arthur-bellore

I’m a tech content creator. I enjoy breaking up seemingly complicated topics into easy-to-understand pieces for people to read. When I’m not in front of a computer, you’ll usually find me reading books.

Cybersec Writer

Arthur Bellore

Why hardware-based Two-Factor Authentication makes the user much more secure over other multi-factor alternatives

When I wrote about how software 2FA is a step-up from SMS 2FA, I also mentioned how there’s one attack vector that software 2FA is still vulnerable to phishing. It’s the **user** who must verify they are entering the passcode into the legitimate website, and bad actors exploit that.

Phishing is a hard problem to solve because the bad actor exploits human behavior that has been ingrained in all of us for the last couple hundred thousand years and will probably continue to be for a long time in the future.

Everybody is prone to fall for phishing campaigns, even security-conscious people, because these attacks are never head-on, explicit attacks, but sneaky ones and when you aren’t expecting them.

And if we look at types of attacks over the years, there is a clear trend: the number of websites containing malware has been declining, while the number of phishing websites skyrocketed in the last few years. You can see that in the chart below:

![01_bleeping_computer](https://images.ctfassets.net/23aumh6u8s0i/5Z7X9Z3Dm07lEvbjtubPO1/6c57ba7fc4b4458c6a995463e6a39ee6/01_bleeping_computer.jpg)
Source: <a href="https://www.bleepingcomputer.com/news/security/google-chrome-uses-safe-browsing-to-improve-phishing-protection/">Bleeping Computer</a> via <a href="https://transparencyreport.google.com/safe-browsing/overview">Google Transparency Report</a> (archive)


Attackers are becoming more **proactive** and trying to **force errors**. With more devices connected to the Internet, these attacks become more profitable (we’ve seen a [surge during the last few years](https://www.f5.com/company/news/features/phishing-attacks-soar-220--during-covid-19-peak-as-cybercriminal)), and now more companies are starting to pay attention to phishing attacks.

Taking the human element out of security is not an easy task, but that is what Universal 2nd Factor, or U2F, tries to do — it’s an open protocol for second-factor hardware keys that doesn’t rely on the user to make sure he’s on the right website; there is a built-in mechanism on the key itself to verify that.

## How The U2F Protocol Was Created

In 2011, the founders of Stockholm-based Yubico would relocate to Silicon Valley to be in close contact with tech companies to further develop the protocol used by the YubiKey into a universal standard. 

> Note: many hardware tokens, such as the YubiKey 5, support more types of authentications on top of U2F (e.g., TOTP), but references to hardware tokens throughout this article refer specifically to U2F.

In that same year, they started discussions with Google’s internal security team and together identified YubiKey as the best solution to solve the employee phishing problem Google was having at the time.

One year later, in 2012, Google and Yubico signed a partnership to co-create the U2F — an open standard for two-factor authentication based on public-key cryptography that would remove the need for the user to verify that they were, in fact, at the intended website. 

They tested the USB token Yubico had created with Google employees, and one year later, they joined the FIDO Alliance board and brought along with them the technical specifications to the protocol. The protocol continued to be improved over the years, being released publicly for Chrome and Gmail, along with many other products.

In 2019, the World Wide Web Consortium (W3C) announced Web Authentication API (WebAuthn), the new global standard comprising the implementation of FIDO U2F security keys in most modern browsers. By that time, [Google already eliminated phishing attacks by having its 85,000 employees use hardware tokens](https://krebsonsecurity.com/2018/07/google-security-keys-neutralized-employee-phishing/). 

## How Hardware 2FA (or U2F) Works

When you think of a real-world key, you probably imagine that the same key you use to _lock_ something is also used to _unlock it_. If you have a chest with all of your passwords stored inside, this setup works because you’re the only one who needs to access it.

But what would happen if you wanted to share a password securely with me (and only me)?

Well, here’s an option. I could get a chest and put it outside my door. Then I could leave the key on a key holder outside, and you would come over, put the password inside the chest, lock it, and put the key back on the key holder. As soon as I get back home, I would take the keys, open the chest, and pick up the password you put in there.

This approach is far less than ideal because we can’t be sure who else used the key to open the chest and read the password. I also can’t be sure that you, or anyone else, didn’t make copies of my key to open my chest.

The solution to this problem is **public-key cryptography**, and it’s the principle used by U2F tokens to authenticate users. In public-key cryptography, instead of using just one key, we use a pair of keys — if you lock the chest with a certain key, only the other key can unlock it.

![02_How_hardware_2fa_works](https://images.ctfassets.net/23aumh6u8s0i/1DZ5lxj8zLE6vu3vluVADj/1f79e96a559d9b0eecdce2603be22efa/02_How_hardware_2fa_works.jpg)

Now I can keep one key — my private key — and put the other one outside for you to use — the public key. And since only my private key can unlock the chest, once you lock it, no one else can use the key I left outside to peek inside the chest.

In cryptography, these keys are called a **key pair** and are mathematically linked. I could create as many public keys from a private key as I wanted, but you can’t recreate my private key from a public key.

Key pairs can be created using software, but in the case of U2F, the private key is **generated using a unique secret that is embedded during the manufacturing process and can never leave your U2F token**, which is what makes it so secure.

The process to start using U2F in an account is simple and happens in two steps: registration and authentication.

## Registration

This step involves four parties:

- the user, 
- the hardware token, 
- the client (e.g., a browser), 
- and the remote server. 

To register a security token, the user needs first to authenticate through another method, e.g., with username and password, or while he’s creating the account for the first time. After the user signals they want to register a U2F token, the server sends a challenge — a random number — and an AppID to the user’s device.

The AppID is a unique identifier for the app — on a browser, the AppID is the URL, like `auth0.com`. On Android, it’s going to look something like `android:apk-key-hash:<hash-of-apk-signing-cert>` and on iOS, something like `ios:bundle-id:<ios-bundle-id-of-app>`.

Once this information is received, the user will be prompted to press a button on the hardware token to confirm the request. This will prevent remote attacks even if the key is inserted into the user’s device.

![03_registration](https://images.ctfassets.net/23aumh6u8s0i/2mGwrM5SqnQ6Jz8S5EQXCo/d1ae6f4bfae43541bae86596dfa8fe43/03_registration.jpg)
Source: <a href="https://www.yubico.com">Yubico</a>


The hardware token will generate a [nonce](https://en.wikipedia.org/wiki/Cryptographic_nonce) and hash it together with the AppID and the secret key on the token using HMAC-SHA256 to create a private key. From this private key, a public key is derived, along with a checksum. Check the diagram below:

The nonce and public key are sent back to the server to be stored for later when the user comes back to authenticate.

## Authentication

The user will normally authenticate with their login and password. The server will remember that this user has a security token registered and will generate a new challenge to send back along with the AppID and nonce created on the registration phase.

The browser will once again ask the user to press a button on their physical token, and the token will use the received information to re-create the same key pair is created during the registration phase.

If the information was sent from a legitimate server, it should result in the same public key since the secret inside the device didn’t change. The device will then encrypt the challenge sent by the server with the private key and send it back to the server.

However, because the domain is hashed together with the device secret, if you’re on a phishing website, the token will generate a different key, and the checksum will fail.

The challenge can only be decrypted by the public key created with that same private key, which the server already should have stored from the previous phase. The server will try to decrypt it using the public key it already has, and if the challenge matches with the one the server sent, the user is authenticated.

## What Makes Hardware 2FA Better than Software 2FA?

Hardware 2FA brings several security benefits over software 2FA. The most obvious one is phishing resistance. By using the website domain in the key generation process, the token assumes what normally would be a user responsibility — that of verifying that the website they are logging in to is legitimate.

It’s also more leak-resistant than software 2FA. We’ve seen that software 2FA works on the basis of a shared secret between user and server ahead of time, from which the passcode is derived. But if the shared secret is leaked from the server, anyone can use it to generate the correct passcodes.

If the user has secured their account with U2F, however, and the public keys and key handle on the server get leaked, the attacker still won’t be able to take over the account because he’d still need the private key to sign the payload and authenticate themselves.

Not only that, a U2F token can’t be exploited remotely by automated bots. Most keys require a physical touch on the device to sign the payload, so they aren’t vulnerable to the [brute-force attacks that can occur in improperly implemented TOTP systems](https://www.miknet.net/security/the-trouble-with-totp/) (e.g., not taking into consideration user behavior, geolocation, number of bad attempts before locking down the account for a determined amount of time).

In a scenario where the attacker has acquired a list of compromised passwords, brute-forcing any individual account by going over all possible 1,000,000 passcode possibilities is increasingly trivial with a big enough list:

![04_what_makes_hardware_2fa](https://images.ctfassets.net/23aumh6u8s0i/6ovPCcvrlpLnrKCviq4Ukw/8ed6038cb3408a799f5fa6cb54f1ac04/04_what_makes_hardware_2fa.jpg)
Source: <a href="https://www.miknet.net/security/the-trouble-with-totp/">The trouble with TOTP</a>.
 
An automated attack like that can’t happen on U2F-enabled accounts. Also, all cryptographic operations happen inside the token. By the time the private key leaves the token, it already has been hashed using SHA-256, so even if the user doesn’t know that the client is compromised, it’s still safe to use the token.

In terms of usability, in an [internal study at Google](https://research.google/pubs/pub45409/), they found that U2F allowed employees to authenticate as much as four times as fast as using an authenticator app.

And as with software 2FA, users can assign multiple tokens as backups in case they lose one — the only problem here is that each key additional key will cost money (presuming the user already had multiple devices in where to store the TOTP seeds), and considering the already low 2FA adoption rates, it’s something to be considered carefully.

In some cases, though, there might be a decrease in costs by mandating hardware tokens.

It’s what the study above found: initially, Google tested the YubiKey internally with 50,000 employees, and they found that not only internal accounts protected with YubiKey were much more likely to be secure, they also saw a 92% reduction in support incidents.

In the end, this allowed Google to _save money_ in support hours and costs related to compromised accounts by issuing multiple backups per employee.

In fact, requiring backups may also be one of the downsides of hardware 2FA: having no backups can be _extremely problematic_ if you lose your token. You’ll be at the mercy of the admins to let you in again — and in some cases, like in that of password managers where your vault is end-to-end encrypted, not even they can help you recover your account.

## Driving Up The Adoption Of U2F

The biggest problem with U2F right now is adoption — it’s low even among users who use any 2FA (according to [this 2018 report](https://www.theregister.com/2018/01/17/no_one_uses_two_factor_authentication), less than 10% of Gmail users enabled any kind of 2FA), and 2FA adoption overall is already low. In this case, it’s a two-sided adoption problem:

1. Users need to buy a hardware token to use U2F.
2. Applications need to implement the protocol to allow users to use them in the first place.

And as you can see [here](https://2fa.directory), U2F is not nearly as well-supported as SMS and software 2FA. Surprisingly, even applications you would expect to support U2F still don’t, such as some of the password managers.

If you want to incentivize your users to use U2F, Auth0 now supports WebAuthn with FIDO (U2F) security keys, so you can easily offer it as an option for your users. For more information, visit [Auth0 Docs](https://auth0.com/docs/mfa/configure-webauthn-security-keys-for-mfa).

