprise-connections-data/)_), you'll need to implement that before you can close the deal.

If you let the sales cycle stretch out (already _[estimated at 3-6 months](https://saasmetrics.co/benchmark-for-b2b-saas-sales-cycles/)_ for deals that exceed \$100,000 in annual contract value), your internal advocate might move to a different position or company, or the benefits of your initial pitch might not remain relevant. Meanwhile, you might be losing out on other opportunities as you pay expensive developers to make your back end work with theirs.

Worse, if your next customer has a different back end, you'll have to do it all over again.

Auth0 offers B2B federation that _[integrates with 10+ IAM providers](https://auth0.com/blog/how-enterprise-federation-helps-shorten-the-sales-cycle/)_. With a few lines of code, you can configure any enterprise connection, including Active Directory, LDAP, ADFS, SAML, and more.

![Auth0 enterprise connections](https://images.ctfassets.net/23aumh6u8s0i/6HTuHDmDrVhGoM64N5W5VT/fbf838da10673560329d5dfcd92070f3/why-federation-is-your-secret-weapon-for-enterprise_auth0-enterprise-connections)

B2B federation provides the technical compatibility that makes your product more trustworthy and easier to use. By configuring your app with Auth0, you effectively configure it for numerous providers at once.

A sustainable [_enterprise sales strategy_](https://sapphireventures.com/oiling-the-enterprise-it-sales-engine/) builds from one company to the next, so you don't need to start over each time.

<include src="TweetQuote" quoteText="Auth0 offers B2B federation that integrates with 10+ IAM providers. Active Directory, LDAP, ADFS, SAML? Bring it on!"/>

## Show Enterprise Customers They Can Trust You

High-profile [_data breaches_](https://auth0.com/blog/what-is-a-data-breach/) have made enterprises increasingly risk-averse. To a wary enterprise, another partnership might seem like another vulnerability. New products, though they might be valuable, risk widening an enterprise's attack surface.

Enterprises are more likely than SMBs to have security and compliance teams that will take a critical look at your product. These teams need more than assurance. Their input for your service-level agreements will go beyond up-times and scalability and into strict security parameters and compliance standards.

If you provide federation through Auth0, however, maintaining security and compliance in the authentication process is much easier. Auth0 combines the simplicity of a federated identity provider with customizable security features. Your customers can enable tools like multi-factor authentication (MFA) and reinforce compliance procedures as necessary.

![Auth0 multi-factor authentication](https://images.ctfassets.net/23aumh6u8s0i/5zHCdntb8UHVwFG6QBnhd4/2b9f2ba4cfbcab1461b35f82e76d4e8c/why-federation-is-your-secret-weapon-for-enterprise_auth0-multi-factor-authentication)

With MFA, your enterprise clients know that access to sensitive materials won't be granted to anyone with a username and password. Despite these barriers to malicious access, administrators can approve requests easily across a variety of devices.

Guardian, Auth0's MFA application, also provides Mobile SDKs for [_iOS_](https://auth0.com/docs/multifactor-authentication/developer/libraries/ios) and [_Android_](https://auth0.com/docs/multifactor-authentication/developer/libraries/android) that enable you to build a white-labeled MFA application that matches a customer's branding.

Auth0 is compliant with a [_wide range of security, privacy, and compliance standards_](https://auth0.com/security/), such as HIPAA BAA, SOC 2 Type II, and PCI DSS, so you can demonstrate an understanding of your customer's industry-specific needs.

If you're competing with other products that have similar value propositions, the trust you build with enterprise customers can tip a decision in your favor. With Auth0 backing you, it's easier to address concerns from security and compliance teams. The faster and better you can satisfy these stakeholders, the closer you can get to completing a deal.

<include src="TweetQuote" quoteText="Auth0 is compliant with a wide range of security, privacy, and compliance standards such as HIPAA BAA, SOC 2 Type II, and PCI DSS that lets you cover your customer's industry-specific needs."/>

## Sell across Organizations with Single Sign on and Customization

Selling to an enterprise requires selling across levels and [_pleasing different parties_](https://www.copper.com/blog/enterprise-sales-prospecting). Your point of contact might be excited by the core value proposition, but the project managers might be worried about its execution. If all decision-makers aren't in agreement, a deal months in the making can fall apart.

