auziros:jeana-tahnk

Jeana has been in the tech industry for 15+ years, both as a communications professional and writer. As Director of Global Communications at Auth0, she works with her internal team and external agencies to amplify the company's visibility worldwide and establish its leadership in the identity industry. When she is not working, she can most likely be found on a field watching one of her three kids playing sports, or cleaning up after her one-year-old retriever who chews everything.

Senior Director, Global Communications

Jeana Tahnk

Breached Password Detection and Multifactor Authentication Critical for Prevention

**BELLEVUE, Wash., November 18, 2019 —** The [Auth0](https://auth0.com/) Identity Platform, a product unit within Okta, today revealed data insights showing the staggering amount of credential stuffing attacks attempted on its platform on a daily basis. Auth0 detects attacks from more than 50,000 unique IP addresses every day, reflecting the growing sophistication and frequency of cybercrime. Credential stuffing attempts are constantly multiplying, with absolutely no slowdown in sight.

The sheer number of attempts is due largely to the ease and inexpensive manner in which credential stuffing attacks can be orchestrated. Getting access to breached passwords is the first step for attackers, and unfortunately, there are billions openly available on the internet. Auth0's database contains more than one billion breached email/password combinations which are used for its [Breached Password Detection](https://auth0.com/breached-passwords) feature, the first line of defense against credential stuffing. Breached credentials, in combination with 65% of people [reusing passwords across accounts](https://services.google.com/fh/files/blogs/google_security_infographic.pdf) (Google), enables hackers to architect botnets — networks of exploited devices — to direct large-scale attacks in a coordinated manner.

Whereas targeted attacks have a specific and designated entry in mind, large-scale attacks like credential stuffing are automated and intended to attack as many entry points as possible. There is also a proliferation of 'botnets-for-hire' where services are traded among hackers, even rented for nominal fees for use in widespread attacks. And their destruction can oftentimes go unnoticed because these botnets steal insignificant amounts of money from services (like Spotify or Netflix) that actually add up to billions of dollars every year.

Between July and September 2019 alone, Auth0 determined that during a credential stuffing attack, traffic for a particular website may surge as much as 180x the usual volume, with traffic related to the attack itself accounting for 70% of overall activity.

"Unfortunately, it has become very easy and cheap for bad actors to quickly rotate the IP addresses used in an attack. Nearly all of the attacks we detect appear to originate from botnets," said Matias Woloski, CTO and co-founder of Auth0. "Many major brands have fallen victim to credential stuffing attacks this year — causing a significant impact on IT resources, account takeovers, and brand reputation. Even the largest companies are vulnerable if they don't have the right preventative measures in place." 

Auth0 is at the front door to stop credential stuffing attacks. [Breached Password Detection](https://auth0.com/breached-passwords) (part of Auth0's [Anomaly Detection](https://auth0.com/learn/anomaly-detection/)), with its internal database of more than one billion breached passwords, enables customers to block user accounts that try to login with compromised information, and only grants access when the password has been reset. This is instrumental in blocking credential stuffing attacks, since hackers rely on people reusing email and password combinations that have already been breached.  

In addition, [Multifactor Authentication](https://auth0.com/multifactor-authentication) (MFA) is one of the best ways to prevent account takeovers, whether from a credential stuffing attack or something else. In order to compromise an MFA-protected account, attackers would need to access not only a set of breached credentials used across accounts, but also the device used for the second factor. Combatting MFA drastically increases the time and effort needed for bad actors to compromise an account, which makes it infeasible to do at scale. Auth0 is working on additional features to reduce the perceived friction end users experience when MFA is implemented.

"Breached Password Detection and MFA functionality are the critical barriers for preventing credential stuffing attacks. We are continuously improving our features to detect and prevent, and will be rolling out new functionality to have even greater visibility into attacks," added Woloski.

<include src="asides/AboutAuth0" />

### Media Contacts

Alex Plew 
Matter for Auth0 
auth0@matternow.com 

Deepika Zafar 
Racepoint Global for Auth0, EMEA 
auth0@racepointglobal.com

Auth0 Reveals 50,000 Unique IP Addresses Make Credential Stuffing Attempts on Daily Basis

df6c864847fba9687d962cb80b482764?size=200 avatar

df6c864847fba9687d962cb80b482764?size=200

Martin Gontovnikas, a.k.a Gonto, is a software engineer at heart who moved to the ‘dark side’ and became VP of Marketing at Auth0. He considers himself lucky to have found a way to combine his two passions and apply his engineering thinking model to marketing. Gonto’s analytical thinking is a huge driver of his data-driven approach to marketing strategy and experimental design. He is based in the Bay area, and in his spare time, can be found eating gourmet food at the best new restaurants, visiting every local brewery he can find, or traveling the globe in search of new experiences.

Former SVP of Marketing and Growth at Auth0

Martin Gontovnikas

Multifactor authentication and social login are just two of several tools that Auth0 offers on its platform to guard its customers against breaches.

The number of attacks on individuals' data is astounding. From the [Equifax breach](https://www.washingtonpost.com/news/the-switch/wp/2018/03/01/equifax-keeps-finding-millions-more-people-who-were-affected-by-its-massive-data-breach/?noredirect=on&utm_term=.4bbb572bb730) that continues to worsen to attacks on high-tech companies like [Uber](https://www.wired.com/story/uber-paid-off-hackers-to-hide-a-57-million-user-data-breach/) — it seems as if no one is immune to cybercrime. 

Several common threats exist to web apps:

* XSS (cross-site scripting), when malicious scripts are injected into otherwise trusted web applications
* Clickjacking, which happens when an attacker introduces transparent or opaque objects into your web application
* Cross-site request forgery, in which an attacker impersonates an authorized user and makes requests on their behalf, like resetting a password.

And it doesn't stop there. These threats are constantly evolving. As soon as IT teams and experts root out dishonesty, it seems like the criminals pivot to find a new path. 

So what can you do, now, to secure your user database in this difficult landscape?

<include src="TweetQuote" quoteText="What can you do to secure your user database when there are so many threats like XSS, Clickjacking, Cross-site request forgery, etc?"/>

This piece will offer concrete tools and approaches for keeping your customers safe and help you build a solid technical foundation on which to scale. 

## Why Is Your User Database At Risk?

A major reason that user databases are at risk is inherent software vulnerability. For example, Apache servers have historically been exposed to the [Heartbleed](http://heartbleed.com/) bug. Heartbleed is unique to OpenSSL (the data encryption technology used by a huge chunk of the internet) and allows attackers to intercept vulnerable information between one's browser and computer. 

If you're entering a password or payment information into a browser, for example, although this data will be encrypted during the transfer to the computer on one level; a second connection, often described as a “heartbeat” between the browser and computer can be intercepted.

![The heartbleed bug](https://images.ctfassets.net/23aumh6u8s0i/7bi6p1IFj7zJXCTzoN17S5/2dc69f99ed1d1efc1ce92a3c6738fdaf/the-heartbleed-bug)

([Source](https://www.youtube.com/watch?v=WgrBrPW_Zn4))

The Heartbleed bug manipulates the secret keys that the browser and computer use to encrypt the names and passwords of the users, along with other sensitive content. In vulnerable versions of OpenSSL software, hackers can break in and steal data directly from the services and users. You can read more about it on the [Heartbleed website](http://heartbleed.com/). 

### Why Not Just Patch The System?

If you find holes or vulnerabilities in your system, why not just fix them up and continue with business-as-usual? 

First, taking a user database offline creates downtime for a business. This can result in frustrated users who enjoy and rely on your service. Down the line, it can lead to a loss in revenue. 

Patching software is also risky. Particularly if you work with a lot of sensitive customer information, such as [financial transactions](https://auth0.com/blog/how-two-factor-authentication-can-help-financial-institutions-reduce-data-breaches/), making changes to a software library can break critical processes, leaving your users out to dry with payments incomplete and exposed. 

In some dire cases, such as a medical facility, it could truly be a matter of life and death if your system, full of patient data, shuts down (even temporarily). 

## A Better Solution: Secure Your User Database With Auth0 Identity Tools

Outsourcing your cybersecurity needs, particularly for a user database, can be an excellent solution. Only a few teams have the in-house capability to build and customize cutting-edge tools without support. Particularly if your company is constantly growing and changing as it should — you need to both brace your systems against attackers and make them flexible enough to allow you to scale. 

Auth0 has [several tools](https://auth0.com/why-auth0) to help you do this.

### Content-Aware MFA Technology

Amid the many features that Auth0 offers customers on its universal authentication and authorization platform, [multifactor authentication (MFA)](https://auth0.com/docs/multifactor-authentication) helps ensure that only the right users gain access to your system. Even if a hacker obtains a user's login credentials, s/he still needs a second piece of information, such as the user's thumbprint or mobile device, to make it through. 

It's simple to add MFA to your app. For example, if you want to add the Google Authenticator, which provides a six to eight digit one-time password to users as an alternate token, you can turn this on by first visiting Auth0's [Multifactor Auth](https://manage.auth0.com/#/guardian) page from the dashboard. 

![Auth0 multifactor authentication feature](https://images.ctfassets.net/23aumh6u8s0i/2ZuIZT9aZzbLGoaygmQljD/5704c74279f0f95fb04e3ee6de2ec85a/auth0-multifactor-authentication)

If you want to use a different provider like Duo, just click on the link to switch. You can then select if you want your users to receive the password via a push notification or SMS. 

