andrew-akers

I'm a product marketing manager who loves learning about technology, information security, and identity. My goal is to turn that knowledge into positive outcomes for our customers. Before Auth0, I was a product marketing manager at Cisco in the network security division. In my spare time, you can find me spending time with my family, reading, writing, and working on endless home improvement projects.

Product Marketing Manager

Andrew Akers

The technology remains the cornerstone of Auth0 security



On Nov. 5, 2020, Auth0 announced the deprecation of Auth0 Signals brand, the Apility.io API, and the IP Signals API. This change will not impact Auth0’s core product functionality, but it will affect anyone using the Apility.io and IP Signals APIs. Specifically, the API endpoints signals.api.auth0.com and api.apility.net.

The Apility.io and IP Signals APIs will be fully deprecated on **Feb. 8, 2021**.

Signals represented the various datasets Auth0 uses to fuel product capabilities such as [bot detection](https://auth0.com/blog/new-bot-detection-feature-by-auth0-reduces-effectiveness-of-credential-stuffing-attacks-by-up-to-85/) and [breached password detection](https://auth0.com/breached-passwords). These datasets are correlated via our Attack Protection engine to produce confidence scores used by a variety of features. In addition, we offered some of these datasets freely via public APIs.

The technology behind Auth0 Signals remains a cornerstone of our current and future security capabilities for the core Auth0 product. There will be no loss of functionality for the core Auth0 product.

However, to continue operating these APIs publicly would have required significant development resources. These development resources will now focus on improving on creating new security capabilities in our core Auth0 product.

While most of the Apility.io and Signals web properties are being deprecated today, the APIs and [documentation](https://auth0.com/signals/docs/) pages will remain live until Feb. 8, which is the final deprecation date.

### How are you affected, and what action do you need to take?

If you are using the API endpoints [signals.api.auth0.com](http://signals.api.auth0.com) and [api.apility.net](http://api.apility.net), [we recommend reading the Auth0 Attack Protection documentation to find an alternative to your specific use case](https://auth0.com/docs/anomaly-detection). The APIs listed above will no longer be available as of Feb. 8, 2021. Any calls made to these APIs after then will result in a 404 HTTP error or name resolving failure.

While we encourage signing up to become an Auth0 customer to further use the features you’ve grown to rely on, there are several different API services available not affiliated with Auth0 that may fulfill your needs. For example:

**IP address blocklists:**

* [https://www.blocklist.de](https://www.blocklist.de)
* [https://www.stopforumspam.com](https://www.stopforumspam.com)
* [https://www.abuseipdb.com](https://www.abuseipdb.com)
* [http://iplists.firehol.org](http://iplists.firehol.org/)
<br /><br />

**Domain blocklists:**

* [https://github.com/dpup/freemail](https://github.com/dpup/freemail)
* [https://github.com/ivolo/disposable-email-domains](https://github.com/ivolo/disposable-email-domains)
<br /><br />

**Email blocklists and verification:**

* [https://www.emailchecker.com/](https://www.emailchecker.com)
<br /><br />

**IP Geolocation / AS search:**

* [https://ipinfo.io](https://ipinfo.io)
<br /><br />

<include src="asides/AboutAuth0" />


Auth0 Sunsets Signals

antoniofuentes

Antonio is a Product Manager in charge of features and functions used by thousands of customers implementing identity systems to keep their users safe and prevent malicious activity.

Product Manager, Continuous Auth

Antonio Fuentes

How Auth0 uses risk signals to detect and help you manage scripted, high-volume attacks on your identity flows



## The Problem

Attacks on an identity infrastructure using stolen credentials are a difficult problem to solve. [Credential stuffing attacks](https://auth0.com/blog/what-is-credential-stuffing/) occur when a bad actor sends scripted, automated login attempts to an application or website in extremely high volumes, with the objective of gaining access to user accounts. This is an increasingly common problem: on any given day, up to 69% of login attempts on the Auth0 infrastructure are suspected to have originated from credential stuffing attacks. 

This type of attack can be quite sophisticated. Sometimes they come in the form of hundreds of thousands of login requests to a site in a short time window, at a very high velocity, and from a relatively small number of IP addresses from unusual locations. They can also come in the form of scripts that send traffic using tactics to dynamically evolve their velocity, location, and number of IP addresses to avoid detection.  