Authentication can be a significant hurdle. IT staff, for example, might resist a new product if it threatens to increase their account-management workloads. Other stakeholders might resist the sheer addition of more credentials to memorize.

Single sign-on (SSO) can dispatch these concerns. With Auth0, employees will only have to enter their credentials once.

![Auth0 single sign-on](https://images.ctfassets.net/23aumh6u8s0i/51MTEF6y286lEpPFiuWMMC/5b67cb0f5643bb655fe06ddf981240cc/why-federation-is-your-secret-weapon-for-enterprise_auth0-single-sign-on)

Enterprises have a higher volume of users and tools, so the ability to sign on once is compelling.

Safari, a company that provides access for corporate learning materials, [_leveraged Auth0's SSO capabilities_](https://auth0.com/learn/safari-case-study/) to expand to enterprise customers. SSO cut support calls for account management without Safari having to dedicate specialized resources. They have since added numerous enterprise customers, differentiating their offering with easy authentication across desktop and mobile devices.

If you need to make integration and usage even smoother, Auth0 also provides customizable _[Rules](https://auth0.com/docs/rules)_. With this customization engine, you can make unique authentication and authorization stages for the customers that need it.

You can use Rules to assist migration by reusing information from existing databases, maintain a white list for particular users, notify systems of login attempts, and more.

## Moving Upmarket Requires a Renewed Strategy

Moving upmarket is more complicated than aiming your sales team at a different target. While you might be able to [_validate product/market fit_](https://www.intercom.com/blog/podcasts/the-myths-of-product-market-fit/) with smaller companies first, moving to enterprise clients requires significant planning.

Moving too fast can threaten your stability. A big contract might seem like a win at first, but without a [diverse customer base](https://www.inc.com/magazine/201606/jason-fried/saying-no-to-large-enterprise-customers.html), too much of your sustainability might hinge on a single large customer. If you shift your business to serve only a few clients, then your future belongs to those contracts—and that's a position no one wants to be in.

Closing deals with enterprise customers means closing the gap between a legacy provider's track record and your ability to meet the needs of your customer. The better you can tailor your product to their needs, the more you'll be able to _[shorten the sales cycle](https://blog.getbase.com/3-hurdles-slowing-sales-cycle)_ and build more valuable relationships for the long-run.

<include src="asides/AboutAuth0" />


Why Federation Is Your Secret Weapon for Enterprise

Three ways SMBs can invest in cybersecurity best practices that prioritize protecting sensitive data.



Many small business leaders believe their companies are safe from cybersecurity threats. In a [2017 study by Insureon](https://www.insureon.com/resources/research/small-business-cyber-security-poll), just 16% of 2,400 respondents were concerned about a cybersecurity attack — down from 18% the year prior. 

Small business leaders assume their teams are too small to be worthwhile targets — or that existing IT teams can handle external threats. In particular, startup founders must juggle numerous other priorities as they scale, like getting to product-market fit, hiring, and fundraising. If cybersecurity isn’t front of mind, it’s less likely the team will make a concerted effort to improve their current infrastructure.

Yet this lack of attention can be a fatal mistake. Hacking operations often use bots to [_crawl multitudes of sites_](https://www.sitelock.com/blog/2017/04/website-vulnerabilities/) looking for known vulnerabilities. In these situations, company size doesn’t matter. While security disasters at massive companies, such as [_Anthem and Target_](https://auth0.com/blog/4-security-measures-after-data-breach/), dominate headlines, startups, and the rest of the small-to-medium businesses often make easy prey because [_they devote fewer resources to defense_](https://www.bbb.org/globalassets/shared/media/state-of-cybersecurity/updates/cybersecurity_final-lowres.pdf)_._

How can small teams protect themselves when resources are low and other projects are vying for immediate attention? In this piece, we highlight three areas where startup and small business leaders can invest their time and money to secure their sensitive data and safely grow.