The Working Principles of 2FA (2-Factor Authentication) Hardware

df6c864847fba9687d962cb80b482764?size=200 avatar

df6c864847fba9687d962cb80b482764?size=200

Martin Gontovnikas, a.k.a Gonto, is a software engineer at heart who moved to the ‘dark side’ and became VP of Marketing at Auth0. He considers himself lucky to have found a way to combine his two passions and apply his engineering thinking model to marketing. Gonto’s analytical thinking is a huge driver of his data-driven approach to marketing strategy and experimental design. He is based in the Bay area, and in his spare time, can be found eating gourmet food at the best new restaurants, visiting every local brewery he can find, or traveling the globe in search of new experiences.

Former SVP of Marketing and Growth at Auth0

Martin Gontovnikas

New regulation is part of a global push for MFA

At the end of April, the Australian Communications and Media Authority (ACMA) will begin requiring all telcos to implement two-factor authentication (2FA) when customers transfer their phone numbers between providers.

ACMA member Fiona Cameron was quoted in [ZDNet](https://www.zdnet.com/article/australian-government-introduces-new-telco-regulations-to-fight-phone-scams/), explaining her support for this regulation: “Mobile number fraud can have devastating effects as scammers can gain access to bank accounts, email, social media and more... [V]ictims struggle to regain control over personal and financial information, often over the years."

For Australian businesses providing telco services, including virtual networks of any size, this new 2FA requirement demands immediate attention. Telecommunications companies that fail to comply can be [fined up to $250,000](https://www.theguardian.com/money/2020/feb/28/acma-announces-new-rules-on-porting-mobile-numbers-to-tackle-identity). 

But even if you're not directly involved in telecommunications services—and don’t operate in Australia—this news is important. It represents a global movement, in which lawmakers are increasingly treating [multi-factor authentication (MFA)](https://auth0.com/multifactor-authentication) as a requirement rather than a mere recommendation.

## What Australia’s Regulation Entails
On its face, ACMA’s 2FA requirement is fairly limited in scope. The law requires that when customers switch (or “port”) their mobile phone numbers from one provider to another, 2FA must be in use to ensure that the number is not being hijacked by scammers. The telco will implement 2FA by sending a one-time SMS code to a customer’s phone number or email. 

2FA is the most common form of MFA. It’s more secure than logging in using a simple (easily stolen or hacked) password because it communicates with an account or device already associated with a user’s identity. 

However, some have argued that SMS codes aren’t the strongest 2FA choice to break the cycle of fraudulent phone porting. Australian Communications Consumer Action Network chief executive Teresa Corbin told [_The Guardian_](https://www.theguardian.com/money/2020/feb/28/acma-announces-new-rules-on-porting-mobile-numbers-to-tackle-identity), “We’d like to see the Acma require telcos to use highly secure forms of verification, such as hardware or software authentication tokens, which are generated with a mobile app.”

There may not be a perfect consensus on Acma’s solution, but no one denies that Australia’s specific focus on phone porting comes in response to a real security need. [According to Paul Fletcher](https://www.news.com.au/technology/consumer-issues/twofactor-authentication-to-be-made-mandatory-for-mobile-phone-number-transfers/news-story/845224336b099726f6a7410461ff8143), Australia’s Minister for Communications, Cyber Safety and the Arts, scammers steal the identities of thousands of Australians yearly through fraudulent porting, costing an average of AUS$10,000 per victim.

<include src="TweetQuote" quoteText="Find out why @acmadotgov’s 2FA requirement for all telcos to implement two-factor authentication (2FA) when customers transfer their phone numbers between providers is a global forerunner."/>

These attacks are often very targeted (unlike ransomware) in order to steal money by gaining access to financial accounts or bitcoin wallets. They are also used to target high-value people at companies (think admins) to access highly valuable resources. In 2018, [Reddit was breached](https://www.wired.com/story/reddit-hacked-thanks-to-woefully-insecure-two-factor-setup/) in one of these “SIM swapping” attacks, which prompted them to stop using SMS authentication in favor of token-based 2FA. 

The biggest players in Australia's telecommunications industry (Telstra, Optus, and Vodafone) already require pre-port authentication, but the government believes smaller service providers also need to implement the requirement or risk attracting scammers to their networks. Those network providers will have until April 2020 to achieve compliance with the regulation.

## Why Australia Is Getting Aggressive on Cybersecurity
Passing mandatory 2FA for telco is just one part of the Australian government’s broader effort to tighten cybersecurity. Last year, the government instituted the [Notifiable Data Breach](https://www.wired.com/story/reddit-hacked-thanks-to-woefully-insecure-two-factor-setup/) (NBD) program, requiring companies to notify individuals when their data has been compromised. Australia’s government is in the midst of overhauling its 2016 cybersecurity strategy, and MFA authentication was one of the “[Essential Eight](https://www.bit.com.au/guide/your-guide-to-the-essential-eight-security-strategies-451152)” security steps recommended by the Australian Signals Directorate in 2017.

While the telco 2FA regulation is highly targeted at phone porting, it’s still an indicator that Australia's federal government is willing to legislate 2FA in the name of consumer protection. This initial rule could be part of a regulatory framework that may spread to other industries. According to [ZDNet](https://www.zdnet.com/article/australian-government-introduces-new-telco-regulations-to-fight-phone-scams/), “the government believes there are still one million services that are yet to have these consumer safeguards implemented,” and these service providers may be under the microscope next.

However, the Australian government is clearly still weighing how forcefully to regulate businesses. The 2FA requirement is the first piece of policy to come out of Australia's [Scam Technology Project](https://www.acma.gov.au/theACMA/scam-technology-project), a partnership between industry and the government.

In September 2019, the government circulated a public survey soliciting input on the appropriate balance between industry self-regulation versus governmental intervention on matters of cybersecurity. The [survey](https://www.homeaffairs.gov.au/reports-and-pubs/files/cyber-security-strategy-2020-discussion-paper.pdf) asks, among other things: “Do you agree with our understanding of who is responsible for managing cyber risks in the economy?” and “Do you think the way these responsibilities are currently allocated is right? What changes should we consider?”

<include src="TweetQuote" quoteText="@acmadotgov’s 2FA requirement will provide better protection for people switching telco providers. Discover why it could pave the way for additional global MFA adoption."/>

### MFA Is Becoming a Global Standard
While Australia’s law is a pioneer in specifically mandating 2FA for phone porting, MFA is increasingly required to do business with private corporations and certain government agencies and in order to be compliant with broader data privacy laws.

In June 2019, [Microsoft announced](https://krebsonsecurity.com/2019/06/microsoft-to-require-multi-factor-authentication-for-cloud-solution-providers/) that all of its Cloud Solution Providers (CSPs) had to use MFA. In the United States, [the IRS requires](https://www.irs.gov/privacy-disclosure/multi-factor-authentication-implementation) that any federal, state or local employee accessing IRS data remotely must use MFA.

While the EU’s [General Data Privacy Regulation (GDPR)](https://auth0.com/docs/compliance/gdpr/features-aiding-compliance/protect-user-data) doesn’t specifically stipulate that businesses must implement MFA, it does require “appropriate security measures” to protect personal data, and it holds businesses liable for any breach. Because MFA is among the strongest safeguards available to protect data, GDPR compliance practically makes it a necessity. The European Union Agency for Cybersecurity (ENISA) published a [list of guidelines](https://www.enclave.ie/blog/multi-factor-authentication-is-recommended-by-the-european-union-agency-for-network-information-security-for-gdpr.508.html) when GDPR became law. In it, they specifically advised that any system handling personal data use 2FA.

In addition, the EU mandates [Strong Customer Authentication (SCA)](https://ec.europa.eu/info/publications/190913-safer-payment-services_en) for payment service providers, requiring that electronic payments user MFA.

The private sector is quickly recognizing that instituting MFA is critical to protecting data against breaches and staying compliant with data privacy laws. According to [Global Industry Analysts'](https://www.reportlinker.com/p03329771/Global-Multi-Factor-Authentication-MFA-Industry.html?utm_source=GNW) October 2019 report, the 2FA market worldwide is predicted to grow to US$12.1 billion by 2025, with potential growth of 14.3%.

Historically, many businesses have shied away from implementing MFA. For example, a [2018 Experian report](https://www.experian.com/assets/decision-analytics/reports/global-fraud-report-2018.pdf) found that only 44% of eCommerce businesses implemented MFA, out of concern that any demand for credentials would be a source of friction that might alienate customers and hurt profits.

However, with each new regulation that requires (and therefore normalizes) MFA, the perceived level of friction decreases. In other words, customers are becoming more accustomed to encountering MFA whenever they conduct sensitive transactions, so no individual business that implements it needs to worry about presenting an undue burden on the end-user.

That isn’t to say that businesses (in Australia or otherwise) shouldn’t be thinking about implementing MFA in order to ensure a seamless customer experience. Not every login attempt should require users to get a one-time code; [step-up authentication and adaptive authentication](https://auth0.com/blog/what-is-step-up-authentication-when-to-use-it/) tailor MFA requests based on risk.

Furthermore, a good MFA solution is designed to prioritize UX by completing authentication requests in as few steps as possible. Auth0’s [Guardian MFA](https://auth0.com/multifactor-authentication), for instance, lets users authenticate through a simple push notification on their phones.

![Multifactor Authentication Dashboard](https://images.ctfassets.net/23aumh6u8s0i/76dOMSouGVa1RG4sZHWMIl/fb3c361a75713719bef1665bc9ba185d/mfa-dashboard-1)

## Auth0 Can Ease the Journey to MFA
The legal requirements, customer expectations, and technological capabilities around MFA are evolving rapidly. Australia’s 2FA requirement for phone porting is just one sign that the prevailing winds are pushing industries toward more secure authentication solutions. In light of this, businesses who have avoided implementing MFA should take this opportunity to reconsider their stance.

Aside from any regulatory mandate, MFA is no longer an inherent source of friction for customers. When you outsource this capability to an authentication partner like Auth0, you can reap the benefits of MFA solutions that are secure and compliant and are as easy on your customers as possible.

For a deeper dive into MFA and the potential implications for your business, please check out our whitepaper [When is MFA the right choice](https://info.auth0.com/contact.html?utm_source=blog&utm_campaign=2020-03-aus-mandates-2fa)?

Australia Mandates Two-Factor Authentication for Telcos

diegopoza

System Engineer, geek, foodie, technology lover, speaker.

Sr Manager, Developer Advocacy

Diego Poza

Implement identity management tools for all of your users as you scale.

On August 21, Facebook took down over 600 accounts, pages, and groups that originated in Iran. These accounts were disseminating political disinformation, largely targeted at users in Latin America and the Middle East.

Cybersecurity firm FireEye initially tipped Facebook off about a network of pages called Liberty Front Press. Their reach was 74 Facebook pages, 70 accounts, and 3 groups, as well as 76 Instagram accounts.

The tip also led Facebook to discover an array of other networks, pages, and accounts that were disseminating false information — and engaging in cybersecurity attacks.