Generally, solving this problem involves a tradeoff between usability and security, in which user experience pays the price. Measures like multi-factor authentication (MFA) are effective in limiting the success rates for a script involved in a credential stuffing attack, but they also add friction for legitimate users. 

To tip the scale in favor of user experience, malicious bots and scripts need to be detected and rejected before a login call is even processed by the authentication server. Doing so enables you to limit the impact of credential stuffing attacks while delivering a better experience for the end user. 

## Bot Detection from Auth0

Auth0 is launching Bot Detection, the first in a series of features to detect credential stuffing attacks on the login flow. Once enabled, this feature will use a variety of signals to assess the likelihood that a login call originates from a scripted attack. If the risk assessment is high, a CAPTCHA step is inserted into the login flow. 

![Bot Detection](https://images.ctfassets.net/23aumh6u8s0i/3Fs7MAvNuLZTFJ20QOSw6m/63bf1b065314dd2bea4a7451782dfb6b/bot-detection-anomaly)

Bot Detection will be supported at launch with Auth0’s Universal Login experience. For customers who have built more customized user experiences using native SDKs such as `lock.js` and mobile SDKs such as a `lock.Android` and `lock.swift`, Auth0 will support an exception scenario so that customers can recognize a risky call and take steps to render a CAPTCHA step on the screen. The feature will also support presenting CAPTCHA using a generic flow or a customer’s own Google reCAPTCHA.

<table>
<tbody>
<tr>
<td><img src="https://images.ctfassets.net/23aumh6u8s0i/1sos7fOgZYGp148983HyH5/809ea54d105104de83c2e922fe22de7f/bot-captcha" alt="Bot Detection-1" width="396" height="602"/></td>
<td><img src="https://images.ctfassets.net/23aumh6u8s0i/1U3FsuEZ0rHL9kDNQv17J5/cb207f20b5eb8b676f1b2549866456dd/bot-captcha-2" alt="Bot Detection-2" width="382" height="735"/></td>
</tr>
</tbody>
</table>

## Mitigating Abuse with Auth0

Bot Detection will be the latest addition to Auth0’s collection of features designed to prevent abuse, including [Breached Password Detection](https://auth0.com/docs/anomaly-detection/breached-password-security), [Brute Force Protection](https://auth0.com/docs/anomaly-detection/brute-force-protection), and [MFA](https://auth0.com/docs/mfa). These features help customers mitigate the tradeoffs between security and usability without unnecessary compromises to user experience. 

## Learn More

* [Credential Stuffing Attacks: What They Are and How to Combat Them](https://auth0.com/resources/whitepapers/credential-stuffing-attacks)
* [The Anatomy of a Credential Stuffing Attack](https://auth0.com/resources/webinars/credential-stuffing-attack-webinar)

Auth0 is the first identity management platform for application builders, and the only identity solution needed for custom-built applications. With a mission to secure the world’s identities so innovators can innovate, Auth0 provides the simplicity, extensibility, and expertise to scale and protect identities in any application, for any audience. Auth0 secures more than 100 million logins each day, giving enterprises the confidence to deliver trusted and elegant digital experiences to their customers around the world.
<include src="asides/AboutAuth0" />


Reducing the Impact of Credential Stuffing Attacks

diego-parrilla

Diego is a Security Software Architect at the Office of the CTO team (OCTO). It has been a long journey since his dad bought his first eight-bit computer in the early 80s. He joined Auth0 after the acquisition of Apility.io in October 2019, and now he is looking for new ways to improve how Auth0 detects and stops potential threats. When he's not working, Diego loves participating in open source communities, riding his mountain bike, listen 80s and 90s hard rock music, watching NBA games, and traveling with his wife and teenage daughter.

Security Software Architect at OCTO

Diego Parrilla

Assess your users' reputation using the Auth0 Signals Email Verification API.



<div class="alert alert-info alert-icon">
  <i class="icon-budicon-487"></i>
  <strong>Important Information</strong><br> 
  <b>The Apility.io and Signals web properties and public APIs are no longer available. For more details, please refer to this <a href="https://auth0.com/blog/auth0-sunsets-signals/">blog post</a>.</b><br> 
</div>

**TL;DR:** How often do you feel that there is something wrong with the email address of that new customer? The username and the domain look suspicious. With the new risk assessment features of the Email Verification API, you can get enough insights to make informed decisions about your users in real-time.