## 1. Secure your users from the start.

From the moment you begin hiring, safely and easily managing access to your technical systems becomes a challenge. Yet the pace of startup growth and the [_looming chance of failure_](https://www.godaddy.com/garage/startup-mistakes-4-startups-that-monumentally-failed-and-what-we-can-learn-from-them/) can make it difficult to spend time on credential management. 

A lack of a strong user management and authentication system, however, can sink you.

In Verizon's annual Data Breach Investigations report, they found that [63% of confirmed breaches](https://enterprise.verizon.com/resources/reports/2017/dbir-presentation-beltug.pdf) involved weak, default, or stolen passwords. A bad password doesn't threaten a single account. If users reuse passwords, one compromised account could lead to the loss of many other devices and systems. 

A solution like Auth0 provides [_multi-factor authentication_](https://auth0.com/multifactor-authentication) (MFA) that bypasses password vulnerabilities and enables admins to immediately approve login requests with a single click across a range of devices.

![Auth0 Guardian MFA authentication requests mobile and smart watch screenshots](https://images.ctfassets.net/23aumh6u8s0i/2WzftOPNUQiNo7UrxPClrO/f30cb0b18a1882b312362585c23f8c6d/auth0-guardian-mfa)

With MFA in place, users need a second piece of sensitive information, such as a thumbprint or facial scan, to access other systems. Hackers with only one set of credentials can't get any further. 

[Auth0 Guardian](https://auth0.com/multifactor-authentication) helps startups keep moving by ridding employees of pesky, single-use login codes. With push notifications, busy admins can approve or deny requests without ever having to open the app. Guardian also offers mobile Software Development Kits (SDKs), so that you can design your own MFA application that integrates smoothly with the rest of your company's branding.

## 2. Plan your response to attacks.

Unfortunately, [with data breaches on the rise](https://auth0.com/blog/what-is-a-data-breach/), you can’t afford to not plan ahead.

In 2017, the startup Kickico [found itself unprepared](https://medium.com/@kickico/how-they-tried-to-hack-our-ico-d348659dc4). They endured a wave of distributed denial-of-service (DDoS) attacks as hackers spoofed their site, cloned their platform on GitHub, and readied the clone to fool potential users once the original site went down. Luckily, the hackers appeared to run out of funds to keep up the DDoS attacks, and GitHub promptly responded to Kickico's request to block the attackers. 

Kickico wasn't ready, and admitted “We did not realize such a small and inconspicuous company without huge PR actions [would] attract any attention.”

Many startups are ill-prepared and subtle attacks can take much longer to detect. One study found that [over two-thirds of companies](https://enterprise.verizon.com/resources/reports/DBIR_2018_Report_execsummary.pdf) took months or longer to discover a breach—even though those breaches took mere minutes to accomplish. 

Startups can build in preparedness with tools that offer [breached password notifications](https://auth0.com/breached-passwords), so that you know about leaked credentials instantly, and can even lock out users until they reset their passwords. 

![Auth0 anomaly protection Dashboard brute force protection enabled](https://images.ctfassets.net/23aumh6u8s0i/1dU6iYAvPdzS7ZM8HcK2RA/44ebc4556fcf622399d699338f3383f9/anomaly-detection-overview)

With anomaly detection in place, startups can also set limits on brute force logins before they happen, establishing a baseline level of preparedness. 

These cybersecurity best practices can buttress a [data breach response plan](https://auth0.com/blog/data-breach-response-planning-for-startups/), which prepares startups to react as quickly as possible to a breach. Rather than taking it alone, startups should form relationships early on with law, public relations, and incident response firms that are familiar with data breaches. Once you detect a breach, you can follow the plan and leverage the experts to recover as quickly and fully as possible. 

Data privacy laws are also increasingly [taking breaches more seriously](https://auth0.com/blog/get-ready-for-gdpr/), requiring faster responses and imposing stiffer penalties. A well-thought-out data breach response plan, informed by automatic detection, is only going to become more necessary.

<include src="TweetQuote" quoteText="Many startups are ill-prepared to tackle cybersecurity attacks and subtle ones can take too long to be detected. One study found that over two-thirds of companies took months or longer to discover a breach."/>

## 3. Guard against web-based attacks.

Your website is like your company's front door, yet hackers have thousands of ways in. [Forty-nine percent of cyber attacks](https://www.cyberreadinessinstitute.org/cyber-readiness-news/small-and-mid-sized-businesses-cyber-threats-by-the-numbers) are web-based, and [44 attacks per day](https://smallbiztrends.com/2018/03/sitelock-website-security-insider-q4-2017.html) strike the average small business site. 