With these issues so widespread on the platform, how could Facebook not have figured it out sooner?

Coupled with numerous other [data breaches](https://auth0.com/blog/what-companies-can-learn-from-the-reddit-data-breach/) across multiple companies this year, the most recent Facebook incident highlights how important it is for companies to continually update their user-management practices as they scale — before bad activity gets out of control.

## Facebook's Disinformation Incident Reveals the Challenge of Monitoring All of Your Users

The number of daily active users on Facebook has nearly tripled since 2011. Today, it boasts 1.47 billion users worldwide.

![Facebook daily user statistics](https://images.ctfassets.net/23aumh6u8s0i/1A3WvCiIUCsatoS3Du1l7f/87c64d7a41a81547cc3261de519f27f3/facebook-scandal_daily-users)
 
In addition, as of Q2 2018, the company had over 25,000 employees, and it shares its data with numerous third parties. 

Although it recently ended this practice, following the [Cambridge Analytica scandal](https://auth0.com/blog/what-data-did-facebook-really-give-cambridge-analytica/), Facebook historically shared user information with major online and offline data brokers through its Partner Categories program. This included what the company had collected itself (e.g., page likes) and information from its advertisers.

<include src="TweetQuote" quoteText="With so many stakeholders accessing different parts of the Facebook platform at different times, it's clearly too much for Facebook to keep track of Fake news, and accounts are rampant."/>

These providers helped other businesses understand and optimize their marketing campaigns. As an example, [according to Facebook](https://www.facebook.com/help/494750870625830):

"An auto dealer may want to customize an offer to people who are likely to be in the market for a new car. The dealer also might want to send offers, like discounts for service, to customers that have purchased a car from them. To do this, the auto dealer works with a third-party company to identify and reach those customers with the right offer. The third-party partner provides Facebook with information that helps Facebook connect those customers with the offers." 

With so many stakeholders accessing different parts of the Facebook platform at different times, it's clearly too much for Facebook to keep track of [Fake news](https://www.zuora.com/2017/05/26/social-platforms-channel-fake-news-next-revolution-journalism-2/) and accounts are rampant.

How can your team do better?

## Avoid Your Own Disinformation Scandal with Strong Identity Management Tools

Even if you’re not as large as Facebook, there are key steps you can take as your company scales to be sure you are keeping track of who your users are (customers, employees, and third parties) and what behaviors they display in order to root out fake accounts and nefarious activities.

### Identity management for your employees

As your team expands on multiple levels, across new geographies and time zones, following everyone working within your system can be a headache.

Pushing certain [Rules](https://auth0.com/learn/cloud-identity-access-management/) in the cloud, like blocking people or even entire groups from logging in on particular devices or at certain times, can help cut down on inefficient DIY tactics and organize access in a streamlined way.

If using Auth0's solutions, you can quickly pull [user-profile details](https://auth0.com/docs/user-profile/user-profile-details), including

* first name and last name;
* email address; and
* specific company identifiers, such as an employee number or a listed department name.

Given the range of data sources that this information could come from, including custom databases, an Active Directory, or even a social provider like LinkedIn, Auth0 will normalize this and return a basic set of data, with attributes like `user_id`, `name`, `nickname`, and `picture`, to allow admins and programs to retrieve the information they need when double-checking employees.

Giving admins the control to rapidly parse an employee user base will help them notice any suspicious behaviors — like repeated failed login attempts in real-time — mitigating the risk of false accounts or system breaches.

### Identity management tools for third parties

For third parties such as consultants or auditors (or, in Facebook's case, purchase-data providers like Datalogix, Epsilon, Acxiom, and BlueKai) that you allow into your system but that are not regular employees, providing them with a single sign-on (SSO) feature through [Auth0 Universal Login](https://auth0.com/universal-login) will not only make things cleaner and more efficient on their end but also help consolidate all of their credentials into a single location for vetting purposes.

Auth0 Universal Login provides a secure login infrastructure to authenticate users to your apps.

![Auth0 Universal login page](https://images.ctfassets.net/23aumh6u8s0i/6TwsXjuNeMnkg5I4ZN3y5o/c4b1c77a6e5b8e10b44dc000bde49d19/auth0-centralized-login)

On the back end, after the authentication event occurs, admins can call the `getUserInfo` method to acquire all of the user's profile information (as needed).

Keeping track of external users is critical in maintaining order and privacy within your system as needed (as Facebook's canceled Partner Categories program highlighted). Because these users aren't formal employees, you want to be sure that they still adhere to your company's standards and practices and aren't straying or creating unwanted programs.

### Customer identity management tools

Knowing your customers is key to growing your company. Strong customer-identity and customer-access tools can make onboarding quick and fun, up your daily active-user base, reduce churn, and [drive conversions](https://blog.nomnominsights.com/turning-customer-feedback-into-research-hypotheses/).

It also helps you ensure that no one is masquerading as someone they're not.

This year, British shipping company Clarksons revealed that a single fake account was to blame for [stealing confidential information](https://www.zdnet.com/article/clarkson-says-single-user-account-to-blame-for-data-breach/). The account accessed corporate databases and made off with highly sensitive data, such as Social Security numbers, criminal convictions, medical information, tax and insurance details, signatures, and login credentials — along with even more personal details, like ethnicity and religion.

To get out of the mess, Clarksons had to hire outside forensic help to find and disable the problematic account.

Implementing social integrations can help you avoid this by immediately double-checking that all users are who they say they are. A social login feature relies on existing login information from a social network provider like Google to verify a users identity.

![Log into a Wordpress site using social login provider](https://images.ctfassets.net/23aumh6u8s0i/4DR1XvnUhTlC5oOYIQw4vU/c5c39ff1cd0ec9e4a6d26cb97ca860ed/facebook-scandal_auth0-wordpress)

A customer can sign into a third-party website like WordPress through Google instead of creating an entirely new account. Since the provider (Google) has already authenticated the user, it provides an extra layer of security.

Any further support you can get to vet users — even your loyal and trusted customers — can go a long way toward avoiding a costly data breach.

<include src="TweetQuote" quoteText="Creating or outsourcing tools like Auth0 Universal Login for rapidly pulling and storing current user data, and features like social login will help secure your company at its foundation so that you can grow."/>

## Use Identity Management Tools to Stop Bad Behavior at the Source 

As your company grows, it's a blessing to bring on more users — whether new customers, freelancers, consultants or employees. But it can quickly become a curse if you don't implement strong practices for monitoring them.

As the Facebook disinformation scandal clearly shows, without proper tracking, small issues can balloon out of control. Ideally, you'd stop any fake accounts at the login source so they don't snowball at all.

Creating or outsourcing tools like [Auth0 Universal Login](https://auth0.com/universal-login), [Rules for rapidly pulling and storing current user data](https://auth0.com/docs/rules/current), and features like [social login](https://auth0.com/learn/social-login/) will help secure your company at its foundation so that you can grow.

What the Facebook Disinformation Scandal Means for Your Company

3 lessons business leader can learn from the T-Mobile data breach to protect their teams and customers.

On August 20, T-Mobile discovered that a hacker had gained personal information from unauthorized access to its system. Over 2 million of its 77 million customers were exposed.

Although T-Mobile quickly reported the incident to authorities, it's apparent that the cybercriminal is [aiming to sell the data](https://www.databreachtoday.com/t-mobile-database-breach-exposes-2-million-customers-data-a-11420), including names, ZIP codes, phone numbers, email addresses, and payment information.

While it's still too early to determine the financial consequences T-Mobile will face from the incident, a recent [study](https://blog.kenan-flagler.unc.edu/risky-business-the-impact-of-data-breaches/) from UNC found that data breaches can cost companies as much as 3% of their market value. Dashlane estimates the average dollar cost at [$7.35 million](https://blog.dashlane.com/data-breach-statistics-2018-forecast-everything-you-need-to-know/) in the U.S., 60% of which is customer (revenue) loss.

 What can business leaders learn from this incident to protect their teams and their customers going forward?

## Lesson 1: Hackers Go for Weak Points, So Protect Yours

Understanding how hackers get in is the first step. There are [four common ways](https://auth0.com/blog/four-cybersecurity-attacks-you-need-to-know/) that hackers access systems:

1. Malware infiltration (placement of malicious software, including ransomware and spyware)
2. Phishing (emails that trick recipients into giving away sensitive data or downloading a file that installs spyware)
3. USB traps (a hardware device that contains a HID spoof)
4. Mobile attacks (attacks specifically designed for mobile software)

In all cases, hackers look for the simplest vulnerability they can possibly use to compromise your system. That means they're not necessarily going to try to waltz in the front door. In the T-Mobile data breach, the thief was able to access the system through a hole in an API.

It's critical to plug your leaks. Since APIs run on web servers, they are available to all internet users. Like websites, hackers can crawl APIs.

### Authorize Your Users

To be sure you know who is working within your system at any one time, implement a strong user management system. You can build one in-house or outsource it. Many choose to outsource their identity management since the field is increasingly complex and time-intensive — a challenge for in-house teams to manage with the rest of their workload.

Auth0's [user management](https://auth0.com/user-management) dashboard, for example, lets administrators grant permissions for certain users to access sensitive customer information.

![Auth0's user management dashboard](https://images.ctfassets.net/23aumh6u8s0i/QocoCmdAqGCxzA9wCSqsp/c0f08f478e78129808dea8aa38477077/authorization-permissions)

With this powerful web interface, they can add or remove users, modify their profiles, and identify any root-cause login issues.

With APIs, it's also important to remember to authenticate your apps in addition to authorizing users. You can use a [standardized protocol](https://auth0.com/docs/api-auth) for both authentication and authorization.

## Lesson 2: Update Your Password Practices

A 2017 Verizon report found that [81%](https://blog.dashlane.com/data-breach-statistics-2018-forecast-everything-you-need-to-know/) of hacking-related breaches were due to stolen and/or weak passwords. While for years teams relied on the MD5 (message-digest) algorithm to hash passwords (create mathematical representations of plain text), today it's not considered the safest method.

<include src="TweetQuote" quoteText="A 2017 Verizon report found that 81% of hacking-related breaches were due to stolen and/or weak passwords."/>

Although originally MD5 hashes were designed to prevent anyone from working backwards from the hash to determine the real password, it's now possible to rapidly generate MD5 hashes to eventually find a matching password.

[Evidence](https://www.databreachtoday.com/t-mobile-database-breach-exposes-2-million-customers-data-a-11420) points to T-Mobile password hashes being MD5, which suggests the company may have been using outdated password practices.

To prevent the risk of password hacking, many providers are using bcrypt instead — a more resistant algorithm. bcrypt uses a salt, an additional layer safeguard for passwords in storage. Over time, users can increase bcrypt's iteration count to slow the process. This makes it more resistant to brute-force search attacks.

### Implement Two-Factor Authentication

Two-factor authentication or 2FA is an alternative verification method. In addition to requiring users to type in a password, 2FA can also request a TOTP (a time-based one-time password algorithm) that it sends to the user's cell phone or other hardware device.

2FA can also require the second form of identification to be a biometric, such as a thumbprint or Face ID.