While MFA is proven to reduce breaches of user databases, few organizations have successfully integrated it. Why? Making the 2FA setup simple for customers is a challenge. Even advanced services like [PayPal](https://www.paypal.com/us/smarthelp/article/how-do-i-enable-2fa-(two-factor-authentication)-for-my-paypal-powered-by-braintree-user-faq3500) have made users opt-in through a lengthy process that entails their first logging into a control panel, navigating to their account, and then independently enabling 2FA with a QR code or another supported app.

Auth0 can help you figure out ways to integrate and communicate MFA capabilities for your users in a more seamless and self-aware way. Visit our [business blog](https://auth0.com/blog/business/) for further resources.

### Social Login Integrations

You can also build robust profiles of all of your users using Auth0's [social login functions](https://auth0.com/learn/social-login/). Social login allows users to register and access your app by connecting via a provider like Facebook.

Auth0 supports over 30 social providers, including Facebook, Twitter, Google, Yahoo, Windows Live, LinkedIn, GitHub, PayPal, Amazon, VKontakte, Yandex, Basecamp, Box, Salesforce, and more.

![Auth0 social login integrations](https://images.ctfassets.net/23aumh6u8s0i/3SndDrKq0SuzoeXOcEt6Bb/08882aef7d9d6b36f48aa6d516b5300f/auth0-social-login-integrations)

In addition, you can add any OAuth2 Authorization Server you need. To enable social login, just click Connections and then Social in the Auth0’s Management Dashboard, then flip on the switch of the social network provider you'd like in the app(s) of your choice.

The advantages of social login are numerous. A few are:

* You know your users are verified since the social provider is already responsible for verifying the user’s email. 
* If you want to double check an individual, you can immediately access information such as their interests, location, connections, and more to make sure the account is real. 
* This data can also go a long way towards underpinning new marketing and product tactics.

You can take this a step further and build even richer customer profiles by integrating with a provider like [Clearbit](https://blog.clearbit.com/avoid-tedious-signup-forms-with-auth0-and-clearbit/). Clearbit sharpens customer intelligence, allowing teams access to valuable public information that can help them outperform.

## Why Auth0?

Outsourcing your user database needs allows you to turn over these critical tasks to experts, who are up-to-date on the latest trends and are keeping pace with evolving threats. An identity services provider like Auth0 doesn't have to balance these tasks with regular maintenance projects like most IT teams do. 

<include src="TweetQuote" quoteText="Outsourcing your user database needs allows you to turn over these critical tasks to experts, who are up-to-date on the latest trends and are keeping pace with evolving threats."/>

Auth0's user database tools support all major industry standards such as SAML, OpenID Connect, JSON Web Token, OAuth 2.0, OAuth 1.0a, WS­-Federation and OpenID, preventing vendor lock-in.

If you're looking for a quick solution to help you come into [GDPR](https://auth0.com/gdpr) compliance — as part of a larger customer identity and access management (CIAM) platform — MFA and Social Login will support your getting there in an efficient manner.

If you are just starting out or [modernizing](https://auth0.com/app-modernization) legacy apps from years of prior use, integrating tools to protect user identities from the outset will build a solid foundation for your products for years to come.

Use Auth0 Tools To Securely Manage Your User Database

Passwordless and Multifactor Authentication motivate companies to shift their approach to customer logins.

**BELLEVUE, Wash. -- July 9, 2018 --** [Auth0](https://auth0.com), a global leader in Identity-as-a-Service (IDaaS), today announced key findings on how companies are approaching the Customer Login Experience as new technologies like Passwordless, Multifactor Authentication, and social login options become more prevalent. According to anonymized data collected in May from a large sampling of Auth0 customers across all verticals, including financial services, media, retail, transportation, SaaS, and more, Auth0 found that companies are eager to embrace and adopt methods for streamlining the login process, suggesting that we should see an increase in passwordless usage in the near future. 

The emergence of [FIDO 2.0](https://fidoalliance.org/specs/fido-v2.0-rd-20170927/fido-overview-v2.0-rd-20170927.html) and [WebAuthn](https://auth0.com/blog/introduction-to-web-authentication) have encouraged more companies to take the leap into a passwordless future. Auth0’s customers are leading the charge, with 19.4 percent already using its [Passwordless](https://auth0.com/passwordless) feature, allowing developers to easily enable sign-in to apps without the need for passwords – a feature that Auth0 has offered since 2015. 

> Learn more and [try a WebAuthn demo crafted by Auth0, here](https://webauthn.me/).

The shift toward passwordless is a strategic one, considering that password changes are quite common for Auth0’s customers that use traditional username/password as a login method. Customers in the staffing & recruiting industry see 48.2 percent of their customers requesting a password change, followed by transportation (39.8 percent), federal (23.0 percent), and financial services (18.6 percent), the most common reason being forgotten passwords. “Gartner predicts that, through the end of 2020, enterprises that invest in new authentication methods and compensating controls will experience 50 percent fewer identity-related security breaches than peers that do not (Gartner).”[1](#myfootnote1)

As the industry evolves to a possibly passwordless future, the current state of the industry still finds a predominant use of passwords as the primary means of logging in. Before making the leap into passwordless, many companies have implemented [social login](https://auth0.com/learn/social-login) as an easier way to consolidate secure logins. 
 
Auth0 provides support for 30+ social providers, which 72 percent of its customers take advantage of, easing the login process for their users. The top five most widely used social login sites for Auth0 customers are: Google (60.3 percent), Facebook (24.1 percent), LinkedIn (8.8 percent), GitHub (7.1 percent), and Windows Live (6.8 percent). These percentages may shift in coming months based on recent news about how Cambridge Analytica handled Facebook data, which is a [cautionary tale](https://auth0.com/blog/cambridge-analytica-and-facebook/) for organizations about the implications of data breaches. 

With the prevalence of passwords still being used, the best way to protect identity credentials is to employ a feature like [Multifactor Authentication](https://auth0.com/multifactor-authentication) (MFA), which only 11.4 percent of Auth0 customers currently provide to their users. Of these customers, the top three industries consist of healthcare, manufacturing, followed by government. Adoption rates of MFA are on the low end due to the perception of added friction it supposedly creates for users, but it’s a critical feature for stopping phishing attacks, as well as decreasing the probability of getting hacked. In addition to this essential security layer, customers are relying on additional risk-based MFA that accommodates factors such as geographic location, IP filtering, type of device, which is a huge benefit with today’s global workforce. 

“The login experience is continually changing based on user demand and the need to protect against today’s sophisticated cybercriminal landscape. Passwordless is a signal of the kind of industry change we are all heading toward,” said Martin Gontovnikas, VP of Marketing and Growth at Auth0. “The insights we continually gather from our fantastic in-house data team fuel the continued innovation of our platform so customers stay several steps ahead in this constantly changing industry.” 

<a name="myfootnote1">1</a>: [Gartner Smarter with Gartner, Aim for a Workable Password Policy, Not a Perfect One October 9, 2017](https://www.gartner.com/smarterwithgartner/aim-for-a-workable-password-policy-not-a-perfect-one/)

<include src="asides/AboutAuth0" />

### **Media Contact:**

Jeana Tahnk 
Corporate Communications 
Auth0 
[jeana.tahnk@auth0.com](mailto:jeana.tahnk@auth0.com)

Kasia Hall 
Matter for Auth0 
[khall@matternow.com](mailto:khall@matternow.com) 
971-246-7898

Momentum Building for a More Streamlined Customer Login Experience, According to Auth0

Add Extra security to your company's Data without giving up the mobility your employees expect.

When is the last time you saw a jewelry shop protect their diamonds with a simple lock and key? Even before extra layers of security like alarms, motion detectors, and [biometrics](https://en.wikipedia.org/wiki/Biometrics) were invented, jewelers hid their diamonds and even put out fakes to deter criminals. 

In your company, data is as valuable as those diamonds — so why are you protecting it with a [simple username and password?](https://auth0.com/blog/modern-authentication-for-your-clients-made-easy/;)

Passwords are the keys that access your company's data, but like the traditional lock and key, any mediocre cybercriminal can easily decipher your password. In fact, it's now possible for your mother to easily hack your Facebook account.

![Your mom can hack your Facebook account.](https://images.ctfassets.net/23aumh6u8s0i/5Jkvtw1v3sCHI5g73P2Jrb/856a27a1a2c9ed202895e1b24e098a19/facebook-account-Password-Hacker)

Technology enables hackers to test billions of password combinations per second, exposing [_90% of all passwords_](http://www.telegraph.co.uk/technology/news/9802062/90-of-passwords-vulnerable-to-hacking.html). Facebook realized this when they [discovered](http://www.businessinsider.fr/us/90-percent-of-passwords-vulnerable-to-hacking-2013-1/) 600,000 imposters were attempting to access users' personal information every day using stolen passwords.

Companies like LinkedIn, Google and Twitter decided that they needed extra layers of security to strengthen passwords and protect their users' data. The solution: two-factor authentication (2FA).

<include src="TweetQuote" quoteText="Even your mom can try hacking your Facebook account."/>

## Two-Factor Authentication Adds the Extra Security You Need

If you have logged into Facebook, Twitter, or Google within the past few years, you have come across two-factor authentication.

Two-factor authentication (2FA), sometimes referred to as [multifactor authentication](https://auth0.com/learn/multifactor-authentication/), is a method used to verify a user's identity when they are trying to access an application. In addition to a password, 2FA requires you to provide a second piece of information to confirm your identity.

The first step is to sign into your account with a username and a password. This is the first factor of the two-step process.

![First factor of two-factor authentication: username and password.](https://images.ctfassets.net/23aumh6u8s0i/8KlwIklqafMi98LgppRJQ/8cf66446ba2f526fae327d3587875073/Gmail-login-procedure-email-and-password)

Unlike the ineffective security questions such as your mom's maiden name or your school's mascot, the second piece of information used in 2FA is extremely hard for cybercriminals to acquire. The idea is to create a second factor that is unique to the user, which is often something they possess, like a smartphone, or even something biological, like a fingerprint.