Web security depends on more than the connection between two entities. Data [goes through third parties](https://auth0.com/blog/using-https/) to get where it needs to go, so authentication at all stages is central to secure communication. 

If the [right communication protocols](https://auth0.com/blog/common-threats-in-web-app-security/) aren't set, transmitted information can become vulnerable to so-called man-in-the-middle attacks. HTTP, an application protocol you've likely seen in many URLs, is historically focused on sending information, not securing it. 

HTTPS, a newer protocol with security built in, makes attacks much harder to accomplish. HTTPS adds Transport Layer Security, or TLS, which ensures a client is only communicating with the expected server and that all data passed between is encrypted. 

Using an [HTTP Strict Transport Security](https://developer.mozilla.org/en-US/docs/Web/HTTP/Headers/Strict-Transport-Security), or HSTS, header reinforces HTTPS across your web application by telling browsers your site can only be accessed through HTTPS. Even if users have an older version bookmarked or type http://, an HSTS header forces browsers and applications to use HTTPS instead. Hackers won't be able to access the encrypted information, steal your site's cookies, or force a redirect to a spoofed site. 

Auth0 [enforces HTTPS connections](https://auth0.com/blog/a-run-through-the-owasp-top-10/) to all of its services, which means any non-HTTPS connections will be upgraded. 

Startups have to use their limited resources judiciously, but in the same way, a new restaurant wouldn't skimp on locks, neither should startups ignore these web security best practices. 

## Security on day one

Poor cybersecurity is technical debt. These shortcuts can keep a company moving but compound over time, eventually becoming expensive burdens. You can wait on establishing good cybersecurity procedures, but hackers won't. The longer you take to make security a priority, the harder it's going to be to retroactively protect yourself. 

Cybersecurity is an investment in the sustainability of your company. Growth without cybersecurity best practices in place is [growth for the benefit of hackers](http://blog.idonethis.com/security-ringcaptcha/) seeking a big payout.  

Start by addressing one of your primary vulnerabilities: identity. With an outsourced provider like Auth0, you can scale security with user growth, form an informed threat response plan, and build a secure login environment. Investing in security early will keep you safer and better-informed when it matters most.

<include src="TweetQuote" quoteText="Cybersecurity is an investment in the sustainability of your company. Growth without cybersecurity best practices in place is growth for the benefit of hackers seeking a big payout."/>

<include src="asides/AboutAuth0" />


How SMBs can Improve Cybersecurity for their Customers

37590801?s=460&v=4

A software engineer who dreams about non-electric sheep and autonomous vehicles and likes to champion security.

Software Engineer

Dan Arias

Help your customers fall in love with your application by providing a secure and easy authentication experience they don't have to remember.



Ah, Valentine's Day! Love is in the cloud. Billions of people are either signing up for or logging in to web services to wish their loved ones a happy day. They are ordering flowers, buying chocolates, or sharing the most intimate of thoughts through messages. Building scalable authentication the right way to sustain spikes in demand can leave developers with a heavy heart. 

However, Auth0 can help you prepare for the best and the worst today and every day. Let me show you why using Auth0 can make you fall in love with authentication through these solid Auth0 features that make modern authentication a walk in the park.

## <a class="toc-target" id="single-sign-on-will-keep-us-together"></a>Single Sign-On Will Keep Us Together

According to the [2018 World Password Survey run by MacAfee](https://securingtomorrow.mcafee.com/consumer/consumer-threat-notices/security-world-password-day/), consumers who responded to the survey have an average of **23 online accounts** that require a password but **on average only use 13 unique passwords** for those accounts. With so many passwords to track, forgetting a password is common.

Going through the motions of resetting a password can bring some heartache... Imagine if one of the "Challenge Questions" is asking you about the favorite vegetable of your ex. However, not being able to recover the account or getting it compromised can truly unleash the worst of heartbreaks. 