![iOS 11 iPhone X Face ID](https://images.ctfassets.net/23aumh6u8s0i/i6mkIBMKzZboV96MAaR8I/a18fc7a031c9f5660c611d89a7e52de0/ios11-iphone-x-face-id-hero)

[[Source](https://support.apple.com/en-us/HT208109)]

While none of these solutions are foolproof, a second method of authentication has been found to prevent breaches in [80%](https://www.slideshare.net/cheapsslsecurity/vip-strong-authentication-no-passwords-infographic-by-symantec)of the cases.

## Lesson 3: Improve Communication with Customers After a Data Breach

Although T-Mobile did attempt to notify customers whose accounts might have been compromised a few days after they discovered the incident, many of these recipients were put off — thinking the text message itself was a form of phishing.

![T-Mobile Data Breach Tweet](https://images.ctfassets.net/23aumh6u8s0i/1mspiKVeO2GUD8nXvUZw8z/7ba4d36cdc43e5edbcdbcf60907236b0/tmobile-tweet)

[[Source](https://techcrunch.com/2018/08/24/t-mobile-says-hackers-stole-customer-data-in-data-breach/)]

Texting can be a tricky form of communication for something so sensitive (particularly from a large, impersonal corporation). Organizations like [Reddit](https://auth0.com/blog/what-companies-can-learn-from-the-reddit-data-breach/) and Equifax have succeeded with well-crafted PR campaigns and explanations on their websites:

![Reddit data breach press release](https://images.ctfassets.net/23aumh6u8s0i/KD5ZLDwuM8UeOKhP3UW2K/bcb28aeb0eda8d90b2a6daee7e69f580/reddit-breach-release)

As a portion of the full announcement (which you can read [here](https://www.reddit.com/r/announcements/comments/93qnm5/we_had_a_security_incident_heres_what_you_need_to/?st=jkk18vb3&sh=ad92bacb)), Reddit clearly defines the scope of the breach, including details of what information the hacker accessed and how to know which users were affected.

Reddit also lets users know ahead of time that they will be contacting them through email to verify if their account has been compromised.

This is in stark contrast to T-Mobile's [vague description](https://go.skimresources.com/?xs=1&url=https%3A%2F%2Fwww.t-mobile.com%2Fcustomers%2F6305378821&xguid=85UTUFk2RzAa&id=66960X1514734&checksum=fc5d6ea7126bb8e6a7af56a7049975e787946c4e625ac9ceef083a8513bb04da) that their team shut down “an unauthorized access to certain information.”

![T-Mobile data breach press release](https://images.ctfassets.net/23aumh6u8s0i/3di8OI1TiR8WKlOTKzEIX3/560aff9c400227387f70fbc291cfad36/tmobile-breach-release)

Being as specific and transparent as possible (as quickly as possible) will help your customers trust that you are handling the situation and keeping them safe.

## Recent Data Breaches by the Numbers

It seems like every week there is a new catastrophe for personal data in the headlines. [Reddit](https://auth0.com/blog/what-companies-can-learn-from-the-reddit-data-breach/), Saks, Ticketfly, Panera, Lord & Taylor — these are just a handful of the major incidents so far in 2018.

The first half of 2018 saw nearly 700 breaches, on pace to equal 2017's staggering 1,579 breaches.

![T-Mobile Data breach chart](https://images.ctfassets.net/23aumh6u8s0i/2zNkiAn1hkY4MHzNlS1usB/28808e7918247c784def7780f80ae734/data-breach-chart)

The total number of exposed records from these incidents in the past five years tops 580 million.

<include src="TweetQuote" quoteText="The first half of 2018 saw nearly 700 data breaches, on pace to equal 2017's staggering 1,579 breaches."/>

In addition to data breaches, data exposures — when data is improperly defended and open for access on the internet — are on the rise. Instead of a malevolent hacker getting through a protected system, a data exposure occurs if a database isn't correctly configured or doesn't require appropriate authentication. In 2018, Exactis, for example, exposed [340 million records](https://www.wired.com/story/exactis-database-leak-340-million-records/), putting 2 terabytes of personal information at risk.

You don't have to be as large as T-Mobile to take powerful steps to secure your company. [Small businesses](https://www.godaddy.com/garage/online-security-advice-small-business/), for example, can still implement multi-factor authentication and improve their password practices. Taking steps to secure your customer data — whatever your size — will help you avoid becoming an easy target for hackers.

## Bolster Your Security in Order to Scale

Data breaches and exposures can quickly erode customer and investor trust — particularly at critical times in a business's lifecycle. For example, T-Mobile is currently in [a $26 billion merger agreement](https://www.zdnet.com/article/t-mobile-and-sprint-to-merge-finally-strutting-5g-clout/) with Sprint. The deal, which has already been subject to regulatory scrutiny, could face even more hurdles if parties see T-Mobile's lack of updated security practices as a liability.

On the flip side, if you strengthen your defenses and clearly communicate your progress, you have a better chance of emerging from any issues with your reputation intact.

Make sure you are on top of the latest security practices and protocol to avoid worst-case scenarios that could obstruct progress.

3 Critical Lessons from the T-Mobile Data Breach

Learn how advanced forms of two-factor authentication and identity management can prevent data breaches.

On June 19, [Reddit learned that an attacker had breached several employee accounts](https://www.reddit.com/r/announcements/comments/93qnm5/we_had_a_security_incident_heres_what_you_need_to/?st=jkk18vb3&sh=ad92bacb) via the company's cloud and source-code hosting providers:

![Reddit 2018 data breach public release note](https://images.ctfassets.net/23aumh6u8s0i/3vvdTEoXaRdiioBWnvYVGw/304ad288397fd4941d530ee9feffba77/reddit-data-breach-release-note)

[[Source](https://www.reddit.com/r/announcements/comments/93qnm5/we_had_a_security_incident_heres_what_you_need_to/?st=jkk18vb3&sh=ad92bacb)]

No Reddit information was altered, and the company quickly moved forward to lock down proprietary data, but it's still caused ripples of concern among Reddit's community of users. The theft contained a complete copy of an old database backup that held personal data from Reddit's early users. This largely included account credentials (username + salted hashed passwords), email addresses, and messages — valuable information that thieves can recycle to access other accounts, such as health or financial records.

This is one of hundreds of breaches this year. According to Statista, [the U.S. has seen 668 data breaches](https://www.statista.com/statistics/273550/data-breaches-recorded-in-the-united-states-by-number-of-breaches-and-records-exposed/) that have exposed more than 22 million personal records.

![2018 US data breaches statistic numbers](https://images.ctfassets.net/23aumh6u8s0i/kmr11NOwGzu3xUNCzXeUH/9c715131409344e33a249f3e0a3561b8/2018-us-data-breaches-by-the-numbers)

The pace of break-ins has been steadily rising for over a decade.

How do companies like Reddit protect themselves in an increasingly dangerous environment? This piece digs into key strategies you can use to brace your company against attacks before they happen — and tells you what to do if the unfortunate occurs.

## Why Didn't Two-Factor Authentication Stop Reddit's Data Breach?

Although Reddit employed a [two-factor authentication](https://auth0.com/learn/two-factor-authentication/) (2FA) shield, it was SMS-based, and the main attack occurred via SMS intercept.

All forms of 2FA require a user to provide a second form of identification — over and above a simple password — to gain access to a system. The most common 2FA method sends the user a unique token via SMS/text message.

![Text messaging SMS showing two-factor authentication 2FA code](https://images.ctfassets.net/23aumh6u8s0i/3aTnxxkyFkwyPh8Mk0EeJR/5f46a5d0fc3e2cf01d8de31beb455de4/text-message-two-factor-authentication-code)

[[Source](https://spriv.com/automated-two-factor-authentication/)]

This is generally a 5- to 10-digit code, which the user types in after the successful entry of their username and password. Many enterprises have opted for this method because [two-factor authentication is user-friendly](https://www.appcues.com/blog/privacy-conscious-consumer) (nearly everyone is familiar with receiving text messages) and is inexpensive to set up.

Yet the method clearly has holes. SMS 2FA is vulnerable to swings in cell-phone connectivity and can be easily intercepted by third parties.

A more secure version is employing software tokens. Software tokens in 2FA have gained popularity in recent years with the rise of smartphones.

The [Microsoft Authenticator](https://docs.microsoft.com/en-us/azure/multi-factor-authentication/end-user/microsoft-authenticator-app-how-to) is an example of a popular software token-based solution, which could have provided Reddit a tighter wall against hackers.

![Microsoft Authenticator app in action](https://images.ctfassets.net/23aumh6u8s0i/3hUiPXdXBRNCeNWxpA9Mqu/c14c2ce1fd77d24ae5ba9ee388422c9f/microsoft-authenticator)

The Microsoft Authenticator is one of many similar tools, including the Google Authenticator, Twilio Authenticator, and LastPass Authenticator. They all rely on a time-based one-time password (TOTP) algorithm to generate a short-lived (30 seconds or less) password. The user must [copy the password into the website](https://uk.godaddy.com/blog/how-to-avoid-web-design-mistakes-that-could-sabotage-your-business/)'s or app's required field for verification before it expires.

<include src="TweetQuote" quoteText="SMS 2FA is vulnerable to swings in cell-phone connectivity and can be easily intercepted by third parties. A more secure version is employing software tokens."/>

### Other Forms of 2FA That Could Have Stopped the Reddit Data Breach

Hardware tokens are another method that many enterprises use. They rely on a physical device, such as a key fob or USB dongle, that generates a token for the user.

![DUO hardware token for two-factor authentication](https://images.ctfassets.net/23aumh6u8s0i/5qQ6dhwRziynoTxCrEzVbh/7f76c542b435941ba28d5c00a00d70b2/duo-hardware-authentication-token)

[[Source](https://guide.duo.com/tokens)]

Unlike SMS and software tokens, hardware tokens don't require cell-phone reception or even Wi-Fi; however, they are costly to set up and maintain. In addition, employees often misplace hardware tokens or confuse them with other personal devices.

Several teams rely on email or phone verification, where the user receives a link or a voice recording with an alphanumeric token. While these options are also relatively inexpensive and easy to set up, they can, like SMS tokens, fail in delivery and are vulnerable to interceptions.

An exciting area of [multifactor authentication (MFA) that is on the rise is biometrics](https://auth0.com/blog/identity-as-a-service-in-2018/). This eliminates additional devices altogether and instead relies on a user's inherent credentials, such as fingerprints, a retina, or even gait.

## Incorporate 2FA as Part of a Larger Identity Strategy to Stop Cyber Theft

Two-factor authentication is a critical component of security for enterprises today — despite [the fact that only 28% of people employ 2FA](http://fortune.com/2017/11/07/cybersecurity-2fa-two-factor-authentication/). While it's important to help all of your users implement 2FA, there are other elements of identity management that companies like Reddit should consider.

For example, identity-management providers like [Auth0 have several Rules](https://auth0.com/docs/rules/current) that its users can turn on quickly to immediately detect fraud within a system and take action against it. A dashboard view also allows system administrators to observe all of the activity that is taking place at a given time.