After you enter your credentials in step one, you will be prompted to add the second factor. There are several pieces of information that can be used, which we'll share below. In this case, the user chooses an SMS verification.

![Google asking SMS verification on two-factor authentication](https://images.ctfassets.net/23aumh6u8s0i/6cmLDT4KHVDbAOg1HT5kQb/3e4d0169d8f56f1282a188dfdccdec6f/2-step-verification-google)

Hacking a password is extremely easy, but obtaining a physical device that generates the second code or stealing biological features is not as easy, which is why 2FA is one of the most effective security approaches available.

### 2FA Approaches to Give Your Employees Convenient Options

If you are considering 2FA for your business, there are several approaches for the second factor known as one-time passwords (OTP) that don't require the technical sophistication of biometrics (fingerprints, retina scans).

Your OTP options include:

* **SMS (Text Messages):** SMS is the most popular method of 2FA. After a successful login, the user receives a 5-10 digit code via SMS on their phone, which they then enter into the application for access.
 - **_Pros:_** Employees are comfortable receiving text messages and it is cost-effective to implement.
 - **_Cons:_** Relies on cell reception and a physical phone. If stolen, you can't authenticate.
* **Email:** An OTP can be sent to a secondary email account for verification. This technique works in the same way as SMS, where a 5-10 digit code is sent to the email address.
 - **_Pros:_** Employees can get emails on multiple devices, it’s cost-effective and everyone uses email.
 - **_Cons:_** Emails sometimes fail to deliver, and hackers can gain access to your email and get the code.
* **Voice Call:** Although not a common practice, users can choose to receive a call to a designated phone number with the OTP delivered using a text-to-speech service.
 * **_Pros:_** All employees are comfortable with phone calls and voice doesn't require a data connection.
 * **_Cons:_** Calls can be intercepted, forwarded or voicemails hacked. If stolen, you can't authenticate.

![Multiple two-factor authentication screens](https://images.ctfassets.net/23aumh6u8s0i/wLMMuoTSqpF5OdmetC1mt/f733ee40015326c4f390aebdc7f2b359/Twitter-Card-Multifactor)

* **Hardware Tokens:** This is a common enterprise practice, where employees are given a physical device such a [*key fob*](https://en.wikipedia.org/wiki/RSA_SecurID), or other devices that dynamically generates a code for the user.
 * **_Pros:_** It is a standalone solution that doesn’t require reception or WiFi connection.
 * **_Cons:_** The pieces are expensive, hard to manage and devices are easily misplaced or lost.
* **Software Tokens:** Instead of carrying around a device, software tokens require employees to install an application that runs on their computer or mobile device.
 * **_Pros:_** Apps are easy to use, easy to update and easy to apply patches when needed.* *
 * **_Cons:_** Employees must download to their personal device. Apps can be compromised without user knowledge.
* **Push Notification:** Apps like Auth0 [Guardian](https://auth0.com/docs/multifactor-authentication/guardian) enable you to receive a push notification in the same way you get alerts from your calendar app or news activity. The notifications request a response of either a “Yes” or a “No.”
 * **_Pros:_** There's a direct and secure communication between authentication and the smartphone application.* *
 * **_Cons:_** If a device is stolen, users must go online to cancel the device before it is compromised.

Although there are pros and cons to every 2FA option, keep in mind that it is impossible to get your enterprise authentication 100% secure. Implementing 2FA increases your security no matter what, so select a second factor that works best for your employees.

## 2FA Goes Beyond Security to Improve Output

While the primary reason businesses implement 2FA is for the extra layers of security, the methodology of 2FA also enhances employee productivity and operational efficiencies.

Simply by requiring a second form of identification, there is a low probability that a hacker can successfully impersonate an employee and gain access to your systems. If an employee loses a mobile device or a password is stolen, 2FA provides enough time for your company to remedy the issue before too much damage is done.

Beyond these obvious mobile security benefits, 2FA also provides the enterprise with a few other advantages that affect your bottom line.

### Increased Productivity

Employees are now mobile, working on their personal devices outside the office. As a result, they are more productive and businesses are reaping the rewards of this newfound flexibility.

2FA is an [effective method](https://auth0.com/blog/enhancing-productivity-with-identity-and-access-management/) to secure mobile devices where employees can safely access company-owned applications, data, shared documents, and other systems from virtually any device without putting the company at risk. Corporate IT can rest assured that if a device is compromised, 2FA will make it really hard for anyone to gain illegal access.

![Nowadays, multiple devices are used by employees.](https://images.ctfassets.net/23aumh6u8s0i/1cewJALdmtvtG73hmdAidf/48f0e65905372c10848fd8fa38e27b73/DifferentDevices2)

Employee mobility has created a happier and [more productive](https://www.forbes.com/sites/danielnewman/2016/03/29/is-mobility-the-answer-to-better-employee-productivity/#6c493277131c) workforce, and 2FA is the best method to provide the security measure that reaches outside the firewall to make it all possible.

<include src="TweetQuote" quoteText="Two-factor authentication also means increased productivity."/>

### Increased Awareness

Stolen credentials are the biggest security risk for every business, but most companies don't even know when an employee's credentials have been compromised until it is too late.

In the devastating 2014 [eBay data breach](https://www.alertlogic.com/blog/the-ebay-breach-in-review/), the attackers spent over 229 days within eBay's systems because the stolen passwords were logged as appropriate access. 2FA notifies the account owner immediately that their credentials are being used by someone other than them.

![Google showing an alert that a non-regular sign in was blocked.](https://images.ctfassets.net/23aumh6u8s0i/2RIA9ufpiptT3aL9kDTqyD/827a3f112766779f58916b5706bb25c4/Google-block-sign-in-attempt-prevented-email)

If the hacker has both security factors, there is a good chance that the account owner has already reported a security concern because it means they are missing a device or received an alert that is inconsistent with their activities. 2FA gives the business a new level of awareness level to stop crimes before they start.

### Cost Savings

There are several ways 2FA can help your company save money. The biggest is in preventing a data breach, which can cost a company up [to $3 million](https://www-03.ibm.com/security/uk-en/data-breach/). Beyond mitigating theft, there are two other ways 2FA can help you save money:

1. **Reduced Help Desk Inquiries:** Time is money and reducing the amount of time your IT expert is spending resetting passwords can save the company a lot of money. According to HDI, at least 35-40% of help desk calls are related to password resets, which require an average of 20 minutes of the help desk technician’s time to complete. 2FA gives employees a secure way to reset their own passwords, resulting in fewer calls and more productive employees.

2. **Cloud-based 2FA:** Some larger companies have implemented 2FA using hardware tokens (or "fobs") that employees carry around like a thumb drive. These tokens generate one-time passwords, but they are expensive and hard to manage as employees often lose them or keep them after they leave the company. [Cloud-based tools](https://auth0.com/learn/cloud-identity-access-management/) like Auth0 provide soft tokens like SMS and Push Notifications, giving companies a new, cost-effective way to utilize 2FA.

![Crypto card two factor authentication](https://images.ctfassets.net/23aumh6u8s0i/8TP8HQgFeZNfz4WQBqVGK/c441ae38290e1654de781afd2ca2ce6f/CryptoCard_two_factor-1024x690)

Identity access management [tools](https://auth0.com/learn/cloud-identity-access-management/) allow businesses to [implement 2FA ](https://auth0.com/learn/two-factor-authentication/)for their internal systems in the same way Google, Twitter and Facebook use it to address consumer concerns. Not only will you gain that added layer of security, but the enhanced productivity, awareness and cost savings make 2FA a viable tool for your bottom line.

## Empower Your Passwords, Improve Your Business

In the same way we still use keys to unlock our doors, passwords are our preferred method of accessing our digital worlds. Passwords have been part of humanity for ages and are not going anywhere, but that doesn't mean we need to rely on them solely to protect our company's valuable assets.

2FA augments passwords in a unique way that not only adds an important layer of extra security but also enhances employee productivity helping your bottom line.

Why Every Business Needs Two-Factor Authentication Security

diegopoza

System Engineer, geek, foodie, technology lover, speaker.

Sr Manager, Developer Advocacy

Diego Poza

The good, the bad, and the future of Biometric Identity.



If we have any hope of a future with all-around [passwordless, friction-free authentication, it will probably come at the hands of biometrics](https://auth0.com/passwordless).

A biometric identity is the unique physical features of your person that can be used to identify you. The classic example is fingerprints, which have been used to identify criminals since the 1800s. But now, much more than the fingerprint is used to identify people — for less sinister reasons than criminal identification.

And the future only promises more innovation in the field of biometric authentication. From gait analysis to the way you use a computer, biometric authentication still has plenty of room to grow.

## Biometrics of today

There are a large number of biometric options available today, some more used than others. Here's a quick rundown of what's in place and how they're generally used.

## Widely Used

The most widely used biometrics are generally used by the government or large companies to verify your identity. One popular application of biometrics is in border security, where it is used as a way to confirm someone's identity in addition to their passport. Banks and hospitals are also big users of biometrics, in part because they secure large amounts of sensitive data.

Of course, with facial and fingerprint recognition available in many smartphones and computers. Day-to-day, many consumers use biometric authentication habitually, whether it's unlocking one's phone or signing into an app.

Another huge use of biometrics is in law enforcement. While most people thankfully don't come up against this use, it is an extension of the government's ability to store large amounts of biometric data, which is important for its widespread adoption.