This all could be alleviated if we only needed to remember one username and one password, right? Find _the_ one and be forever happy with easy access to all of our accounts. This sounds like a fairy tale but it's not. Fortunately for us, Password Charming exists in the form of **Single Sign-On**. 

Single sign-on (SSO) allows users to simply log in once and use all applications they have been granted access to. You could use your Google account to authenticate yourself with a dating site or any other application that decided to delegate the responsibility to create, maintain, and protect your username and password to Google.

![Single sign-on example login authentication in action](https://images.ctfassets.net/23aumh6u8s0i/7cMIHIB6DD65M59E8b60JU/3e95a93f4bd9fd5d532a890de2b5b49f/auth0-single-sign-on-flow)

Building and maintaining an identity platform with Single Sign-On can become expensive, time-consuming, and difficult to get right &mdash; just like love. In a [recent survey](https://auth0.com/forrester-total-economic-impact/), 94% of organizations said they were able to implement Auth0 in less than a month. That is possible because with Auth0’s SSO solution you get:

* [Over 40 supported Identity Providers](https://auth0.com/docs/identityproviders) including mainstream social providers such as MySpace. Kidding!

![Auth0 has built-in identity providers such as Facebook, Twitter, Google, GitHub, LinkedIn, Dropbox, and many more.](https://images.ctfassets.net/23aumh6u8s0i/6oH8TXss4ErZM3RzJ9n7Rp/d31d514b9368daa63782d5a4da15fafb/new-grid-02b)

* The ability to authenticate the social butterfly by consolidating duplicate accounts across various providers with account linking &mdash; while [increasing conversion rates](https://auth0.com/retail/).

* Ease of use by having the freedom to write your code once and integrate any configured connection. One login screen to rule them all.

* Like meeting the expectations of even the strictest of parents, [compliance with leading organizations including SOC2, GDPR, HIPAA, and others](https://auth0.com/docs/compliance). 

[Let Auth0 help you get SSO right today](https://auth0.com/single-sign-on) to help your customers fall in love with an amazing authentication user experience. Don't let any customer be the one that got away because he or she forgot to remember you.

## <a class="toc-target" id="rules-to-love"></a>Rules to Love

Relationship needs are not static. They change as the relationship grows... or dwindles. Authentication is one of the most critical relationships you'll ever form with your customers. This process helps you understand who they are and how you can help them based on an established and ongoing relationship around identity. Therefore, authentication needs to be extensible, flexible, and customizable.

With Auth0 Rules, you can customize your authentication workflow. Auth0 Rules are JavaScript functions that execute when a user authenticates to your application. They run once the authentication process is complete. You can use them to customize and extend Auth0's capabilities.

### Use Auth0 Rules to:

* Enrich user profiles: query for information on the user from a database/API, and add it to the user profile object.

* Create authorization rules based on complex logic (anything that can be written in JavaScript).

* Reuse information from existing databases or APIs for migration scenarios.

* Keep a white-list of users and deny access based on email.

* Notify other systems through an API when a login happens in real-time.

* Modify tokens: Change the returned scopes of the Access Token and/or add claims to it, and to the ID Token.

[Let Auth0 help you rule the authentication game today](https://auth0.com/docs/rules). 

## <a class="toc-target" id="universal-login-one-form-one-heart"></a>Universal Login: One Form, One Heart

One of the easiest ways to improve your customers’ experience while boosting security is through consistency. Imagine that each login form in your application is a physical door. If the look and feel of this door are not consistent throughout the application, your customers' user experience when logging in may look like this:

![Doors metaphorically representing the UX and UI of an app's login form flow.](https://images.ctfassets.net/23aumh6u8s0i/4qZC52zb2rkifVRgofbtvh/1f1e5140952a12c0126b8b456ef6c6f6/valid-doors-valid-login-forms)

Each door that represents a login form looks different. They are all valid entryways for the customer's credentials, but your customer can't anticipate what the login form should look like. This inconsistency can let a malicious actor to phish your customers. Here’s how:

![Invalid door metaphorically representing introduction of a phishing login form.](https://images.ctfassets.net/23aumh6u8s0i/7govsBdLttTOlrwwqEEKTN/668dacccd29c76629deb2b79727aa68c/invalid-door-invalid-login-form)

The attacker creates a site and requests your customers' login. If your login forms are inconsistently designed, for your customers, the brown door may just signal a new form design. They could easily enter their credentials there expecting access to your application &mdash; and just like that, they become phishing victims.