## The Problem

There is a rising wave of abusers that sign up to services offering freemium or free-trial. Typically they want to exploit the resource you offer (compute, streaming, APIs, etc). The tension lies between converting more vs stopping these abusers.

One way to stop them, without introducing much friction, is to verify if their email is legitimate (without sending all users an email). This is what the Auth0 Signals Email Verification API provides.

## What is the Auth0 Signals API?

The [Auth0 Signals API](https://auth0.com/signals) is a standalone free service for the community. The service consists of an HTTP API that allows you to detect the reputation of an Email address or the IP address. The API checks the Email and/or IP address against several public denylists to evaluate its reputation. It responds with data about the originator and a score indicating the reliability level of the Email or IP address. Having this information enables you to detect malicious activities proactively.

## When to use Email Verification signal?

The Email Verification signal provides a continually curated and accurate Email reputation data. It takes the hard work out of consuming Open-Source Intelligence (OSINT) by curating, parsing, and normalizing numerous denylists. Auth0 uses this data to protect its own service.

There are two main use cases for this API:

- **Real-time risk assessment:** Developers can embed into their code requests to the API and detect malicious activity proactively, not reactively. For example, automatically checking Email reputation during the authentication flow. With a disclaimer that it’s free, no SLA and rate limits are in place.
- **Incident response and forensics:** When security experts identify an incident, they begin investigation and response processes to determine if a genuine security incident occurred, its scope, and the best way to remediate the threat. The API and some assessment tools will become part of the Security professionals swiss army knife.

Auth0 Email verification signal enables all users to obtain a score that indicates the risk level of an analyzed Email address. The overall process involves an in-depth analysis of each email,  combining several validation techniques based on custom-built algorithms scoring the legitimacy of an email. Clean and valid email addresses will have a neutral score. Suspicious addresses will have a negative rating: the more negative the score, the more probability of being an address with a low reputation.

## How does the Email Verification API work?

First [sign up in Auth0 Signals and get an API Key](https://auth0.com/signals). If you have any doubt, you can [read this short tutorial detailing all the steps](https://community.auth0.com/t/how-to-obtain-an-auth0-signals-api-key/42048)
The [API documentation in the Auth0 Signals site](https://auth0.com/signals/docs/#email-verification) explains how to use the service with or without an API Key. For example, let’s get the score for the email ```test@example.com```. We will assume that ```example.com``` is a very well known [Disposable Email Address](https://en.wikipedia.org/wiki/Disposable_email_address) provider, so it should have a negative rating. To test the API, we will use the command ```curl```. The requests need two parameters: the Auth0 Signals API Key and the Email to analyze. It’s also possible to add parameters in the query string to tweak how the service works.

```shell
$ curl -i -H "Accept: application/json" -H "X-Auth-Token: API_KEY" -X GET "https://signals.api.auth0.com/bademail/test@example.com"
```

or

```shell
$ curl -H "Accept: application/json" -X GET "https://signals.api.auth0.com/bademail/test@example.com?token=API_KEY"
```

the JSON response will be:

```
{
   "response":{
      ...
      "score":-3,
      "email_address":"test@example.com"
   },
   "type":"bademail"
}
```

We have trimmed the JSON object of the response to make this post more readable, but you can [read the full JSON response in the documentation](https://auth0.com/signals/docs/#email). The global score is ```-3```. That’s a bad score. Let’s see how the scoring formula works in detail.

## The scoring formula explained

The global score or confidence score is the sum after analyzing different parameters of the Email address. These are the possible values:

- **0:** Auth0 Signals is neutral about the Email address given. It means the service cannot find the Email address in any given individual service and cannot classify the Email as risky.
- **-1:** Auth0 Signals has detected the Email address in one of the checks.
- **lower than -1:** Auth0 Signals has detected the Email address in two or more checks. The lower the score, the riskier the Email.

The possible values range between -3 and 0, and there are no positive values because the algorithm does not calculate confidence levels, but rather levels of DISTRUST.