![Auth0 Dashboard](https://images.ctfassets.net/23aumh6u8s0i/10u8AWJkh17HuFzODWxKoB/ec0260b5f23338d27577d6cddcd4afac/auth0-dashboard)

Instead of trying to work with disparate streams of user data (e.g., new sign-ups in one place and historical usage over time in another), a well-constructed dashboard can offer multiple visualizations of this information in the same location. From there, admins can take swift action when they see something is amiss.

With Auth0's [anomaly-detection feature](https://auth0.com/docs/anomaly-detection), you can implement several shields from the dashboard that will block users after a certain number of failed login attempts. In addition, if you know that their information was recently compromised in a major security incident, you can screen for logins from these accounts. For example, if Reddit makes the information available, Auth0 will flag these emails in case the Reddit thieves are using these credentials to impersonate the users.

The more steps you can take to build out your identity management system, the better off you will be as attacks come from multiple angles.

## How to Help Users After a Data Breach Occurs

The most important thing to do when you learn that your system has been compromised is to immediately communicate it and take action.

1. Report the breach to law enforcement, including any data you have on the number and types of accounts the thieves were able to access.
2. Test the accounts that you believe might have been compromised by sending emails or otherwise attempting to verify if the account holders are still who they say they are.
3. Immediately improve your login systems and any current 2FA approaches, and consider [outsourcing more elements of your identity-management system](https://auth0.com/b2e-identity-management-for-employees) to experts.

Reddit quickly [published data breach mitigation steps on its site](https://www.reddit.com/r/announcements/comments/93qnm5/we_had_a_security_incident_heres_what_you_need_to/?st=jkk18vb3&sh=ad92bacb):

![Reddit data breach mitigation steps notice](https://images.ctfassets.net/23aumh6u8s0i/5zhdOhTCsOpYxpQD7y9nYA/016f7549c2d8c920ac272e29a098ca6c/reddit-data-breach-mitigation-steps-notice)

Offering immediate, actionable steps accompanied by links to more detailed pages of information is a great way to help your users without overwhelming them with technical information.

<include src="TweetQuote" quoteText="The most important thing to do when you learn that your system has been compromised is to immediately communicate it and take action."/>

Hopefully, you won't have to employ these final tactics; however, given today's challenging threat environment, particularly for teams with large user bases, it's critical to stay up to date on the latest solutions and security strategies to avoid a worst-case scenario.

<include src="asides/AboutAuth0" />

What Companies Can Learn From The Reddit Data Breach

Financial institutions are under intense scrutiny by regulators as well as customers to be sure that their user data is secure. Legal pressures are mounting, and customers are increasingly [vocal and demanding](https://auth0.com/blog/cambridge-analytica-and-facebook/) that companies are more transparent and responsible with their information. Finance, over and above other industries, demands a higher level of protection. Behemoth institutions like [J.P. Morgan](https://dealbook.nytimes.com/2014/12/22/entry-point-of-jpmorgan-data-breach-is-identified/?mtrref=www.google.com&gwh=7D07D481AE355F1F8949A1C514F4B11C&gwt=pay&assetType=nyt_now) and [Equifax](https://finance.yahoo.com/news/equifax-reveals-many-ssns-credit-cards-passports-hacked-182355107.html) continue to be top targets for cybercriminals.

One concrete step that these institutions, along with smaller firms, can take is to secure their consumer apps. Traditionally, apps with authentication systems require users to provide a single identifier, such as an email address, username, or phone number, along with a correct password or pin to gain access; however, with financial apps, this isn't always enough.

**Two-factor authentication** or ***2FA*** adds an additional step to the process. Like a double security door — if a thief unlocks the first one, he's blocked by another.

## Breaking Down Common 2FA Approaches

In general, there are [three factors](https://preview.pcmag.com/feature/358289/two-factor-authentication-who-has-it-and-how-to-set-it-up) in authentication:

1. Something you know (such as a password you created)
2. Something you have (such as a cell phone or other piece of hardware)
3. Something you are (such as your fingerprint, gait, or facial features)

Two-factor authentication requires that you have two of these options. In addition to a password that you “know,” 2FA can request you “have” a cell phone or other device handy for a TOTP (a time-based one-time password algorithm) or that you present a biometric, such as a thumbprint.

### Time-based one-time password algorithm (TOTP)

A time-based one-time password algorithm or TOTP generates one short-lived (~30 seconds or less) password from a secret key in combination with a current timestamp. A [cryptographic hash function](https://www.lifewire.com/cryptographic-hash-function-2625832) connects these two.

The [Microsoft Authenticator](https://docs.microsoft.com/en-us/azure/multi-factor-authentication/end-user/microsoft-authenticator-app-how-to) is a common option that generates a TOTP:

![Microsoft Authenticator generates a time-based one-time password (TOTP)](https://images.ctfassets.net/23aumh6u8s0i/77LXTM6VFF3ZAkPcn7hvn/8e09b57c1939e64b314c6f96d16fd214/microsoft-authenticator-generates-a-totp.png)

Prior to logging into an app, users will go to Microsoft Authenticator, generate their code, and, before it expires, use it to log into the app. Other leaders in the space include the Google Authenticator, along with smaller providers like Twilio, Authy, Duo Mobile, and the LastPass Authenticator. These providers offer 2FA solutions for both mobile and desktop platforms.

### Biometrics

Biometrics have made big strides in recent years, including the launch of Apple’s iPhone X facial recognition feature. Widely used biometrics for identity verification include iris or retina recognition, facial, fingerprint, hand, and even DNA usage.

Many consumer financial apps, like TD Bank's app for basic checking, savings, and transfer options, employ the thumbprint as a second authenticator:

![TD Bank employs the thumbprint as a second authenticator.](https://images.ctfassets.net/23aumh6u8s0i/GPD4cX5JIXBjbCmuyhpzX/c66fe2fe191fdbc53cda4080eb774a18/td-bank-employs-thumbprint-for-2fa)

[Source: PhoneArena News](https://www.phonearena.com/news/How-to-use-your-fingerprint-scanner-to-log-in-websites-on-a-Samsung-smartphone_id73835)

Users are prompted to place their thumb on the home button for identification prior to entering the app. Several established firms, including [Vanguard](https://personal.vanguard.com/us/insights/article/mobile-touch-id-062016?lang=en) and other asset managers, have incorporated Touch ID as well as [voice verification](https://investor.vanguard.com/account-conveniences/voice-verification) for certain transactions.

<include src="TweetQuote" quoteText="Despite the proven ability of 2FA to reduce the threat of a security breach, the trick is getting users to opt in."/>

## The Challenge: Get Users to Opt In

Despite the proven ability of 2FA to reduce the threat of a security breach along with the ease of setup (no advanced security or developer skills are [required](https://auth0.com/learn/two-factor-authentication/)), 2FA has yet to become mainstream. It can be unclear for many users how to set up 2FA. For example, with services like [PayPal](https://www.paypal.com/us/selfhelp/article/how-do-i-enable-2fa-(two-factor-authentication)-for-my-paypal-powered-by-braintree-user-faq3500), users have to log into their control panel, navigate to their account, and enable 2FA with a QR code or another supported app:

![PayPal supports 2FA with mobile or security key cards](https://images.ctfassets.net/23aumh6u8s0i/wwNSq8sW8ky2GQE9uopOw/7b1d58cba76d2a661b1610ea4062d05b/paypal-supports-2fa-with-mobile-or-security-keys)

It can be difficult for a user without 2FA knowledge to know which option to choose — after already puzzling out how to get to this stage without clear directions in the first place. While some may opt for SMS (first option), the second option (TOTP) doesn't rely on incoming text messages and has proven to be more secure.

For financial firms looking to gain customer trust, making the 2FA setup simple (or figuring out a way to integrate it into their app's UX in a seamless way) will go a long way toward distinguishing themselves from the pack. Customers are particularly looking for a high level of security with their financial information. If you can clearly communicate your enhanced strategy, you will gain a competitive advantage.

<include src="TweetQuote" quoteText="Customer happiness and high engagement are the biggest determinants of its success."/>

### Discourage Password Use

One way to help users understand the importance of 2FA is to discourage the use of passwords alone. Passwords are historically vulnerable due to human error (we're often lazy about re-creating lengthy, secure, and unique passwords and instead recycle the same or iterations of the same password for the majority of accounts) and the ease with which hackers can access this first level of authentication. Explaining that breaches of personal information happen daily — due to phishing and additional criminal tactics that get the user to unknowingly reveal their password — can prompt your customers to consider an alternative. While a [password manager](https://www.pcmag.com/article2/0,2817,2407168,00.asp) is one option, 2FA brings another dimension to the security game altogether. If one or multiple passwords are compromised, a hacker still cannot access the account without acquiring the second factor.

### Balance UX and Practicality

In many cases, customer happiness with a new feature and a [high level of engagement](https://www.youtube.com/watch?v=30f_lVQBzYs) with it are the most important determinants of its success. With cybersecurity features, however, where do you draw the line between ease and enjoyment of use and practicality? Should something so critical be fun? Do users want to see the same types of design for 2FA integrations that they see with, say, e-commerce apps? You don't necessarily have to sacrifice a pleasant user experience due to the serious nature of a 2FA feature; at the same time, you should be conscious that 2FA is distinct in its functionality. Consider a design that is utilitarian, clear, and makes the user understand the power behind the tool.

The Google Authenticator, for example, balances clarity, capability, and a splash of color:

![Google Authenticator balances clarity, capability, and design](https://images.ctfassets.net/23aumh6u8s0i/7mg1gsfPl51QE6co76WWfv/80258abc625c467ee0ec0567048b85fa/google-authenticator-balances-clarity-capability-design)

[Source: GeekyGadgets blog](https://www.geeky-gadgets.com/google-authenticator-ios-app-update-removes-user-accounts-04-09-2013/)

Whichever authenticator tool you offer your users it should reflect your brand and focus. Further reading on the topic that we've found helpful includes:

1. [UX vs. Cybersecurity](https://medium.com/@4Barel/ux-vs-cybersecurity-3eedf77ed6e7)
2. [Cyber Security Requires an Important Ingredient: Strong UX](https://hackernoon.com/cyber-security-requires-an-important-ingredient-strong-ux-d0727a0c076)
3. [What is two-factor authentication, and which 2FA apps are best?](https://www.pcworld.com/article/3225913/security/what-is-two-factor-authentication-and-which-2fa-apps-are-best.html)

## Conclusion: Be There for Your Customers

Figuring out how to integrate 2FA into your consumer financial apps in ways that will make your customers opt-in and enjoy the process will give them peace of mind, help ensure your firm is [compliant](https://auth0.com/gdpr), and even allow you a competitive advantage in the race to gain user support and trust.

<include src="asides/AboutAuth0" />

How Two-Factor Authentication (2FA) Can Help Financial Institutions Reduce Data Breaches

Add Extra security to your company's Data without giving up the mobility your employees expect.

When is the last time you saw a jewelry shop protect their diamonds with a simple lock and key? Even before extra layers of security like alarms, motion detectors, and [biometrics](https://en.wikipedia.org/wiki/Biometrics) were invented, jewelers hid their diamonds and even put out fakes to deter criminals. 