To help protect your customers, a consistent authentication UX and UI helps them better identify when a phishing attempt may be happening. Say that you opt for all of your login forms to look like the yellow door. Now it's much harder to trick one of your customers:

![Consistent app UX and UI of login flow/forms helps to recognize a phishing form.](https://images.ctfassets.net/23aumh6u8s0i/5nckAsKhcjZUvSGITOUnGX/1c7ebfca7a4618e415084e5492071596/consistent-valid-door-design-consistent-valid-login-form-design)

The universal design and implementation of the login makes your customers expect one, and only one, form for their credentials. Anything different must be rejected.

Auth0 offers you an easy way to build this unique door for your customers through **Universal Login**. Anytime your customers need to log in, they are redirected to a central authorization server that presents them with a login form that embraces your brand. Since authentication takes place on the same domain as the login, credentials are not sent across origins, increasing security and protecting against phishing and bucket brigade attacks, also known as man-in-the-middle (MITM) attacks.

Universal Login and SSO also happen to be a match made in heaven. You can orchestrate single sign-on (SSO) between multiple apps. If the user has already signed on to one app, the login page will not be shown again and the user will be logged in via SSO.

Play this video to see it in practice!

<AmpContent>
<amp-video controls
  layout="responsive"
  width="480" height="270">
  <source src="https://videos.ctfassets.net/2ntc334xpx65/67t8nyR02cUssAmCmsaiE6/4abf027ac21be3f56b0c16854b5bcd5e/sso_new_diagram_video.mp4"
    type="video/webm" />
</amp-video>

</AmpContent>

<NonAmpContent>

<video controls="controls">
  <source src="https://videos.ctfassets.net/2ntc334xpx65/67t8nyR02cUssAmCmsaiE6/4abf027ac21be3f56b0c16854b5bcd5e/sso_new_diagram_video.mp4">
   Your browser doesn't support HTML5 video. Here is a <a href="https://videos.ctfassets.net/2ntc334xpx65/67t8nyR02cUssAmCmsaiE6/4abf027ac21be3f56b0c16854b5bcd5e/sso_new_diagram_video.mp4"> link to Universal login and SSO</a> instead.
</video>

</NonAmpContent>

Love and security are based on trust. Don't let phishing steal your customers' trust in your design or implementation.  You can [get started with Universal Login from Auth0 today](https://auth0.com/universal-login).

## <a class="toc-target" id="multi-factor-authentication-are-you-the-one-for-me"></a>Multi-Factor Authentication: Are You the One for Me??

![Are these images of actress Jaime Pressly or Margot Robbie?](https://images.ctfassets.net/23aumh6u8s0i/2PqNgYrJVTbFlgEJprLfkb/810a1cf582f03290460a72b1145405ef/margot-jaime)

[Left image source: Gage Skidmore](https://en.wikipedia.org/wiki/Margot_Robbie#/media/File:Margot_Robbie_by_Gage_Skidmore.jpg)

Pictured above are _two_ different and unique women. One of them is [Jaime Pressly](https://www.imdb.com/name/nm0005326/) and the other one is [Margot Robbie](https://www.imdb.com/name/nm3053338/). If someone gives you the picture of one of them and tells you to hand her a super secret script for an upcoming Spider-Woman movie, would you be able to tell them apart?

It would be very difficult. Even if you were to ask one of them for their name... What if Margot, jokingly, says her name is Jaime. You need to ask more questions to establish their identity and not make the mistake of giving the prized script to the unintended person. 

Authenticating users is just like that. If you want to have greater confidence that you are granting data access to the right person, multi-factor authentication is for you.