The email verification process analyzes different elements of an email address assigning a neutral or negative score for each part:

- **Address:** If any of these checks fail, the score of this test is -1.
  - **Address Syntax:** This check removes improperly formatted email addresses. It must adhere to [IETF standards](https://tools.ietf.org/html/rfc2822).
  - **Role-Based Account:** Email sent to role-based such as postmaster@, info@, sales@, admin@, etc. can negatively impact the deliverability, and even some ISPs will block them. This process detects and flags such addresses.
- **Domain:** test for the MX domains, and NS domains. If any of these checks fail, the score of this test is -1.
  - **Domain banned:** The process searches the domain in different deny lists. To be a clean domain, it must not appear in any of them.
  - **MX domain banned:** It searches the MX domains in different deny lists too. Clean MX domains must not appear in any of them.
  - **NS domain banned:** It searches the NS domains in different deny lists too. Spammers use very well-known suspicious Nameservers, and we also can block them.
- **Free Email Service:** detects emails hosted by Free Email Services like (Google, Yahoo, Hotmail/Microsoft, etc.). Since this is a very aggressive option, the algorithm does not compute the result as negative, but it flags the email to help users to make a decision.
- **Disposable Email Address:** Throwaway/disposable email addresses, or “junk collector” email addresses" are detected and processed appropriately. It is a widespread threat indicator of bad actors using them to bypass signup forms or login forms that require a valid email address. The score for this test is -1.
- **Banned Email Address:** If the Email address belongs to some of our Email Abuse deny lists, then the score for this test is -1.
- **SMTP Verification:** Performs deep-level extended SMTP verifications on the email address. The process pings the addresses for mailbox existence without sending an actual email to the inbox. It will also check the validity of the MX records and will test if the server implements a catch-all policy. The score for this test is -1 for any of them.
- **Lookup IP in OSINT deny lists:** The algorithms check the email addresses and IP addresses against known DNSBLs and RBL to trap spam networks. The score for this test is -1 for any of them.

## Using the Email Verification API in your application

It’s perfectly fine to use the API in your own services. If you are a developer, here goes some hints to get the most of the Email verification service:

- You can verify 4,000 emails in a 24-hour range. Use your quota wisely.
- The global score or confidence score should be considered an important signal. Still, we strongly recommend reviewing the different individual scores as you process production traffic to better understand the email address's reputation for your use case. Our general-purpose scoring formula can be too generic for some use cases.   
- You can ignore the global score and focus on individual tests. For example: if you want to detect emails from Free Email providers, you can check the ```freemail``` object in the JSON and ignore the rest of the response.
- Have a look at the [Querystring parameters](https://auth0.com/signals/docs/#check-if-an-email-scores-a-negative-or-neutral-score). This can help you adjust the results to your specific needs. 
- Auth0 Signals is free for all and offered 'as is' with no SLA. This means you should make your code resilient in case the API stops responding.
- For production-grade usage use the Auth0 service that includes Signals built-in. 

## The Email Verification tools: Slack Bot
The [Signals Slack Bot](https://auth0.com/signals/ip#signalsbot-slack-landing) is a new tool built on top of the Signals API for Cybersecurity Professionals, SecOps, analysts, and forensics teams willing to use the bot to get the most of the API without having to write a single line of code. The tool uses the Email Verification and IP Reputation APIs combined with some interactive features to drill down on the data. The installation is very straightforward following the [instructions on our community site](https://community.auth0.com/t/auth0-signals-slack-bot/45216).

![The installation page of the SignalsBot App](https://images.ctfassets.net/23aumh6u8s0i/1MhWa1qfDbbAaxaSMG1xcc/b5d1cb6ebfb99b28824293dee6c4ac3f/signals-installation-page)

Once the Slack Bot is installed and configured, any member of the Slack workspace can go to the SignalsBot in the Apps section and click on the Messages tab at the right-hand side of Home and execute the ```email```(lowercase) command with the email to analyze:

![Auth0 Signals Email verification score](https://images.ctfassets.net/23aumh6u8s0i/4jQkOPsEDZy6FopipmFhQj/38d05be24c61028cfcc372cd68875954/signals-email-score)

## Summary

The Email Verification API is a powerful tool to prevent and mitigate sign-up and sign-in abuse at different stages. If the API integrates with the existing authentication workflow it can help to detect potential low-quality users. When the API or the tools are in the hands of Security professionals it can help SecOps teams perform threat intelligence duties more effectively. Be sure to [check out the documentation](https://auth0.com/signals/docs) for more details.