### Eyes: Iris or Retina Recognition

An individual may be identified by a scan of their eye, either looking for unique patterns in the iris or vein patterns in the retina. Both are unique to individuals and may be verified against a digital copy. The largest use of iris or retina recognition currently is by governments at border control or to verify benefits recipients. Smartphones with the capability to scan eyes have been released, but fingerprints remain much more common on personal devices.

![Retina recognition](https://images.ctfassets.net/23aumh6u8s0i/45NNDBOYwKZ7b1XbxoEAUs/75c3830e1f764eba131882fe38d6f1dc/iris)

([source](http://www.iritech.com/blog/iris-biometric-safe/))

### Face Recognition

Face recognition is made possible by taking features of the face (ex the distance between eyes) and using those to match a face stored in a database. There are many methods of analysis currently in use for accurate facial recognition, and the field is still developing. Face recognition is widely used by the US and other governments, is available for device login, and is also used by cameras and social sites to identify faces in photographs.

### Fingerprint Recognition
One of the most widely known ways to identify and individual biometrically is with their fingerprint. Everywhere from police stations to border control to your iPhone, you can be identified by the ridges and valleys on the tips of your fingers.

### Other Hand Recognitions
Fingerprints aren't the only unique features of the hand — anything from dimensions of fingers to vein patterns in the palm to a palmprint may be recorded and used to identify an individual. Other hand recognitions are not as common as fingerprints, but are gaining in popularity everywhere from the FBI to hospitals.

![Palm scan](https://images.ctfassets.net/23aumh6u8s0i/1Zj3Cb2vQedCEh04ByR9It/65e19f026a938dd153f7f4ea8bcc5f17/nyu-langone-patientsecure-palm-scan-620)

(Vein matching scan | [source](http://www.cbsnews.com/news/patientsecure-biometric-palm-scan-system-hospital-security/))

### DNA
DNA recognition is probably the only form of biometric authentication on this list that isn't easy to understand, because it relies on the isolation, copying and splitting of genetic markers in our DNA to identify us as an individual. Though widely used and very accurate, from court evidence to paternal testing to gene therapy, it doesn't have the immediacy needed to be used for something like border security.

## Emerging

There are some biometric technologies that are still being refined and implemented, but are already available for use. Among these, voice recognition may be the most widely available, especially in the financial sector, although the development of voice technology still leaves much to be desired.

It remains to be seen if these will become widely adopted, or pushed out of the way by newer technology. Either way, it's possible that you'll one day soon be able to be identified by the following:

### Typing Recognition
Already widely used by Norwegian financial firms, typing recognition identifies individual by their unique habits using a computer keyboard, from key pressure to rhythm of tapping. One company boasted a [99.7%](https://www.hottopics.ht/stories/consumer/dont-go-hacking-my-heart-10-startups-at-the-frontier-of-biometric-authentication/) success rate at distinguishing real and fake users.

### Ear Recognition
You may not know that the human ear is unique to every individual, for we are born with more or less the ear shape we'll have for the rest of our lives. While the technology for highly accurate ear recognition exists and is theoretically ready to use, applications of ear recognition are being refined and tested, and are still not widespread.

### Voice Recognition
From the sound of your voice to the cadence of your breath, voice recognition takes ~[100 datapoints](https://www.theguardian.com/technology/2016/feb/19/how-safe-is-voice-recognition-fingerprint-id-hsbc) from your speech to identify you as a unique individual. It is starting to be implemented in bank security and also by some governments.

## Biometrics of tomorrow

The future of biometrics is likely to try and move towards identifications that are easier and easier for users. Things like gait analysis don't take any real work on the part of the individual, like putting a finger or palm a scanner. They will rely on more powerful technological infrastructure becoming available in public areas, whether that's an easier way to read under-skin chips or better touchscreens for finger writing.

It is, of course, possible that these technologies won't be significantly better than the developments made in our current biometric authentication methods — but there's only one way to find out.

### Gait Analysis
An individual can be identified by a number of data points surrounding their gait, including speed and joint movements. Gait analysis is sometimes used for efficiency of motion in elite athletes, but people are still trying to figure out the best way to implement gait analysis for identification, and what the limits of its applications are.

### Body Modifications (Bodymod)
While certainly not adopted by the masses, people like PayPal's Jonathan Leblanc have [talked](https://www.hottopics.ht/stories/consumer/dont-go-hacking-my-heart-10-startups-at-the-frontier-of-biometric-authentication/) about bodymod as a way to attach unique identification to a person, rather than relying on their underlying biological identity. Could embedding, injecting, or ingesting technology could be the future of authentication? He's not the only one that thinks so — a senior BuzzFeed reporter got a chip implanted in his hand and successfully purchased goods by connecting it to a mobile paying app. Radical? Yes, but also possible.

![Gait analysis](https://images.ctfassets.net/23aumh6u8s0i/17cZlAxCWdOOtGSLq4uLfz/f4ab86a826e31ec15a13eb343b36a7d7/gait-analysis)

([source](https://www.buzzfeed.com/charliewarzel/yes-we-scan?utm_term=.ctLeR0e7ZZ#.hg09LO9Voo))

### Finger Writing
With repeated writing on a touch screen, computers can recognize a “signature” in your finger writing — your unique way of writing without a pen. This data could theoretically be stored and used in any number of ways. For example, instead of punching in a PIN number, you might write a phrase on a screen. Finger writing to date has been given an extremely high level of accuracy, with confidence up to [99.97%](http://resources.infosecinstitute.com/biometrics-todays-choice-future-authentication/#gref).

### Computer Interaction
Like typing recognition, computer interaction relies on the unique way an individual interacts with a computer, from typing speed to common spelling mistakes. It is currently [being developed](http://resources.infosecinstitute.com/biometrics-todays-choice-future-authentication/#gref) at West Point, but there are definitely civilian applications for the tech — imagine if you just had to write a quick email to get through customs or to apply for a visa.

## Are biometrics safe?

Biometrics *are* safe. There are a lot of hyperbolic fears about people who are worried that if they have a cold voice recognition won't work, or that people will be cutting off fingers to get around fingerprint scanners.

Well, remember those 100 datapoints that advanced voice recognition takes? They can determine you are you if you have a cold, and can even distinguish between voice imitators that sound so similar the human ear might confuse them for the same person.

Biometric authentication checks aren't 100% foolproof, but it shouldn't be cause for concern. Unfortunately, there are weaknesses for every system. The weaknesses in biometric systems certainly aren't any higher than those in a username + password system, which we rely on now.

Let's put it this way — nobody is going to make a 3D printed version of your face to fool a scanner, unless you're an *extremely* powerful public figure.

![3D Face Scan](https://images.ctfassets.net/23aumh6u8s0i/2XQianhjwIV5inXu5aqYe5/69cc8f85393509d707a1981fd75d28c4/3d-face)

(Source: [The Memo](http://www.thememo.com/2017/03/02/how-secure-is-your-face-the-worrying-world-of-biometrics/))

If you are a powerful figure, you might want to avoid a total reliance on biometrics to [configure a multifactor login](https://auth0.com/multifactor-authentication) with a complex, unique password and multiple devices involved in login.

Most people simply aren't going to be targets of biometric identity theft, especially as technology gets more sophisticated and takes more and more data into account when making identifications. As it is now, biometric authentication is probably better than having “1234567” or “0000” as your password, anyway.

## Aside: Securing Applications with Auth0

Are you building a [B2C](https://auth0.com/b2c-customer-identity-management), [B2B](https://auth0.com/b2b-enterprise-identity-management), or [B2E](https://auth0.com/b2e-identity-management-for-employees) tool? Auth0, can help you focus on what matters the most to you, the special features of your product. [Auth0](https://auth0.com/) can improve your product's security with state-of-the-art features like [passwordless](https://auth0.com/passwordless), [breached password surveillance](https://auth0.com/breached-passwords), and [multifactor authentication](https://auth0.com/multifactor-authentication).

[We offer a generous **free tier**](https://auth0.com/pricing) so you can get started with modern authentication.

## The bio-future

Biometric authentication clearly has a long way to go before we exhaust its possibilities. From government identification to healthcare to banking, from consumers unlocking their devices to evidence in a courtroom, where biometric authentication isn't the norm, it's likely to become the norm in the future.

With more development, we could sharply reduce the use of passwords, identification documents, and PIN numbers. Biometrics are here to stay — and the best part is that once they're in place, you might never have to remember any passwords again.


The State of Biometric Identity in 2017

99c4080f412ccf46b9b564db7f482907?s=200 avatar

99c4080f412ccf46b9b564db7f482907?s=200

I'm currently a Senior Developer Advocate at MongoDB. I'm also a Google Developer Expert for Web Technologies and spend most my time giving talks at conferences and meetups, mentoring developers and running workshops, and creating online content to help technology professionals.

Former Auth0 Employee

Ado Kukic

Stormpath is shutting down Aug 18, 2017. Learn how to migrate your existing Stormpath users to Auth0 without requiring your users to reset their passwords.

---

**TL;DR** Stormpath announced today that it was acquired by Okta. As a result, the Stormpath API will be shutting down this coming August as the team transitions to Okta. Customers have until August 18, 2017 to export their user data to Okta or a different provider. Find out how to easily migrate your users to Auth0 without requiring your users to reset their passwords and some additional benefits you'll gain by making the switch. If you would like to follow along with our demo, download the sample app from [GitHub](https://github.com/auth0-blog/migrate-stormpath-users-to-auth0/tree/master/).

---

[Stormpath](https://stormpath.com) is an authentication as a service company that allows developers to offload their authentication and authorization needs to a third party. The company offered a RESTful API that customers could use to manage identity in their applications. Today, the company [announced](https://stormpath.com/blog/stormpaths-new-path) that it had been acquired by [Okta](https://www.okta.com), another company that provides identity management services.