Multi-factor authentication (MFA) is a method of verifying a user's identity by requiring them to present more than one piece of identifying information. This effectively provides an additional layer of security, decreasing the likelihood of unauthorized access. The type of information required from the user is typically two or more of the following:

* Knowledge: Something the user knows (such as a password)
* Possession: Something the user has (such as a mobile device)
* Inheritance: Something the user is (such as a fingerprint or retina scan)

The complexity of getting MFA right keeps developers from implementing it in their applications. However, with Auth0, enabling MFA for your application is a fairly straightforward process:
 
* Choose what factors to enable on your application, such as push notification.

* Perform any further setup required to configure that factor.
 
* Choose whether or not you wish to enforce MFA for all users.

![Auth0 Multi-Factor Authentication dashboard with different factors to enable](https://images.ctfassets.net/23aumh6u8s0i/76dOMSouGVa1RG4sZHWMIl/fb3c361a75713719bef1665bc9ba185d/mfa-dashboard-1)

With Auth0 Rules, as you learned earlier, your application's MFA experience can be customized. You can only require MFA in specific circumstances or force a particular factor to be used. When in doubt, always ask: is he or she the one to log in?

Catfishing? Ain't nobody got time for that! Don't let doubt erode your confidence and increase your risk of leaking data. Love, trust but verify. [Give Auth0 Multi-factor Authentication a try today](https://auth0.com/docs/multifactor-authentication).

## <a class="toc-target" id="anomaly-detection-trouble-in-paradise"></a>Anomaly Detection: Trouble in Paradise

> You know that I trust you, baby
>
> But your data's so good lookin'
>
> I'm afraid somebody's gonna steal it away from me.

We know that most of the time it's your customers who are authenticating into your application, but we also know that their data is beautiful and attractive to many malicious users out there. They will try to pretend to be your customer by deception or by force.

Legitimate users may try to log in three or five times if they have forgotten their password but are trying to remember it:

> Was it `correcthorsebatterystaple` or `confectcoarsewaterymaple`?

Ten failed consecutive attempts to log in are definitely a red flag. If the legitimate user is so pressed to log in, they will resort to resetting their password as soon as possible.

With Auth0, you can detect anomalies and stop malicious attempts to access your application. Auth0 offers two types of shields:

* Brute-force protection
* Breached password detection

![Auth0's Anomaly Detection dashboard](https://images.ctfassets.net/23aumh6u8s0i/17r5rvTrkVXqzAgA1v6WM1/724776f473b2c765614f0efaf0ac4ea6/anomaly-detection-overview)

A shield specifies the action you wish to take given a specific trigger. A trigger is a suspicious event that is detected when someone is trying to log in to your system, or they are using a breached password that has been reported by another third-party service.

**Brute-force protection is enabled by default for all connections**. There are two different triggers for the brute-force protection shield, for two slightly different attack scenarios:

* 10 consecutive failed login attempts for the same user and from the same IP address
* 100 failed login attempts from the same IP address in 24 hours or 50 sign up attempts per minute from the same IP address

Auth0 tracks large security breaches that are happening on major third-party sites to help keep your users and systems secure. By enabling breached password detection, when a trigger occurs, your users can be notified and/or blocked from logging in if we suspect their credentials were part of a published security breach. **Auth0 never blocks the user itself, just the attempts from the suspicious origin**.

Is love knocking at your door or is it a brute force attack? [Integrate Auth0's anomaly detection in your application today](https://auth0.com/docs/anomaly-detection) to mitigate bad actors from forcing themselves into the heart of your data.

## <a class="toc-target" id="happy-valentines-day"></a>Happy Valentine's Day

Let Auth0 be the final piece that helps you build a secure and seamless user authentication experience that your customers will love to use. <a href="https://auth0.com/signup" data-amp-replace="CLIENT_ID" data-amp-addparams="anonId=CLIENT_ID(cid-scope-cookie-fallback-name)">Get started with SSO, MFA, Universal Login, Anomaly Detection, and Rules for free today</a>!

![Auth0 Features to Fall in Love With - SSO, Rules, and More](https://images.ctfassets.net/23aumh6u8s0i/7fRVnuSnZAQva1b4YwQP0P/6f3f16fb671fecefb1cfd08e28dd40af/auth0-the-final-piece-in-authentication-to-fall-in-love-with)

<include src="asides/AboutAuth0" />


"mfa"