## Join the community!

[Check out the Auth0 Signals community](https://community.auth0.com/c/auth0-signals/78). Go there to interact with other security professionals, get help on incident response actions, or learn more about digital abuse.


Introducing Auth0 Signals Email Verification API

auziros:jeana-tahnk

Jeana has been in the tech industry for 15+ years, both as a communications professional and writer. As Director of Global Communications at Auth0, she works with her internal team and external agencies to amplify the company's visibility worldwide and establish its leadership in the identity industry. When she is not working, she can most likely be found on a field watching one of her three kids playing sports, or cleaning up after her one-year-old retriever who chews everything.

Senior Director, Global Communications

Jeana Tahnk

Auth0 acquires Apility.io to integrate IP reputation in Anomaly Detection capabilities; and launches Auth0 IP Signals, a free standalone API



<div class="alert alert-info alert-icon">
  <i class="icon-budicon-487"></i>
  <strong>Important Information</strong><br> 
  <b>The Apility.io and Signals web properties and public APIs are no longer available. For more details, please refer to this <a href="https://auth0.com/blog/auth0-sunsets-signals/">blog post</a>.</b><br> 
</div>

**BELLEVUE, Wash. – March 12, 2020 –** The [Auth0](https://auth0.com/) Identity Platform, a product unit within Okta, today launched [Auth0 Signals](http://auth0.com/blog/new-ways-to-combat-automated-attacks-auth0-signals), a collection of threat intelligence tools and product capabilities designed to protect customers from identity attacks. Auth0’s acquisition of Apility.io, an anti-abuse company, provides a crucial source of IP threat intelligence to Auth0’s Anomaly Detection engine, which detects malicious and risky login traffic to protect customers from automated attacks, such as credential stuffing and fake account creation. [Auth0 IP Signals](http://auth0.com/signals/ip) is a free tool available for anyone to use, and will be fully integrated into Auth0’s core authentication platform in Q2 2020. 

Auth0 Signals provide important new sources of threat intelligence to Auth0’s Anomaly Detection engine, which already thwarts attacks from more than [50,000 unique IP addresses](https://auth0.com/blog/auth0-reveals-50000-credential-stuffing-attempts/) every day. The continual analysis of numerous risk signals – such as IP reputation, use of breached passwords, and failed authentication volume – assesses the risk of a transaction, login attempt, or session. The collective data gathered from Auth0 Signals produces a Confidence Score that Auth0’s platform then uses to prompt adaptive authentication, or intelligent and dynamic enforcement of controls, such as multi-factor authentication or blacklisting, based on risk.  

Auth0 IP Signals is a curated and constantly updated IP address reputation search engine and API. Its threat database is constantly maintained via a variety of data sources across the web and deep web, including Open Source Intelligence (OSINT). It provides security practitioners with a comprehensive way to proactively identify fraudulent IP addresses and verify IP and email reputation, which can be used to prevent credential stuffing attacks and synthetic account creation. These types of attacks result in an average of more than [$6 million a year in costs per company](https://auth0.com/resources/whitepapers/credential-stuffing-attacks). Auth0 IP Signals is an extension of the company’s history of providing valuable resources for free to its loyal developer community.

“Security and availability are the top priority for our business. We integrated the Auth0 IP Signals API in just hours, and it started blocking abuse right away,” said Guillermo Rauch, CEO of Vercel. “Auth0 Signals helps us ensure a great service to our customers, and helps save money and resources. The best part is that it continues to improve behind-the-scenes on its own.” 