In your company, data is as valuable as those diamonds — so why are you protecting it with a [simple username and password?](https://auth0.com/blog/modern-authentication-for-your-clients-made-easy/;)

Passwords are the keys that access your company's data, but like the traditional lock and key, any mediocre cybercriminal can easily decipher your password. In fact, it's now possible for your mother to easily hack your Facebook account.

![Your mom can hack your Facebook account.](https://images.ctfassets.net/23aumh6u8s0i/5Jkvtw1v3sCHI5g73P2Jrb/856a27a1a2c9ed202895e1b24e098a19/facebook-account-Password-Hacker)

Technology enables hackers to test billions of password combinations per second, exposing [_90% of all passwords_](http://www.telegraph.co.uk/technology/news/9802062/90-of-passwords-vulnerable-to-hacking.html). Facebook realized this when they [discovered](http://www.businessinsider.fr/us/90-percent-of-passwords-vulnerable-to-hacking-2013-1/) 600,000 imposters were attempting to access users' personal information every day using stolen passwords.

Companies like LinkedIn, Google and Twitter decided that they needed extra layers of security to strengthen passwords and protect their users' data. The solution: two-factor authentication (2FA).

<include src="TweetQuote" quoteText="Even your mom can try hacking your Facebook account."/>

## Two-Factor Authentication Adds the Extra Security You Need

If you have logged into Facebook, Twitter, or Google within the past few years, you have come across two-factor authentication.

Two-factor authentication (2FA), sometimes referred to as [multifactor authentication](https://auth0.com/learn/multifactor-authentication/), is a method used to verify a user's identity when they are trying to access an application. In addition to a password, 2FA requires you to provide a second piece of information to confirm your identity.

The first step is to sign into your account with a username and a password. This is the first factor of the two-step process.

![First factor of two-factor authentication: username and password.](https://images.ctfassets.net/23aumh6u8s0i/8KlwIklqafMi98LgppRJQ/8cf66446ba2f526fae327d3587875073/Gmail-login-procedure-email-and-password)

Unlike the ineffective security questions such as your mom's maiden name or your school's mascot, the second piece of information used in 2FA is extremely hard for cybercriminals to acquire. The idea is to create a second factor that is unique to the user, which is often something they possess, like a smartphone, or even something biological, like a fingerprint.

After you enter your credentials in step one, you will be prompted to add the second factor. There are several pieces of information that can be used, which we'll share below. In this case, the user chooses an SMS verification.

![Google asking SMS verification on two-factor authentication](https://images.ctfassets.net/23aumh6u8s0i/6cmLDT4KHVDbAOg1HT5kQb/3e4d0169d8f56f1282a188dfdccdec6f/2-step-verification-google)

Hacking a password is extremely easy, but obtaining a physical device that generates the second code or stealing biological features is not as easy, which is why 2FA is one of the most effective security approaches available.

### 2FA Approaches to Give Your Employees Convenient Options

If you are considering 2FA for your business, there are several approaches for the second factor known as one-time passwords (OTP) that don't require the technical sophistication of biometrics (fingerprints, retina scans).

Your OTP options include:

* **SMS (Text Messages):** SMS is the most popular method of 2FA. After a successful login, the user receives a 5-10 digit code via SMS on their phone, which they then enter into the application for access.
 - **_Pros:_** Employees are comfortable receiving text messages and it is cost-effective to implement.
 - **_Cons:_** Relies on cell reception and a physical phone. If stolen, you can't authenticate.
* **Email:** An OTP can be sent to a secondary email account for verification. This technique works in the same way as SMS, where a 5-10 digit code is sent to the email address.
 - **_Pros:_** Employees can get emails on multiple devices, it’s cost-effective and everyone uses email.
 - **_Cons:_** Emails sometimes fail to deliver, and hackers can gain access to your email and get the code.
* **Voice Call:** Although not a common practice, users can choose to receive a call to a designated phone number with the OTP delivered using a text-to-speech service.
 * **_Pros:_** All employees are comfortable with phone calls and voice doesn't require a data connection.
 * **_Cons:_** Calls can be intercepted, forwarded or voicemails hacked. If stolen, you can't authenticate.

![Multiple two-factor authentication screens](https://images.ctfassets.net/23aumh6u8s0i/wLMMuoTSqpF5OdmetC1mt/f733ee40015326c4f390aebdc7f2b359/Twitter-Card-Multifactor)

* **Hardware Tokens:** This is a common enterprise practice, where employees are given a physical device such a [*key fob*](https://en.wikipedia.org/wiki/RSA_SecurID), or other devices that dynamically generates a code for the user.
 * **_Pros:_** It is a standalone solution that doesn’t require reception or WiFi connection.
 * **_Cons:_** The pieces are expensive, hard to manage and devices are easily misplaced or lost.
* **Software Tokens:** Instead of carrying around a device, software tokens require employees to install an application that runs on their computer or mobile device.
 * **_Pros:_** Apps are easy to use, easy to update and easy to apply patches when needed.* *
 * **_Cons:_** Employees must download to their personal device. Apps can be compromised without user knowledge.
* **Push Notification:** Apps like Auth0 [Guardian](https://auth0.com/docs/multifactor-authentication/guardian) enable you to receive a push notification in the same way you get alerts from your calendar app or news activity. The notifications request a response of either a “Yes” or a “No.”
 * **_Pros:_** There's a direct and secure communication between authentication and the smartphone application.* *
 * **_Cons:_** If a device is stolen, users must go online to cancel the device before it is compromised.

Although there are pros and cons to every 2FA option, keep in mind that it is impossible to get your enterprise authentication 100% secure. Implementing 2FA increases your security no matter what, so select a second factor that works best for your employees.

## 2FA Goes Beyond Security to Improve Output

While the primary reason businesses implement 2FA is for the extra layers of security, the methodology of 2FA also enhances employee productivity and operational efficiencies.

Simply by requiring a second form of identification, there is a low probability that a hacker can successfully impersonate an employee and gain access to your systems. If an employee loses a mobile device or a password is stolen, 2FA provides enough time for your company to remedy the issue before too much damage is done.

Beyond these obvious mobile security benefits, 2FA also provides the enterprise with a few other advantages that affect your bottom line.

### Increased Productivity

Employees are now mobile, working on their personal devices outside the office. As a result, they are more productive and businesses are reaping the rewards of this newfound flexibility.

2FA is an [effective method](https://auth0.com/blog/enhancing-productivity-with-identity-and-access-management/) to secure mobile devices where employees can safely access company-owned applications, data, shared documents, and other systems from virtually any device without putting the company at risk. Corporate IT can rest assured that if a device is compromised, 2FA will make it really hard for anyone to gain illegal access.

![Nowadays, multiple devices are used by employees.](https://images.ctfassets.net/23aumh6u8s0i/1cewJALdmtvtG73hmdAidf/48f0e65905372c10848fd8fa38e27b73/DifferentDevices2)

Employee mobility has created a happier and [more productive](https://www.forbes.com/sites/danielnewman/2016/03/29/is-mobility-the-answer-to-better-employee-productivity/#6c493277131c) workforce, and 2FA is the best method to provide the security measure that reaches outside the firewall to make it all possible.

<include src="TweetQuote" quoteText="Two-factor authentication also means increased productivity."/>

### Increased Awareness

Stolen credentials are the biggest security risk for every business, but most companies don't even know when an employee's credentials have been compromised until it is too late.

In the devastating 2014 [eBay data breach](https://www.alertlogic.com/blog/the-ebay-breach-in-review/), the attackers spent over 229 days within eBay's systems because the stolen passwords were logged as appropriate access. 2FA notifies the account owner immediately that their credentials are being used by someone other than them.

![Google showing an alert that a non-regular sign in was blocked.](https://images.ctfassets.net/23aumh6u8s0i/2RIA9ufpiptT3aL9kDTqyD/827a3f112766779f58916b5706bb25c4/Google-block-sign-in-attempt-prevented-email)

If the hacker has both security factors, there is a good chance that the account owner has already reported a security concern because it means they are missing a device or received an alert that is inconsistent with their activities. 2FA gives the business a new level of awareness level to stop crimes before they start.

### Cost Savings

There are several ways 2FA can help your company save money. The biggest is in preventing a data breach, which can cost a company up [to $3 million](https://www-03.ibm.com/security/uk-en/data-breach/). Beyond mitigating theft, there are two other ways 2FA can help you save money:

1. **Reduced Help Desk Inquiries:** Time is money and reducing the amount of time your IT expert is spending resetting passwords can save the company a lot of money. According to HDI, at least 35-40% of help desk calls are related to password resets, which require an average of 20 minutes of the help desk technician’s time to complete. 2FA gives employees a secure way to reset their own passwords, resulting in fewer calls and more productive employees.

2. **Cloud-based 2FA:** Some larger companies have implemented 2FA using hardware tokens (or "fobs") that employees carry around like a thumb drive. These tokens generate one-time passwords, but they are expensive and hard to manage as employees often lose them or keep them after they leave the company. [Cloud-based tools](https://auth0.com/learn/cloud-identity-access-management/) like Auth0 provide soft tokens like SMS and Push Notifications, giving companies a new, cost-effective way to utilize 2FA.

![Crypto card two factor authentication](https://images.ctfassets.net/23aumh6u8s0i/8TP8HQgFeZNfz4WQBqVGK/c441ae38290e1654de781afd2ca2ce6f/CryptoCard_two_factor-1024x690)

Identity access management [tools](https://auth0.com/learn/cloud-identity-access-management/) allow businesses to [implement 2FA ](https://auth0.com/learn/two-factor-authentication/)for their internal systems in the same way Google, Twitter and Facebook use it to address consumer concerns. Not only will you gain that added layer of security, but the enhanced productivity, awareness and cost savings make 2FA a viable tool for your bottom line.

## Empower Your Passwords, Improve Your Business

In the same way we still use keys to unlock our doors, passwords are our preferred method of accessing our digital worlds. Passwords have been part of humanity for ages and are not going anywhere, but that doesn't mean we need to rely on them solely to protect our company's valuable assets.

2FA augments passwords in a unique way that not only adds an important layer of extra security but also enhances employee productivity helping your bottom line.

Why Every Business Needs Two-Factor Authentication Security

7747f8f5b58076f7bc52cc1bcc54bec5?s=200 avatar

7747f8f5b58076f7bc52cc1bcc54bec5?s=200

João is a software developer at heart that traded his IDE for the possibility to help fellow developers with their authentication and authorization challenges. When not at the computer you'll likely find him exercising his creativity in the kitchen.

Developer Support Engineer

João Angelo

Learn how to integrate voice recognition into your 2FA solution.

<div class="alert alert-info alert-icon">
 
 Forrester Consulting analysis determines that using Auth0 can yield a 548% ROI and $3.7M in identity-related savings. Read the full report: <a href="https://resources.auth0.com/forrester-tei-research-case-study/">Total Economic Impact of Auth0</a>.
</div>

---

**TL;DR** You can replace the use of traditional multifactor possession factors (phone codes, special-purpose hardware) in 2FA implementations with the use of inherence factors (voice biometrics) by leveraging [Auth0](https://auth0.com/) extensibility points and voice recognition services (VoiceIt). Additionally, by integrating a communications platform (Twilio) you can let your users complete the voice authentication step through their own phones.