![Acquisition announcement](https://images.ctfassets.net/23aumh6u8s0i/1KJLrUakWKfawgsxdBFZth/3edb24a5aac1fd1a7522e702f0a704f8/acquisition)

Acquisitions in the software industry are a norm. What is surprising about this acquisition is that the Stormpath product will be shut down later this year as the team transitions to Okta and many customers will have to find an alternative. Customers have until **August 18, 2017** to find a new provider, get it up and running, and export their existing users. This could be a challenging amount of unexpected work in such a short time frame.

<include src="TweetQuote" quoteText="Stormpath customers have until August 18, 2017 to migrate off the platform as it is being shut down!"/>

At [Auth0](https://auth0.com), our goal is to provide the best authentication and identity management solution that is also simple and easy for developers to work with.

<blockquote class="twitter-tweet" data-lang="en"><a href="https://twitter.com/auth0">@auth0</a> should open user migration to everyone from <a href="https://twitter.com/goStormpath">@goStormpath</a> and gain all those clients that can&#39;t move to okta. <a href="https://twitter.com/hashtag/wearesorry?src=hash">#wearesorry</a>&mdash; Tom Compagno (@TomCompagno) <a href="https://twitter.com/TomCompagno/status/838825630078660608">March 6, 2017</a></blockquote>
<script async src="//platform.twitter.com/widgets.js" charset="utf-8"></script>

**You ask, we deliver :)!** We're offering the database migration feature for free for all Stormpath customers 💥!

## Custom Database Migration Made Easy with Auth0

The most important thing you are probably concerned with right now is how to migrate your existing users with minimal impact to your applications. At Auth0 we hope to greatly reduce your stress and anxiety with our painless user import functionality.

The way this feature works is by setting up a [custom database connection](https://auth0.com/docs/connections/database/mysql) and connecting it to your Stormpath account. When your users login the first time, they will enter their existing Stormpath credentials and, if authenticated successfully, we will automatically migrate that user account from Stormpath into Auth0. Your users will not have to change their password or jump through any additional hoops and you can decide what data to port over from Stormpath. Next time the user logs in, Auth0 will detect that they have been migrated and authenticate them with their Auth0 account.

![Auth0 User Migration](https://images.ctfassets.net/23aumh6u8s0i/2o0NcjoJdvUBx7AiZztxkg/6fcb081c1c17597cf37095725459da81/migrating-copy)

Talk is cheap, so let me actually walk you through the steps.

### Implementing the Database Migration Scripts

First of all you will need an Auth0 account. <a href="https://auth0.com/signup" data-amp-replace="CLIENT_ID" data-amp-addparams="anonId=CLIENT_ID(cid-scope-cookie-fallback-name)">Signup for free here.</a> With your account created, let's setup a custom database connection. In your Auth0 [management dashboard](https://manage.auth0.com), navigate to the [database connections](https://manage.auth0.com/#/connections/database) section.

> [Auth0 offers a generous **free tier**](https://auth0.com/pricing) to get started with modern authentication.

![Create DB Connection](https://images.ctfassets.net/23aumh6u8s0i/48UDN4ZvSqdmy5Ievrc1sR/f78bd0c795f68b2d5a2cb5d266d3dd81/create-db-connection)

You can name your connection anything you like. Leave all the default settings as is for now and click the **Create** button to create the connection.

![Setup Custom DB Connection](https://images.ctfassets.net/23aumh6u8s0i/6rrp1qEEoY4dxrXe8axQvu/0d73729a8811b54500327bb603e59b91/configure-db)

Next, let's go into this database connection and connect it to our Stormpath account. Click on your newly created connection and navigate to the **Custom Database** tab. Flip the switch titled "Use my own database" and the **Database Action Scripts** section will be enabled. This is where we will write our code to connect to your existing Stormpath user datastore. We will need to write two scripts: **Login** and **Get User**. **Login** will proxy the login process and **Get User** will manage looking up accounts when a user attempts to reset their password.

![Enable Custom Database](https://images.ctfassets.net/23aumh6u8s0i/23Z1dp5ad3L8AKItc6YfgT/7089780e5e9e9aa0f91b972caad23385/enable-custom-db)

With our custom database feature turned on, let's enable the import functionality. By default the custom database connection will allow us to authenticate with an external database. If we want to migrate users from the external platform into Auth0 we'll need to simply toggle a switch. Go to the **Settings** tab of the connection and flip the switch titled "Import Users to Auth0" and you're done.

![Import Users to Auth0 Switch](https://images.ctfassets.net/23aumh6u8s0i/4uB3CXu4ZaERpzAjWdcuSW/14f743da4e1e17bb0c16f759e9c148e8/import-to-auth0)

One final step we'll do before implementing our scripts is enabling this connection for our default client. Navigate to the **Clients** tab while you are in your database connection and flip the switch to enable this client for the Default Connection. *If you already have an existing Auth0 account, the connection name may be different.*

![Enable Database Connection](https://images.ctfassets.net/23aumh6u8s0i/6XGYxllP60DPLPJgm9X1TE/ceb49017e52c3267b524f4d456ffde3e/enable-connection)

### Login
The **Login** script is executed when a user attempts to sign in but their account is not found in the Auth0 database. Here we will implement the functionality to pass the user credentials provided to our Stormpath user datastore and see if that user is valid. Auth0 provides templates for many common databases such as MongoDB, MySQL and Sql Server, but for Stormpath we will have to write our own. We will utilize Stormpath's REST API to authenticate the user. Let's look at the implementation below:

```js
function login(username, password, callback) {
 // Replace the YOUR-CLIENT-ID attribute with your Stormpath ID
 var url = 'https://api.stormpath.com/v1/applications/{YOUR-CLIENT-ID}/loginAttempts';

 // Stormpath requires the user credentials be passed in as a base64 encoded message
 var message = username + ':' + password;
 var pass = new Buffer(message).toString('base64');

 // Here we are making the POST request to authenticate a user
 request({
 url: url,
 method: 'POST',
 auth: {
 // Your API Client ID
 user: '{STORMPATH-CLIENT-ID}',
 // YOUR API Client Secret
 password: '{STORMPATH-CLIENT-SECRET}'
 },
 headers: {
 'Content-Type': 'application/json'
 },
 json: {
 type: 'basic',
 // Passing in the base64 encoded credentials
 value: pass
 }
 }, function (error, response, body) {
 // If response is successful we'll continue
 if (response.statusCode !== 200) return callback();
 // A successful response will return a URL to get the user information
 var accountUrl = body.account.href;

 // We'll make a second request to get the user info. This time it will be a GET request
 request({
 url: accountUrl,
 method: 'GET',
 auth: {
 // Your API Client ID
 user: '{STORMPATH-CLIENT-ID}',
 // YOUR API Client Secret
 password: '{STORMPATH-CLIENT-SECRET}'
 }
 }, function (errorUserInfo, responseUserInfo, bodyUserInfo) {
 // If we get a successful response, we'll process it
 if (responseUserInfo.statusCode !== 200) return callback();

 var parsedBody = JSON.parse(bodyUserInfo);
 // To get the user identifier, we'll strip out the Stormpath API
 var id = parsedBody.href.replace('https://api.stormpath.com/v1/accounts/', '');

 // Finally, we'll set the data we want to store in Auth0 and migrate the user
 return callback(null, {
 user_id : id,
 username: parsedBody.username,
 email: parsedBody.email,
 // We set the users email_verified to true as we assume if they were a valid
 // user in Stormpath, they have already verified their email
 // If this field is not set, the user will get an email asking them to verify
 // their account
 email_verified: true,
 // Add any additional fields you would like to carry over from Stormpath
 });
 });
 });
}
```

### Get User
The **Get User** script is executed when the user attempts to do a password reset but their account is not found in the Auth0 database. The **Get User** script interfaces with your Stormpath datastore and checks to see if the user exists there. If the user does exist, their data is sent back to Auth0 where the user is automigrated and a password reset email is sent out from Auth0. Once the user confirms the reset, they are good to go and can access your app. Subsequent logins will be authenticated against the Auth0 database as the users profile is now stored with Auth0.

Let's look at our implementation of the **Get User** script for Stormpath:

```js
function getByEmail(email, callback) {
 // Replace the YOUR-CLIENT-ID attribute with your Stormpath ID
 var url = 'https://api.stormpath.com/v1/applications/{YOUR-CLIENT-ID}/accounts';

 request({
 url: url,
 method: 'GET',
 auth: {
 // Your API Client ID
 user: '{STORMPATH-CLIENT-ID}',
 // YOUR API Client Secret
 password: '{STORMPATH-CLIENT-SECRET}'
 },
 qs: { q: email }
 }, function (error, response, body) {
 if (response.statusCode !== 200) return callback();

 var parsedBody = JSON.parse(body);
 var user = parsedBody.items[0];

 if (!user) return callback();

 var id = user.href.replace('https://api.stormpath.com/v1/accounts/', '');

 return callback(null, {
 user_id: id,
 username: user.username,
 email: user.email,
 email_verified: true,
 // Add any additional fields you would like to carry over from Stormpath
 });
 });
}
```

With these two scripts we have user migration setup and ready to go. To test it and make sure our code works, let's build a simple application that allows a user to login and request protected resources via an API. We'll build the frontend with Angular 2 and the backend we'll power with Spring.