Gartner has introduced a Trusted Identity Corroboration Model (TICM) in its September 2019 Market Guide for Identity Proofing and Corroboration. According to Gartner, “TICM is a conceptual framework that assists SRM (Security & Risk Management) leaders to choose a set of tools and techniques that maximizes the collection of multiple risk indicators to identify fraudulent and malicious activity during account creation, access, and maintenance.” Further, “the continued reliance on static data, public records, or credit bureau data alone to either establish or substantiate trust in an identity is no longer simply unadvisable; it has become negligence. Likewise, a refusal to invest in the gathering and assessment of negative and positive signals puts the burden of security on customers, which is increasingly unacceptable in a world that demands frictionless and secure interactions with businesses and organizations.”

As a central authentication and security service securing more than 100 million logins every day for enterprises around the globe, Auth0 has a unique vantage point for observing trends, where they originate from, and more importantly, knowing how to identify and block them before any damage is done. Recent internal data from Auth0 revealed that up to 67% of traffic going through Auth0 at any given time is suspicious, and 6% of IPs sending traffic to Auth0 are known to be blacklisted on the web, yet they are sending 50% of the total traffic to Auth0. Auth0 Signals will help block that fraudulent traffic from breaking into user’s accounts.

“Credential stuffing, password spraying, phishing, and other malicious attempts are constantly multiplying, and customers need more risk signals than any one company can provide, which is why we’ve created Auth0 Signals,” said Matias Woloski, CTO and co-founder of Auth0. “We have always been a developer-centric company, and wanted to provide a free resource to the application builder community for added value and security. By inserting threat intelligence and risk analysis into the IAM system, we’re reducing identity attack opportunities, offering a frictionless experience, and saving critical time and money for our customers.”

Apility.io is Auth0’s first acquisition, bolstering the company’s security strategy to protect against automated cyberattacks, and underscoring its focus on best security practices to keep customers’ information safe and their experiences seamless. 

Additional Auth0 Signals threat intelligence tools will be launched in 2020, and will be freely available to security practitioners for proactive abuse prevention and incident investigation. To learn more, please visit: [http://auth0.com/signals/ip](http://auth0.com/signals/ip).

<include src="asides/AboutAuth0" />

### Media Contacts
Jeana Tahnk<br>
Corporate Communications<br>
Auth0<br>
[jeana.tahnk@auth0.com](mailto:jeana.tahnk@auth0.com)

Hannah Carroll<br>
Matter for Auth0<br>
[auth0@matternow.com](mailto:auth0@matternow.com)<br>


Auth0 Signals: New Threat Intelligence to Protect Customers from Cyberattacks

0cd73f2f2f39709bd03646e9225cc3d3?s=200 avatar

0cd73f2f2f39709bd03646e9225cc3d3?s=200

I’m an engineer with a passion for building frictionless products. I’ve built effective teams and have grown them into successful engineering organizations. I like to forge a culture.

CTO and Co-founder

Matias Woloski

We acquired Apility.io, an anti-abuse API company that will help us bolster our security strategy to protect against automated cyberattacks.



<div class="alert alert-info alert-icon">
  <i class="icon-budicon-487"></i>
  <strong>Important Information</strong><br> 
  <b>The Apility.io and Signals web properties and public APIs are no longer available. For more details, please refer to this <a href="https://auth0.com/blog/auth0-sunsets-signals/">blog post</a>.</b><br> 
</div>

Today we are announcing the acquisition of Apility.io, an anti-abuse API company. This is our first acquisition, bolstering our security strategy to protect against automated and targeted cyberattacks, including credential stuffing and sophisticated phishing attacks.

Apility.io is now a part of Auth0 Signals, a new collection of dynamic data feeds that fuels [Auth0's Anomaly Detection Engine](https://auth0.com/learn/anomaly-detection/) to detect and prevent sophisticated cyberattacks. In addition, part of Auth0 Signals will be made available as a community version via free APIs to help anyone better protect themselves from threat actors.

**To try out Auth0 IP Signals, our first free Signals API, visit [auth0.com/signals/ip](https://auth0.com/signals/ip)**

## What is Auth0 Signals?

Auth0 Signals is a collection of dynamic data feeds that enable our adaptive authentication pipeline to produce high-quality user confidence scores.

Our authentication pipeline processes an ever-expanding number of Signals to assess the risk of a login attempt, account creation, token refresh, or elevation of privilege. It then produces a confidence score. Using this score, Auth0 and our customers can perform risk-based adaptive authentication decisions.