___

## Traditional Two-Factor Authentication

The majority of existing [two-factor or multifactor authentication](https://auth0.com/multifactor-authentication) implementations rely on the users mobile phone to perform ownership-based checks.

These checks range from the use of codes delivered over SMS to push notifications or time-based one-time password (TOTP) applications. All the methods are a significant improvement over just username and password credentials and they are available to everyone that already has a phone; which is a huge audience.

Nonetheless, you can argue that these approaches are closer to a two-step authentication process rather than two-factor authentication because a users phone isn't really a possession factor at all. The ability to intercept SMS or knowledge of the cryptography keys used in association with TOTP or push notifications could allow an attacker to complete an authentication process without having to have the users phone.

Real possession factors like hardware-based tokens would increase security, but they are not as generally available or as a simple to use as a phone.

## Going Beyond Possession Factors

Inherence factors, usually referred to as biometrics, including fingerprint readers, retina scanners, or voice recognition can be used together with a knowledge factor like username and password credentials as suitable means to provide an effective 2FA solution.

Within the biometrics options, fingerprint readers and retina scanners are even less broadly available than the special purpose hardware-based tokens used as a possession factor. However, requirements for the voice recognition alternative are much less demanding. These requirements can be met with what's available right now to the majority of users, more specifically, audio capture and transmission services.

The support for audio capturing with the increased availability of voice recognition services available over HTTP-based APIs makes it really simple to implement a scenario like the one shown in the following demonstration.

The users provide their username and password credentials and then are asked to speak an authentication phrase that is processed for voice recognition in order to grant access to the client application that initiated the authentication process.

![Two-Factor Authentication Demonstration](https://images.ctfassets.net/23aumh6u8s0i/7mFEpBLBXR0CyaBSiYG5t7/afdfbf6ccde7e2cc607f4407d978ec95/authenticate-browser)

## Theory

Before going into the technicalities of the implementation lets take a look at the requirements for a user to complete voice-based authentication.

A user must first complete a voice enrollment process before being able to authenticate using their voice. This is a one-time process where the user repeatedly records an authentication phrase until the voice recognition service has enough information to later process authentication requests with the required amount of confidence.

Having completed the enrollment process the user's voice can now be used during authentication requests. The authentication process is similar to the enrollment, the users says the authentication phrase they used for enrollment and the voice recognition service will use the available data to verify it.

The following diagram illustrates the flow taken during the enrollment and authentication processes.

![Enrollment and Authentication Flows](https://images.ctfassets.net/23aumh6u8s0i/1YMjmDG1IBizW2BPrkIVl/ab634dc5994c048318d4cddef072e48b/enroll_authenticate_diagram)

## Putting Theory to Practice

Now that we know, at a high-level, what it takes to have a voice authentication system, lets see how can we integrate this into the authentication process of an existing application that uses username and password credentials.

We're going to leverage two Auth0 extensibility points in order to streamline the process. Specifically, we'll configure a redirect rule, that after the successful completion of the first authentication factor will send the user to another web application responsible for the second authentication factor; voice authentication.

The second extensibility point used will be the implementation of a web application as an Auth0 extension which will enable the following:

* Automatic provisioning of the configuration required to call the Auth0 Management API from within the web application.
* Automatic creation of the redirect rule upon extension installation.
* Remove the need for a separate infrastructure to run the web application.

The last piece of the puzzle is the integration with a voice recognition service, which as long as the service exposes an HTTP-based API is also rather simple to accomplish. This happens to be the case for [VoiceIt](https://www.voiceit-tech.com/), the service used in this demo. VoiceIt requires the concept of a user, for which a voice enrollment has to be completed before voice authentication requests can be made.

Finally, it's a matter of putting the pieces together. Most of the code is boilerplate for integration of all the players. The most noteworthy parts that warrant a dedicated look are the ones referring to the transition between the different trust domains and how to ensure the security of these transitions, more specifically:

* Transitioning from the Auth0 authentication transaction to the voice application.
* Transitioning from the voice application back to the corresponding Auth0 authentication transaction.

Both transitions require the secure transmission of information between the two parties. A possible approach to accomplishing this is to use a signed JWT token, as this will provide both a way to encode information that can be easily included in a URL while at the same time ensuring that a malicious user cannot tamper with the information.

Given the reliance on a redirect rule and the fact that the token will need to be included in the URL itself, it's probably for the best if that token has a short expiry time and is also of single-use. The following implementation facilitates the single-use check by including a `jti` claim that can be used by the receiving application as means to ensure that it only accepts a given instance of the token once. Values of the `jti` claim for already used tokens are stored and validation of received tokens include a check against the already used identifiers.

```javascript
user.user_metadata = user.user_metadata || {};
var phoneNumber = user.phone_number || user.user_metadata.phone_number;

// Redirect the user to the extension
var claims = {
 sub: user.user_id,
 name: user.name,
 phone_number: phoneNumber,
 jti: crypto.randomBytes(16).toString("hex"),
 vit_id: user.app_metadata.vit_enrollment.id,
 vit_secret: user.app_metadata.vit_enrollment.secret,
 vit_lang: user.app_metadata.vit_enrollment.language,
 vit_enrolled: user.app_metadata.vit_enrollment.completed
};

var token = jwt.sign(claims, config.signingKey, { expiresIn: 60 });

context.redirect = { url: config.extensionUrl + "?token=" + token };

callback(null, user, context);
```

When the user completes voice authentication, either successfully or not, the second transition occurs and the information is returned back to Auth0. Transmission of this information relies again on a signed JWT token so that tampering can be prevented, however, token replay mitigation is now handled a bit differently.

During the first transmission, besides the token that the rule manualy included in the URL, Auth0 will automatically include a state parameter with a value that uniquely identifies the authentication transaction that is in progress; this same value needs to be returned to Auth0 when continuing the transaction. It's then possible to use the value of the state parameter as the value of a `nonce` claim within the token used during the second transaction as a way to ensure that a given token can only be used to continue a single authentication transaction.

```javascript
var token = context.request.query.token;
var state = context.request.query.state;

try {
 var payload = jwt.verify(token, config.signingKey, {
 algorithms: ["HS256"]
 });

 if (payload.sub !== user.user_id) {
 return callback(new UnauthorizedError("User mismatch."));
 }

 if (!payload.vit_authenticated) {
 return callback(new UnauthorizedError("User failed authentication."));
 }

 if (payload.nonce !== state) {
 return callback(new UnauthorizedError("Session and token mismatch."));
 }

 return callback(null, user, context);
} catch (error) {
 console.log(error);

 return callback(new UnauthorizedError("Unexpected failure."));
}
```

## Improving the UX

Authenticating the user using the computer's microphone is adequate for demonstration purposes or in enterprise environments.

For consumer facing services considering voice authentication, it's more difficult to make assumptions about what's available to the end-user. Adopting alternatives that impose fewer requirements and are overall simpler to use gives them a clear advantage. This is where [Twilio](https://www.twilio.com/) shines as it allows us to implement a full-blown voice authentication solution over the phone in no time.

### Leveraging Twilio for Phone-Based Voice Authentication

Much in the same way that current 2FA methods gained adoption by leveraging the broad availability of mobile phones you can do the same to streamline a voice authentication process.

By integrating the [Twilio](https://www.twilio.com/) communications platform, it's possible to automatically call the user when an authentication request comes in, ask them to provide their associated authentication phrase, record it and send it for verification.

For the user, the similarity to existing solutions that use the phone as a possession factor simplifies the users' transition from one approach to the other. Despite the reliance on phones, there is no strict association to a specific device. This allows the user to switch devices without having to worry about resetting existing multifactor authentication enrollments. The phone is only used as a way to obtain the actual authentication factor; the user's voice.

When the outgoing call is established, you need to associate it with the existing authentication session from the web application. You achieve this by including a token that maps to the correct session within the URL used to initiate the call. Mapping this to the Twilio API, you would use the following code:

```javascript
var client = twilio(accountSid, authToken);

client.calls.create({
 url: `/api/phone/receive-call/${token}`,
 to: userPhoneNumber,
 from: twilioOutgoingPhoneNumber
}, function (error, call) { /* (...) */ });
```

Then, on the handler for the `/api/phone/receive-call/:token` route you take advantage of the fact that you can set a single cookie in the HTTP response to a Twilio initiated request and then this cookie will be sent by Twilio on subsequent requests associated with the same combination of *To* and *From* numbers. Check the Twilio documentation to learn more about [how cookies work](https://support.twilio.com/hc/en-us/articles/223136287-How-do-Twilio-cookies-work-).

```javascript
// (...) Validate the received token

var twiml = new twilio.TwimlResponse();

twiml.say("You have initiated a Voice Authentication process.");

// Set a cookie to link the authentication session with the call
res.cookie("tw_cid", cid, { httpOnly: true, secure: true });

res.send(twiml.toString());
```

The end result, as shown next, is that the user interaction moves from the web application to the phone and the user can complete the request simply by answering a call and following the instructions.

![Two-Factor Authentication by Phone Demonstration](https://images.ctfassets.net/23aumh6u8s0i/66p7DVAsRzVJEEPlbOABjv/1a0ca393c4ab88c2de837e14fd5b3610/authenticate-phone)

## Real-Time Call Progress Updates

Even though the authentication process now transitions from the web application into a call delivered to the users phone, the browser window for the application will need to stay open because the actual completion of the authentication process will have to be completed using it.

The continuation of the process in the web application can and should be done automatically when the call completes. A simple mechanism to accomplish this would be for the client browser-based application to poll the server-side backend that is managing the call. However, this would be inefficient and at the same time introduce artificial delays in the process.

A better alternative is for the server-side to continuously push state changes to the client application in real-time. Even though it sounds more complex than the previous alternative you can easily achieve this by integrating a service like [Pusher](https://pusher.com/).

![Two-Factor Authentication by Phone with Real-Time Progress Updates Demonstration](https://images.ctfassets.net/23aumh6u8s0i/5GIVB97hJza6FyJOMuWy0y/69cb1e65644ae89d744cb8653a011261/authenticate-phone-with-progress)

In order to accomplish the previously illustrated functionality, on the server-side, you initialize a Pusher instance and then continuously push updates when certain call-related events occur:

```javascript
var pusher = new Pusher({
 appId: appId,
 cluster: cluster,
 key: key,
 secret: secret,
 encrypted: true
});

// (...)
pusher.trigger(`callprogress-${call.cpid}`, "update", { "step": 2, "seq": seq++ });

// (...)
pusher.trigger(`callprogress-${call.cpid}`, "update", { "step": 3, "seq": seq++ });
```

On the client-side you subscribe to the event stream and react accordingly. The only thing worth mentioning is that the server sends a sequence number with each update in order to allow the client to correctly process the progress updates even if the network fails to deliver them in order.

```javascript
var pusher = new Pusher(key, {
 cluster: cluster,
 encrypted: true
});

var channel = pusher.subscribe("callprogress-" + cpid);

channel.bind("update", function() { /* (...) */ });
```

## Test-Drive

All of the source code used as the basis for this article is available at: [Auth0 Voice Factor Extension](https://github.com/auth0/auth0-extension-voice-factor) repository. The easiest way for you to get started with it is to install it as an extension within your own [Auth0 account](https://auth0.com/); just follow the instructions contained in the repository [*README*](https://github.com/auth0/auth0-extension-voice-factor#install-as-auth0-extension) file.