### Building the Frontend

We will build our frontend with Angular 2. We'll use the [Auth0 Angular 2 Quickstart](https://github.com/auth0-samples/auth0-angularjs2-systemjs-sample/tree/master/01-Login) to get up and running quickly. Our source code can be found [here](https://github.com/auth0-blog/migrate-stormpath-users-to-auth0/tree/master/frontend). Auth0 provides a comprehensive set of quickstarts, SDKs, and guides for many popular languages and frameworks. See them all [here](https://auth0.com/docs). With the project downloaded, we'll need to setup our Auth0 credentials. We'll do that in the `auth.config.js` file. Open the file and change the values to look like this:

```js
"use strict";
exports.myConfig = {
 // Your Auth0 ClientID.
 clientID: '{AUTH0-CLIENT-ID}',
 // Your Auth0 Domain
 domain: '{YOUR-AUTH0-DOMAIN}.auth0.com'
};
```

Both of these values can be found in your Auth0 [management dashboard](https://manage.auth0.com). In the dashboard, simply click on the **Clients** link from the main menu, and select the **Default Client** that was created when you signed up. *If you already had an Auth0 account, select the client that has the database connection with the custom database enabled*.

With these values configured save the file and run `npm install`. Once npm has installed all the required dependencies, run the project by executing `npm start`. Navigate to `localhost:3000` to see the app in action.

![Angular 2 Frontend](https://images.ctfassets.net/23aumh6u8s0i/18HQrQSCSg4y9UrCi7sMV0/c0f3debbce23cf2c9c11f17ddc9ced09/app-new)

Click on the **Login** button to login to your application. Clicking the **Login** button will bring up the Auth0 [Lock](https://auth0.com/lock) widget and ask the user to provide their email and password. Here, the user will provide their Stormpath email and password credentials and if they are correct they will be logged in. If you don't already have a Stormpath user account you can login with, go into your Stormpath dashboard and create an account. Now login with your Stormpath user credentials.

![Angular 2 Login with Lock](https://images.ctfassets.net/23aumh6u8s0i/5bzzMjL0c5aW0869E46Y5q/366034baff0d48ddb16c51c5471c3bfd/lock)

> [Lock is an embeddable login form for desktop, tablet and mobile devices.](https://auth0.com/lock) It provides the easiest way for securing your website and mobile apps.

Notice that you are instantly logged in. If we look at the response data from the transaction we'll see that the user is coming from the **Stormpath-Users** connection alongside other data that we imported. Let's make sure that this user was migrated to Auth0 as well. To check this we'll navigate to the [Users](https://manage.auth0.com/#/users) section of the Auth0 dashboard and we'll now see the user we logged in with.

![User Migrated](https://images.ctfassets.net/23aumh6u8s0i/7hkbvruJC8h7xLE7NTOCcE/214e761a53a243e2a3463b2012759986/migrated)

This means that our migration was successful. This user is now migrated to Auth0. The next time they login to the application, we'll check their credentials against Auth0's database instead of making the extra call to Stormpath. The workflow diagram below illustrates the process once again.

![Auth0 User Migration](https://images.ctfassets.net/23aumh6u8s0i/2o0NcjoJdvUBx7AiZztxkg/6fcb081c1c17597cf37095725459da81/migrating-copy)

Now you may notice the two links `Call Public API` and `Call Private API`. Let's build a simple backend that will return data when these links are clicked. We'll do that next.

### Building the Backend

For our backend, we'll build a simple Spring Boot application that exposes a RESTful API. You can get the code for the sample application [here](https://github.com/auth0-blog/migrate-stormpath-users-to-auth0/tree/master/backend). To setup the application, you will just need to update the application with your credentials. The file where the credentials are stored is called `auth0.properties` and can be found in the `src/main/resources/` directory. Edit the file to look like so:

```
auth0.domain: {YOUR-AUTH-DOMAIN}.auth0.com
auth0.issuer: https://{YOUR-AUTH0-DOMAIN}.auth0.com/
auth0.clientId: {YOUR-AUTH0-CLIENT-ID}
auth0.securedRoute: NOT_USED
auth0.base64EncodedSecret: false
auth0.authorityStrategy: ROLES
auth0.defaultAuth0ApiSecurityEnabled: false
auth0.signingAlgorithm: HS256
```

With this update in place, you should be able to build the application by running:

```
mvn spring-boot:run -Drun.arguments="--auth0.secret=YOUR_SECRET_KEY"
```

If the application was built successfully, you will be able to access the API at `localhost:4000`. The two routes that are exposed by this application that we care about are `/public` and `/secure`. The `/public` route will be accessible by everyone, while the `/secure` route will return a successful response only if the user is authenticated and passes the correct credentials.

![Accessing Public API](https://images.ctfassets.net/23aumh6u8s0i/4MAMKVaISJhxqbpbRkoZmM/ec39376d8ca4ed42c3d97f698bd26496/public-api)

Once your backend is up and running go back to your frontend application and try clicking on the the two links `Call Public API` and `Call Private API`. The public API you will be able to access even when not logged in. For the private API, you will need to be logged in to call the route and get the appropriate response.

![Accessing Private API](https://images.ctfassets.net/23aumh6u8s0i/4ZQdzDiaiRv7B4Bq1bFS9c/ed20e52d6feff3101465e94efd7358a5/private-api)

We also used Angular 2 to add some dynamic classes. So if the user is logged in we'll make both of the buttons green to indicate they can be clicked.

![App when logged in](https://images.ctfassets.net/23aumh6u8s0i/7yVJJKoAH4iVnoLq46SYP5/ab53413fd2cd513d5fa7c1863e07f398/app-logged-in)

## Go Further with Auth0

I hope the user migration functionality I showed in this post helps with your use case. This gradual migration works great because it is transparent to your end-users. As the deadline approaches and Stormpath prepares to shut down their service, you may need to speed up the migration process. Auth0 can help here as well. You can [bulk import](https://auth0.com/docs/tutorials/bulk-importing-users-into-auth0) your existing user datastore into Auth0 or since we already wrote the **Get User** script you can send out a mass email to your users letting them know they need to change their password and by clicking on the link in the email their accounts will be migrated to Auth0.

Now that your migrates woes have been taken care of, let's briefly talk about what Auth0 brings to the table besides authentication and authorization. Many features that Auth0 provides can be enabled with the flip of a switch. [Multifactor authentication](https://auth0.com/multifactor-authentication) is one such feature. You can enable MFA using our in-house MFA solution, [Guardian](https://auth0.com/multifactor-authentication), with just the flip of a switch.

If you are already using a 3rd party MFA solution or have your own custom solution, you can continue to use it as well. The Auth0 [Rules](https://auth0.com/docs/rules) extensibility platform allows you to take control of the authorization workflow. Here you can configure any number of events such as triggering 3rd party MFA, performing progressive profiling, and much more.

We want to make your switch to Auth0 as painless as possible, so we are making the Database Migration feature free for all existing Stormpath customers. For customers switching from Stormpath to Auth0 and purchasing an Auth0 Enterprise Support plan, we are also offering 8 hours of professional services at no cost.

## Conclusion

Stormpath will be shutting down their authentication and authorization API's this coming August. Customers have until August 18, 2017 to move off the platform. At Auth0, we hope to give existing Stormpath customers an easy and smooth transition plan. Our database migration feature can start migrating your users today!

If you are affected by the Stormpath news and want to easily migrate your users, give Auth0 a try, <a href="https://auth0.com/signup" data-amp-replace="CLIENT_ID" data-amp-addparams="anonId=CLIENT_ID(cid-scope-cookie-fallback-name)">sign up for a free account</a> and get started today.

> Auth0 provides the simplest and easiest to use [User interface tools to help administrators manage user identities](https://auth0.com/user-management) including password resets, creating and provisioning, blocking and deleting users.

Easily Migrate Your Existing Stormpath Users to Auth0 

Multifactor authentication is important, but the question of implementation is more complex than it seems.

<div class="alert alert-info alert-icon">
 
 Forrester Consulting analysis determines that using Auth0 can yield a 548% ROI and $3.7M in identity-related savings. Read the full report: <a href="https://resources.auth0.com/forrester-tei-research-case-study/">Total Economic Impact of Auth0</a>.
</div>

---

## Intro

In recent years, [multifactor authentication](https://auth0.com/multifactor-authentication) has become quite the buzzword in information security. Products from Twitter to Instagram have implemented their own two-step login processes, responding to widespread user demand for better security and the ever-present reality of hackers cracking accounts and selling them across the internet.

All this popularity has also led to the creation and perpetuation of various myths about [multifactor authentication](https://auth0.com/multifactor-authentication) — what it is, what it's for — that can mislead developers and users alike. 

Going with multifactor authentication is almost always going to be an improvement over not. But it's table stakes now. Sophisticated attackers aren't deterred by poorly configured multifactor authentication systems. To keep internal and user information secure, you need to know what you're doing.

> Give your customers enterprise identity integration, frictionless SSO across your products and adaptive authentication with MFA and Anomaly Detection. [All of this with a flip of a switch](https://auth0.com/b2b-enterprise-identity-management).

## Myth #1: There are only a few different forms of MFA

An authentication [factor](https://auth0.com/identity-glossary) is a vector through which identity can be confirmed or denied, from fingerprint scanners to passwords, from USB sticks to PIN codes. The commonly used term “multifactor authentication” simply refers to an authentication scheme that uses **more than one** of these methods.

It was once true that most MFA systems operated basically the same way. Today, however, there's a great variety of factors you can request from your users, from push notification receipt to SMS to email to fingerprint.

### Reality: MFA is extremely customizable

![MFA alternatives](https://images.ctfassets.net/23aumh6u8s0i/1DLAvyone2D6hjqEsLRrmC/9c24dbdf6a6202d6568f9853d1afa568/mfa-alternatives)

There are three entire genres of factor—knowledge, possession, and inherence:

* **Knowledge:** Something only a particular user knows, such as a password or the answer to a secret question.
* **Possession:** Something only a particular user has, such as a USB stick or identifying badge.
* **Inherence:** Someone only a particular user is, such as determined through a fingerprint scanner or GPS recognition system.