<script src="https://fast.wistia.com/embed/medias/h5fqhdgsep.jsonp" async></script><script src="https://fast.wistia.com/assets/external/E-v1.js" async></script><div class="wistia_responsive_padding" style="padding:74.37% 0 0 0;position:relative;"><div class="wistia_responsive_wrapper" style="height:100%;left:0;position:absolute;top:0;width:100%;"><div class="wistia_embed wistia_async_h5fqhdgsep videoFoam=true" style="height:100%;position:relative;width:100%">&nbsp;</div></div></div>
<br>

## Introducing Auth0 Signals Community Version

Today we are introducing a standalone community version of part of the signals we use in our pipeline. More specifically, the **IP reputation signal**. This comes from our acquisition of Apility.io and provides a continually curated and accurate IP, email, and domain reputation data. It takes the hard work out of consuming Open-Source Intelligence (OSINT) by curating, parsing, and normalizing numerous blacklists from across the dark web. We use this data to protect our own infrastructure.

![DIAGRAM](https://images.ctfassets.net/23aumh6u8s0i/5hDiy0cE8lezc61zjwTGnt/168830a9782a26dc67f38d74db746504/diagram-blacklist)

## Why Did We Build Auth0 Signals?

Auth0 Signals and anomaly detection are the foundation of developing a robust adaptive authentication system, ultimately enhancing our continuous authentication capabilities. The goal of adaptive authentication is to continually adapt to a changing threat landscape instead of using a simple rules-based system to block specific interactions.

For example, simple brute force protection usually relies on blocking high-velocity requests above a certain threshold, such as 100 authentication attempts per minute for a single IP address. The problem with this approach is threat actors can create scripts to identify this threshold and then adapt their botnet to operate below it. Effective adaptive authentication takes other risk signals into account, such as IP reputation data.

One of the most pressing threats Auth0 Signals will help address is [credential stuffing attacks](https://auth0.com/blog/what-is-credential-stuffing/). In credential stuffing attacks, threat actors use stolen credentials from one breach to break into users' other accounts. [This is effective because 65% of people reuse passwords across multiple accounts, according to Google](https://www.forbes.com/sites/daveywinder/2019/02/05/google-reveals-a-big-problem-with-passwords-on-safer-internet-day/#297a05f85e0b). Even the largest companies are vulnerable if they don't have the right preventative measures in place.

As a central authentication service that processes billions of logins per month, we are in a good position to observe trends in credential stuffing attacks targeting our customers' identity implementations. [On some days, these attacks originate from more than 50,000 IP addresses and may account for as much as half of all login attempts using our platform](https://auth0.com/resources/whitepapers/credential-stuffing-attacks).

Auth0 Signals, coupled with the Anomaly Detection Engine, will detect these attacks with a high degree of efficacy early in the authentication pipeline. IP addresses identified as participating in a credential stuffing attack will be forced to solve a CAPTCHA, which addresses the vast majority of these attacks.

## Try the API Now. It's Free!

Auth0 IP Signals will assist security analysts with incident response and forensic investigations, as well as provide application security engineers with proactive abuse prevention accessed via an API.

<script src="https://fast.wistia.com/embed/medias/v6ilxd3jhu.jsonp" async></script><script src="https://fast.wistia.com/assets/external/E-v1.js" async></script><div class="wistia_responsive_padding" style="padding:60.83% 0 0 0;position:relative;"><div class="wistia_responsive_wrapper" style="height:100%;left:0;position:absolute;top:0;width:100%;"><div class="wistia_embed wistia_async_v6ilxd3jhu videoFoam=true" style="height:100%;position:relative;width:100%">&nbsp;</div></div></div>
 <br>
 
### Incident response and forensics 

When a security incident is identified, security analysts begin investigation and response processes to determine if a legitimate security incident occurred, the scope of the incident, and the best way to remediate the threat.

Using the _Auth0 IP Signals_ tool, security analysts can submit IP addresses involved in such incidents to quickly identify traffic from known threat sources.

### Abuse prevention

Using _Auth0 IP Signals API_, security professionals can detect malicious activity proactively, not reactively. For example, automatically checking IP reputation during the authentication flow can help prevent common threats, such as credential stuffing attacks.

## Final Thoughts

Last year, I wrote about [our vision for our identity platform](https://auth0.com/blog/the-developer-first-identity-platform-auth0-story-and-future/) and how we want to help security professionals by providing them with a single pane of glass that alerts them and self-remediates any sort of identity attack. This is a step towards fulfilling that vision. I am very excited about what's coming this year to help you all making your applications safer.

**To try out Auth0 IP Signals, our first free Signals API, visit [auth0.com/signals/ip](https://auth0.com/signals/ip)**


New Ways to Combat Automated Attacks: Auth0 Signals

99c4080f412ccf46b9b564db7f482907?s=200 avatar

99c4080f412ccf46b9b564db7f482907?s=200

I'm currently a Senior Developer Advocate at MongoDB. I'm also a Google Developer Expert for Web Technologies and spend most my time giving talks at conferences and meetups, mentoring developers and running workshops, and creating online content to help technology professionals.

Former Auth0 Employee

Ado Kukic

Network, catch up on all the big announcements, and grab some swag at Rogue Ales Pub House. The happy hour hosted by Auth0, Algolia, and Keen IO is happening right after the talks end on May 24, 2017.



[Signal.2017](https://www.twilio.com/signal) is less than two weeks away and we can't wait to see what Twilio and the numerous vendors attending will have to show. The two-day conference kicks off May 24 and will be held at Pier 27 in San Francisco, California. After a long day of invigorating sessions including: [IFTTT: Building applications for the future](https://www.twilio.com/signal/schedule/7sIpsjOkTewgygqY86Sc0Y/ifttt-building-applications-for-the-future) by [Linden Tibbets](https://twitter.com/@ltibbets), [Congress on Speed Dial: Advocacy in the age of Twilio](https://www.twilio.com/signal/schedule/6LbXCBBhtYuKCSciyS8WA/congress-on-speed-dial) by [Ian Webster](https://twitter.com/@iwebst), and [What Can You Do With Twilio Voice?](https://www.twilio.com/signal/schedule/4r1gBAICZOAQGEAAascQSi/what-can-you-do-with-twilio-part-2) by [Manav Khurana](https://twitter.com/@manavkhurana), join Auth0, Algolia, and Keen IO as we host a special happy hour for Signal.2017 attendees.

![Signal Website](https://images.ctfassets.net/23aumh6u8s0i/10qrmp8n7s4gPXO0v98RNW/a1096d585fc0d8911d53703d80b15406/signal)

The happy hour will be a great opportunity to meet and network with fellow attendees, talk about all the new announcements, and get some swag. Food and drinks will be provided courtesy of Auth0, Algolia, and Keen IO.

**What**: Auth0, Algolia, and Keen IO Happy Hour

**Where**: Rogue Ales Public House, 673 Union Street, San Francisco, CA 94133

**When**: May 24, 2017 at 7:30pm - 9:30pm

**How**: [RSVP](https://www.eventbrite.com/e/rogue-ales-happy-hour-by-algolia-auth0-and-keen-io-tickets-34586663642) to reserve your spot as space is limited

We can't wait to see you there!

<include src="asides/AboutAuth0" />

### About Algolia

Algolia helps developers connect their users with what matters most. Our hosted search API powers billions of queries for thousands of websites & mobile applications every month, delivering relevant results in an as-you-type search experience in under 100ms anywhere in the world. Algolia's full-stack solution takes the pain out of building search; we maintain the infrastructure & the engine, and we provide extensive documentations to our dozens of up-to-date API clients and SDKs with all the latest search features, so you can focus on delighting your users.

For more information visit [https://www.algolia.com](https://www.algolia.com) or follow [@algolia](https://twitter.com/algolia) on Twitter.

### About Keen IO

Over 60,000 developers use Keen IO APIs to capture, analyze, and embed event data into their tools and products. Thousands of customers rely on Keen’s event data platform to white label data applications in media, e-commerce, adTech, gaming, IoT and retail. Keen’s customers query trillions of data points daily. Keen IO also values and promotes empathy, introspection, distributed innovation, continuous learning, playing to your strengths, and patching your weaknesses with diverse collaborators.

For more information visit [https://keen.io](https://keen.io) or follow [@keen_io](https://twitter.com/keen_io) on Twitter.


"signal"