Every multifactor authentication system out there is built upon some combination of these three basic factors. A simple password/secret question system would be made up of two separate knowledge factors, while one that asked you for an [RSA hardware token](https://www.rsa.com/en-us/products-services/identity-access-management/securid/hardware-tokens) in addition to your password would be made up of both knowledge and possession factors.

A [passwordless login system](https://auth0.com/passwordless) relies upon you being in possession of, and able to access, your email inbox. And so on. There are so many different forms of authentication out there now that you can freely choose whether you want something that maximizes ease of use, something that maximizes security through obscurity, or something in between.

## Myth #2: Your use case for MFA doesn't matter

[RSA](https://en.wikipedia.org/wiki/RSA_Security) and [TOTP](https://en.wikipedia.org/wiki/Time-based_One-time_Password_Algorithm) are two of the most popular methods for generating secure codes that we have today, but they are not interchangeable — both have their pros and cons.

The main technical difference between them is that RSA operates asymmetrically, with a public and a private key, and TOTP operates symmetrically, with a single private key shared between both parties. But this isn't just a minor detail about how the two systems work. This single difference affects the appropriate context for each one and the trade-offs you will be making.

### Reality: You have to choose your method based on your needs

The security of the public/private key pair of RSA “relies on the computational difficulty of factoring large integers”:

1. Two extremely large prime numbers are generated using the [Rabin-Miller primality test algorithm](http://searchsecurity.techtarget.com/definition/RSA).
2. The public key is generated from the modulus of those two prime numbers and a public exponent.
3. The private key is generated from the modulus of those two prime numbers and an exponent calculated with the Extended Euclidean algorithm.

This also means that computational power is required to encrypt and decrypt RSA when it's used properly. That makes RSA slower, but the benefit is that only one side of the transaction needs to actually [possess the private key](http://crypto.stackexchange.com/questions/11293/hmac-sha256-vs-rsa-sha256-which-one-to-use).

TOTP, on the other hand, operates symmetrically. A secret key is known to both the signer and the signee at the same time. A hash function is used to blend the secret key with the time at the moment of authentication (requiring fairly precise clock synchronization) and a one-time password is generated that is valid only for a short amount of time.

![TOTP screenshots](https://images.ctfassets.net/23aumh6u8s0i/59ont0UsxtdYX86pmfRUOw/489f1c775b9b6d8e9d1632fd3917c190/totp-screenshot)

This takes significantly less time and processing power than RSA, but it does mean certain vulnerabilities become hypothetically possible. If a key was somehow compromised on the server-side, for instance, an employee of an organization could potentially impersonate a user to malicious ends. With RSA, the same employee would have to [change the codebase](http://crypto.stackexchange.com/questions/11293/hmac-sha256-vs-rsa-sha256-which-one-to-use) to do such a thing—likely leaving a paper trail. 

If you absolutely need your users to be able to download and store their private keys on their own systems—maybe you're working with [financial data](http://resources.docs.salesforce.com/204/14/en-us/sfdc/pdf/salesforce_security_impl_guide.pdf) like credit cards, health records, or other forms of sensitive information—you may want to go with an asymmetric method like RSA.

## Myth #3: All MFA solutions work basically the same way

Mass adoption of multifactor authentication is still a significant work in progress, and it's fair to say that most sites should simply focus on implementing it in some form or another—not which method is the absolute perfect one.

That does not, however, mean that every single form of multifactor authentication is equally secure. Each occupies a different position on the axes of security and ease of use, which means that each one will be optimal under a different set of circumstances.

### Reality: you have to choose what you value most

SMS is one of the older and more common forms of multifactor authentication that you see out there. You log in to a website, and then to double-check your identity, a code is sent to a phone number that you have on file. You receive a text on your mobile phone that contains a code, and then you enter that code into the website to verify yourself. Simple.

But the U.S National Institute of Standards and Technology has recently come out with a report saying they believe that SMS multifactor is vulnerable to hijacking, [particularly when used](http://thehackernews.com/2016/07/two-factor-authentication.html) by subscribers to a VoIP phone service like Google Voice. SMS is also vulnerable to social engineering—in some instances, attackers have been able to simply call up a victim's phone company and, impersonating their target, ask that all text messages to that account be forwarded to a different one. 

These vulnerabilities, plus the fact that other forms of authentication have become more user-friendly, mean that many sites and apps enabled with multifactor authentication are moving on to different methods.

![Different multifactor alternatives](https://images.ctfassets.net/23aumh6u8s0i/1AV7Hb9MZLBz8ACf4w3W1h/bdc724d1db6ef8d086748059b8cd03ed/apps-of-mfa)

There's the time-based one-time password algorithm, or TOTP, which is most notable used by apps like Google Authenticator. A single-use password is generated from the combination of a secret key and the current time, and you enter that into the app asking for authentication rather than a code that could have been intercepted in transmission. 

TOTP, because it often involves users manually copying a six-digit code from their phone to their computer, is often considered to be a burden on users. With [Auth0 Rules](https://auth0.com/docs/rules), though, you can get the benefit of MFA without that annoyance by setting up special conditions under which authentication will be requested.

Say someone tries to call your bank's customer support to reset your password — as they did to [Brian Krebs](https://auth0.com/blog/how-paypal-could-have-avoided-account-hack/) — that event could be flagged as requiring a temporary extra authentication. You could trigger the same kind of request in the event of a new email account being added, an address being changed, and the like. This will keep your users' personal information and account more secure without disrupting their usage of your product, as they likely won't be performing these kinds of actions very often.

## Myth #4: MFA is always annoying for users

At many companies where multifactor authentication is tried but fails, one of the most common complaints is that it makes logging in too much of a hassle for users.

They have to first enter in their username and password, and *then* open up their email client or take out their phone, and *then* manually copy a code. Or they lose the hardware key that they were given during onboarding, or they misplace their mobile device and are no longer able to login to anything.

 These companies get so many annoyed emails from their employees, or start noticing users forgetting their passwords and consequently churning, that they finally turn MFA off.

### Reality: MFA can be as easy as tapping a push notification

MFA does not have to be troublesome for users. It doesn't have to require keeping track of a token, manually writing a code, or copying and pasting a code from a mobile device to your computer.

With [Auth0 Guardian](https://auth0.com/guardian/), you can make logging in through multifactor authentication a simple matter of swiping and tapping a push notification from your [phone's lock screen](https://auth0.com/blog/announcing-Auth0-Guardian-a-new-way-to-login/).

![Auth0's Guardian App](https://images.ctfassets.net/23aumh6u8s0i/4AioGEVTLJvh8eWtJ24e9N/99cd88daab3f584eb21e5689264aa87a/auth0-guardian-mfa)

It's available for both iOS and Android, and can be enabled with a [simple toggle](https://auth0.com/guardian). Check out the full docs [here](https://auth0.com/docs/multifactor-authentication/guardian).

## Myths Busted

There's no doubt that [implementing multifactor authentication is one of the best ways to improve the security of a website or an app](https://auth0.com/multifactor-authentication) that doesn't have it. But as with any decision regarding the privacy and security of your users and their information, nothing is as simple as it appears at first glance.

At [Auth0](https://auth0.com/), we want to make sure that MFA is something you can implement knowing that it will protect your accounts without harming the user experience. With [Guardian](https://auth0.com/guardian/), we're pushing that project forward, and we're really excited to have you try it out. Check it out!

> [Auth0 offers a generous **free tier**](https://auth0.com/pricing) to get started with modern authentication.

Is Multifactor Authentication The Best Way To Secure Your Accounts? Myths And Reality

1097492785caf9ffeebffeb624202d8f?s=200 avatar

1097492785caf9ffeebffeb624202d8f?s=200

Prosper is a great speaker, community leader, open source hacker, technical consultant, and a fervent Developer Advocate. He is a full-stack software engineer who has worked on biometric, health and developer tools. Prosper recently co-founded a startup called Eden that’s focused on improving the quality of lives in Nigeria and currently leads the engineering team. He also co-founded forloop, the largest developer community in Africa.

Prosper Otemuyiwa

Learn how the different types of Multifactor Authentication work!

**TL;DR:** Multifactor authentication involves providing an extra layer of security by ensuring users provide more than one piece of information for identification. It typically requires a combination of something the user knows (such as pins, passwords, secret questions) and something the user has (such as cards, hardware tokens, phone). Worthy of note is that two-factor authentication is the most used type of multifactor authentication (MFA). More information about [Multifactor Authentication (MFA) can be found here](https://auth0.com/docs/multifactor-authentication).

In this article we will go over why we should implement multifactor authentication and the different ways to implement it.

## Why should we implement Multifactor Authentication?

There have been several cases of stolen and hacked passwords. Systems with just simple username and password combinations getting hacked have been on the rise. In this situation, implementing multifactor authentication will prevent hackers from gaining access to your accounts even if your password is stolen. The extra layer of protection that **MFA** offers ensure that your account is more secure!

## What are the different ways to implement Multifactor?

I'll highlight various ways to implement multifactor below and an in-depth analysis of the process will be provided in the later part of this post. I'll cover multifactor via:

* **Time-based One-Time Password (TOTP)**
* **Short Message Service (SMS)**
* **Electronic Mail (Email)**
* **Push Notifications**

##How Time-based One-Time Password Works

TOTP involves the generation of a one-time password from a shared secret key and the current timestamp using a specific kind of cryptographic function. These cryptographic functions can vary across the board. A simple example of a cryptographic function is [*SHA-256*](https://en.wikipedia.org/wiki/SHA-2). TOTP is defined in [RFC 6238](https://tools.ietf.org/html/rfc6238). The process flow for a typical multifactor application using *TOTP* involves the **enrollment** and **login** processes.

The **enrollment** process is as follows:

* A user logs into a website/app with a username and password.
* If the credentials are valid, the next stage involves enabling [two-factor authentication](https://auth0.com/learn/two-factor-authentication/) for the user.
* A shared-key is requested (in form of text or QR code)
* The key is stored by an app that implements TOTP such as [**Google Authenticator**](https://play.google.com/store/apps/details?id=com.google.android.apps.authenticator2&hl=en), or [**Auth0 Guardian**](https://auth0.com/blog/announcing-Auth0-Guardian-a-new-way-to-login/)
* Two-factor authentication is enabled.

The **login** process is as follows:

* A user logs into a website/app with a username and password.
* If the credentials are valid, the user is directed to another form where he/she is required to enter a one-time code generated from **Google Authenticator** or **Auth0 Guardian.**
* The server verifies that the code is valid and finally authenticates the user.

![Multifactor Flow Chart](https://images.ctfassets.net/23aumh6u8s0i/i8cSLOCqiN9MEmdiP4kk2/f054cd6d57e5fa41e4da2c481a4d99d8/Flowchart)

An alternative implementation is the use of [**RSA** Keys](https://tools.ietf.org/html/draft-rsa-dsa-sha2-256-03). RSA authentication is basically based on two factors: A password/pin and an authenticator. The authenticator might be a [hardware](http://hitachi-id.com/concepts/hardware_token.html) or [software token](https://en.wikipedia.org/wiki/Software_token). A hardware or software token is assigned to a user. During login, after entering the password/pin, the user clicks on the token and an authentication code is generated at fixed intervals (usually about 60seconds) using a built-in clock and the device's factory-encoded random key. The key is different for each token and is loaded into the corresponding RSA Authentication Manager.

![Software Token](https://images.ctfassets.net/23aumh6u8s0i/2FHeEMJmRM563l6F0mbETy/58da30f26f3fc3ad8b090f12d2866153/tfa-software)

**Note:** The generated codes are time-based so the client and the server need to synchronize their clocks for this to work efficiently.

##How Short Message Service (SMS) Works

The process for a typical multifactor application using SMS also involves the **enrollment** and **login** stages.

The **enrollment** process is as follows:

* A user logs into a website/application with a username and password.
* A user is asked to enter a valid phone number, probably in the *settings* page.
* A unique one-time code is generated on the server and then sent to the phone number.
* The user enters the code into the app and multifactor is enabled.

The **login** process is as follows:

* A user logs into a website/application with a username and password.
* A unique one-time code is generated on the server and then sent to the registered user's phone number.
* The user enters the code into the app.
* If it's valid, the user is authenticated and a session is initiated.

![SMS Multi-factor Authentication](https://images.ctfassets.net/23aumh6u8s0i/12yhYWiO51ZE215JLY7AgY/44c2580ecd744253e176ca19ebd336d9/tfa-sms)

##How Electronic Mail (Email)

The process for a typical multifactor application using email is as follows:

* A user logs into a website/application with a username and password.
* A unique one-time code is generated on the server and sent via email to the user.
* The user retrieves the code from the email and enters the code into the app.
* If it's valid, the user is authenticated and a session is initiated.

![](https://images.ctfassets.net/23aumh6u8s0i/4vHRlcXcuFsfzQf9ryNnKd/51343e718883d3eb4db165075415863d/tfa-email)

##How Push Notifications Work

The process for a typical multifactor application using push notification is as follows:

* A user logs into a website/application with a username and password.
* Typically, push notifications work with applications such as [**Auth0 Guardian**](https://auth0.com/blog/announcing-Auth0-Guardian-a-new-way-to-login/). A push notification is sent to the Guardian app on your mobile device.
* This notification is a login request.
* It includes information such as the application name, the OS and browser of the request, the location and the date of the request.
* The user accepts the request & automatically the user becomes logged in.

![Push Notifications with Auth0 guardian](https://images.ctfassets.net/23aumh6u8s0i/51MSTpDGEztiIhTdK6VuDh/7867e91922d656d0a316fa9bb17524f2/multifactor)

##Aside: Different ways to implement multifactor with Auth0

Implementing multifactor with Auth0 is a breeze. The various ways to implement multifactor with Auth0 are as follows:

* **Push Notifications with Auth0 Guardian:** Guardian offers a frictionless approach to implementing MFA for your apps, and provides a full MFA experience without requiring integration with third-party utilities. You can find out how to implement [push notifications with Auth0 Guardian](https://auth0.com/docs/multifactor-authentication/guardian)
* **SMS:** Auth0 supports [sending an SMS with a one-time password code](https://auth0.com/docs/multifactor-authentication/guardian/admin-guide#support-for-sms) to be used for another step of verification.
* **TOTP with Google Authenticator and Duo:** Learn how to enable [Google Authenticator](https://auth0.com/docs/multifactor-authentication/google-authenticator) and [Duo Security](https://auth0.com/docs/multifactor-authentication/duo)
* [Custom Providers such as *Yubikey*](https://auth0.com/docs/multifactor-authentication/yubikey)
* [Contextual MFA with custom scripted rules](https://auth0.com/docs/multifactor-authentication#mfa-using-custom-rules)

<a href="https://auth0.com/signup" data-amp-replace="CLIENT_ID" data-amp-addparams="anonId=CLIENT_ID(cid-scope-cookie-fallback-name)">Sign up</a> for a free account today and enjoy fast, seamless, hassle-free multifactor authentication in your apps.

##Conclusion

We have covered the different ways to implement multifactor authentication in an application and how they work. Sign up for Auth0 and add that extra layer of security to your apps today in a breeze!

What are the different ways to implement Multifactor Authentication?

001c9ddc5ceb9829b6aaf24f5d28502a

I am software developer with a keen interest in open-source technologies, Linux, and native development. I've worked on many different platforms Android, iOS, Win32, Linux, FreeRTOS, the Web, and others. I've gone through the whole stack and I enjoy learning and using the latest technologies. I now work as a full-stack developer at Auth0.

Senior Engineer

Sebastian Peyrott

Forget about SMSs or manually entering codes, try Guardian!

Today we are officially releasing our [Auth0 Guardian](https://auth0.com/docs/multifactor-authentication/guardian) app, a new and convenient way to perform multifactor authentication for logins. Read on to find out how it works and how you can use it in your projects!

<include src="TweetQuote" quoteText="Auth0 Guardian is a new and convenient way to perform MFA"/>

-----

## Typical Multifactor Authentication
There are good intros to [multifactor authentication (MFA)](https://auth0.com/docs/multifactor-authentication) out there, but here's a refresher:

- A single authentication factor (such as username and password) is not safe enough. If credentials are leaked or stolen, that is all that is needed to impersonate a user.
- Adding a second authentication factor increases security by making it harder for both sets of credentials to be compromised at the same time.
- Typical MFA systems rely on SMSs, e-mails, and time-based one-time passwords ([TOTP](https://auth0.com/blog/from-theory-to-practice-adding-two-factor-to-node-dot-js/)). These require the user to perform manual steps: opening an e-mail, copying a code, etc.

Manual steps in the MFA process are usually the main factor against its adoption. What if it was easier, quicker, simpler?

<include src="TweetQuote" quoteText="What if MFA was easier, quicker, simpler? Enter Auth0 Guardian"/>

## Enter Auth0 Guardian
Auth0 Guardian is our iOS and Android app for multifactor authentication. The best of it: it can work using push-notifications. That's right, no more SMSs or manual codes. Here, have a look:

<video autoplay loop>
 <source src="https://embed-ssl.wistia.com/deliveries/3184dc67e9683a143efbfdb260d8059869594744/mfa-hero-loop.mp4%E2%80%9D"/>
</video>

If you are a security conscious user, you can get a glance at the login request details:

![Auth0 Guardian login request details](https://images.ctfassets.net/23aumh6u8s0i/1GXD08vA05ohqRMNZubKK7/f8db03009b42f2633dc8e63c306ee9eb/defense-iphone-3)

Even better, you are *not* required to rely on Auth0 Guardian to perform a successful MFA login! That's right, Auth0 Guardian integrates with traditional MFA systems, such as SMS, Google Authenticator and Microsoft Authenticator.

Here's the full enrollment and login process:

<video autoplay loop width="600">
 <source src="https://cdn.auth0.com/blog/guardian/guardian-2.m4v"/>
</video>

## How can I use it?
Take a look at the [docs](https://auth0.com/docs/multifactor-authentication/guardian). But here's the deal, to enable it you just need to click a toggle:

![Enabling Auth0 Guardian](https://images.ctfassets.net/23aumh6u8s0i/5QngrxnuyVTdOSLgON7kh6/d8b489ae32ed8de0f7d4880e20e41a8f/enable)

If you want to limit MFA only to certain clients, you can edit the associated rule in that same page. For more information about Auth0 rules, read the [docs](https://auth0.com/docs/multifactor-authentication/guardian/dev-guide). You may also need to setup a SMS provider, in case you want to provide users with that alternative. This all explained in the [administrators's guide](https://auth0.com/docs/multifactor-authentication/guardian/admin-guide).

<a href="https://auth0.com/signup" data-amp-replace="CLIENT_ID" data-amp-addparams="anonId=CLIENT_ID(cid-scope-cookie-fallback-name)">Sign-up now</a> and start using Auth0 and Guardian for free!

"multifactor"