If you don't yet have an Auth0 account don't worry, **you can <a href="https://auth0.com/signup" data-amp-replace="CLIENT_ID" data-amp-addparams="anonId=CLIENT_ID(cid-scope-cookie-fallback-name)">sign up</a> for a free account today**. Besides the Auth0 account, a fully functional deployment also requires a [VoiceIt](https://www.voiceit-tech.com/) account used for processing all the voice enrollment and authentication requests.

> [Auth0 offers a generous **free tier**](https://auth0.com/pricing) to get started with modern authentication.

Additionally, you can provide a [Twilio](https://www.twilio.com/) account if you want to enable the completion of the voice authentication requests through phone calls and a [Pusher](https://pusher.com/) account if you want to receive real-time progress information for those same calls.

# Conclusion

Biometric authentication may still be far from mainstream adoption and may even be overkill for most applications out there. However, this article shows that by leveraging Auth0 extensibility points coupled with a third-party voice authentication service, it's very simple to add an additional layer of security for applications that demand an additional level of security.

Another benefit of biometrics as second authentication factor is that it's less of a burden for end-users. No one likes the hassle of buying a new phone and getting locked out of online accounts due to multifactor authentication enrollments associated with the old phone that you may or may not have anymore.

## Aside: Securing Applications with Auth0

Are you building a [B2C](https://auth0.com/b2c-customer-identity-management), [B2B](https://auth0.com/b2b-enterprise-identity-management), or [B2E](https://auth0.com/b2e-identity-management-for-employees) tool? Auth0, can help you focus on what matters the most to you, the special features of your product. [Auth0](https://auth0.com/) can improve your product's security with state-of-the-art features like [passwordless](https://auth0.com/passwordless), [breached password surveillance](https://auth0.com/breached-passwords), and [multifactor authentication](https://auth0.com/multifactor-authentication).

[We offer a generous **free tier**](https://auth0.com/pricing) so you can get started with modern authentication.

Two-Factor Authentication Using Biometrics

001c9ddc5ceb9829b6aaf24f5d28502a

I am software developer with a keen interest in open-source technologies, Linux, and native development. I've worked on many different platforms Android, iOS, Win32, Linux, FreeRTOS, the Web, and others. I've gone through the whole stack and I enjoy learning and using the latest technologies. I now work as a full-stack developer at Auth0.

Senior Engineer

Sebastian Peyrott

Forget about SMSs or manually entering codes, try Guardian!

Today we are officially releasing our [Auth0 Guardian](https://auth0.com/docs/multifactor-authentication/guardian) app, a new and convenient way to perform multifactor authentication for logins. Read on to find out how it works and how you can use it in your projects!

<include src="TweetQuote" quoteText="Auth0 Guardian is a new and convenient way to perform MFA"/>

-----

## Typical Multifactor Authentication
There are good intros to [multifactor authentication (MFA)](https://auth0.com/docs/multifactor-authentication) out there, but here's a refresher:

- A single authentication factor (such as username and password) is not safe enough. If credentials are leaked or stolen, that is all that is needed to impersonate a user.
- Adding a second authentication factor increases security by making it harder for both sets of credentials to be compromised at the same time.
- Typical MFA systems rely on SMSs, e-mails, and time-based one-time passwords ([TOTP](https://auth0.com/blog/from-theory-to-practice-adding-two-factor-to-node-dot-js/)). These require the user to perform manual steps: opening an e-mail, copying a code, etc.

Manual steps in the MFA process are usually the main factor against its adoption. What if it was easier, quicker, simpler?

<include src="TweetQuote" quoteText="What if MFA was easier, quicker, simpler? Enter Auth0 Guardian"/>

## Enter Auth0 Guardian
Auth0 Guardian is our iOS and Android app for multifactor authentication. The best of it: it can work using push-notifications. That's right, no more SMSs or manual codes. Here, have a look:

<video autoplay loop>
 <source src="https://embed-ssl.wistia.com/deliveries/3184dc67e9683a143efbfdb260d8059869594744/mfa-hero-loop.mp4%E2%80%9D"/>
</video>

If you are a security conscious user, you can get a glance at the login request details:

![Auth0 Guardian login request details](https://images.ctfassets.net/23aumh6u8s0i/1GXD08vA05ohqRMNZubKK7/f8db03009b42f2633dc8e63c306ee9eb/defense-iphone-3)

Even better, you are *not* required to rely on Auth0 Guardian to perform a successful MFA login! That's right, Auth0 Guardian integrates with traditional MFA systems, such as SMS, Google Authenticator and Microsoft Authenticator.

Here's the full enrollment and login process:

<video autoplay loop width="600">
 <source src="https://cdn.auth0.com/blog/guardian/guardian-2.m4v"/>
</video>

## How can I use it?
Take a look at the [docs](https://auth0.com/docs/multifactor-authentication/guardian). But here's the deal, to enable it you just need to click a toggle:

![Enabling Auth0 Guardian](https://images.ctfassets.net/23aumh6u8s0i/5QngrxnuyVTdOSLgON7kh6/d8b489ae32ed8de0f7d4880e20e41a8f/enable)

If you want to limit MFA only to certain clients, you can edit the associated rule in that same page. For more information about Auth0 rules, read the [docs](https://auth0.com/docs/multifactor-authentication/guardian/dev-guide). You may also need to setup a SMS provider, in case you want to provide users with that alternative. This all explained in the [administrators's guide](https://auth0.com/docs/multifactor-authentication/guardian/admin-guide).

<a href="https://auth0.com/signup" data-amp-replace="CLIENT_ID" data-amp-addparams="anonId=CLIENT_ID(cid-scope-cookie-fallback-name)">Sign-up now</a> and start using Auth0 and Guardian for free!

Announcing Auth0 Guardian, Multifactor Made Easy

Learn how to easily add 2FA/MFA to your Node.js + Express.js apps using TOTP

-----

Authentication has increasingly become an important part of all web applications and sites. Long gone are the days of applications that simply performed an action without getting any details about the identity of the user who performed the actions. In this post, we will explore one of the most powerful (and easiest) ways of improving the security of your authentication process: two-factor authentication (2FA / MFA).

-----

## Two-factor authentication
2FA has become quite popular. As you may have guessed, it works by providing an additional layer of authentication that is independent of the main layer. Most applications make use of the usual username + password combination, though any two independent authentication methods may be combined. In the following paragraphs, we will explore one authentication method that has become popular for use as the second step in 2FA: the time-based one-time password algorithm (TOTP).

## Time-based one-time password algorithm
TOTP is defined in [RFC 6238](https://tools.ietf.org/html/rfc6238). It is free and simple. There are many open-source implementations for both the client-side and server-side components. In particular, Google has developed an application that is freely available for Android, iOS and the web: Google Authenticator. This application allows us to integrate TOTP easily into our developments. We will explore how to do so in the following sections, but first I'll give you a quick summary of TOTP and how it usually works in two steps:

1. **Enrollment:** enabling 2FA for a specific user.
2. **Login:** using 2FA to log in.

![Typical 2FA flowchart](https://images.ctfassets.net/23aumh6u8s0i/33T9WITUHdahRvXb4ynlQq/69bb42ab3847e6f6fcc9396d9eee5359/Flowchart.png "Typical 2FA flowchart")

As you may have gathered from the chart above, the main requirement for TOTP to work is a **shared secret**. This shared secret needs to be generated and then stored by both the client- and the server-side components of the system. This usually means that an "enrollment" step is necessary before making TOTP available in an application.

Another important thing to keep in mind, as the name of the algorithm implies, the generated codes are time-dependent. The **client and the server need to synchronize their clocks**, and the codes become invalid after a certain amount of time.

## Adding TOTP to your Node.js application
As you have seen in the previous chart, adding 2FA with TOTP to an application requires two independent steps. In our example, the second step (the actual authentication) will be handled by passport-totp, a passport.js strategy that validates the user-entered TOTP code and requires access to the user-specific key. We will also require users to install Google Authenticator (or a similar app) to generate codes with their cellphone. A user may also choose to use the Google Authenticator Chrome app.

You can find all the code from the following snippets here: [app.js](https://github.com/sebadoom/auth0/blob/master/twofa/backend/app.js)

### Step one: enrollment
In our example, the first step will be handled manually by us. We will add code to generate a new random key and store it along with other user authentication information.

After the usual passport.js and express.js setup, we add the necessary TotpStrategy:

```javascript
passport.use(new TotpStrategy(
 function(user, done) {
 // The user object carries all user related information, including
 // the shared-secret (key) and password.
 var key = user.key;
 if(!key) {
 return done(new Error('No key'));
 } else {
 return done(null, base32.decode(key), 30); //30 = valid key period
 }
 })
);
```

As usual, passport will call this callback with the actual 'user' object as deserialized from the request. The 'user' object contains a 'key' string that may be null. If the key is null, we will consider TOTP disabled and allow logins with just a username and password. If the key is present, we will require an additional input from the user before proceeding with the login. The key must be provided to passport as a byte array, but for convenience (and because Google Authenticator requires so), we store it as a BASE32 encoded string. The 'period' is the amount of time a single TOTP code is valid from the moment it is requested to the moment it is entered.

The enrollment step requires the user to be already logged in (as this is necessary to enable or disable TOTP in the server for each specific account). If the user chooses to enable TOTP, we present the shared secret as a QR code ready to scan and save in Google Authenticator:

```javascript
app.get('/totp-setup',
 isLoggedIn,
 ensureTotp,
 function(req, res) {
 var url = null;
 if(req.user.key) {
 var qrData = sprintf('otpauth://totp/%s?secret=%s',
 req.user.username, req.user.key);
 url = "https://chart.googleapis.com/chart?chs=166x166&chld=L|0&cht=qr&chl=" +
 qrData;
 }

 res.render('totp-setup', {
 strings: strings,
 user: req.user,
 qrUrl: url
 });
 }
);

app.post('/totp-setup',
 isLoggedIn,
 ensureTotp,
 function(req, res) {
 if(req.body.totp) {
 req.session.method = 'totp';

 var secret = base32.encode(crypto.randomBytes(16));
 //Discard equal signs (part of base32,
 //not required by Google Authenticator)
 //Base32 encoding is required by Google Authenticator.
 //Other applications
 //may place other restrictions on the shared key format.
 secret = secret.toString().replace(/=/g, '');
 req.user.key = secret;
 } else {
 req.session.method = 'plain';

 req.user.key = null;
 }

 res.redirect('/totp-setup');
 }
);
```

If the user chooses to enable TOTP, we generate a new secret key randomly. Then we encode it in BASE32 format for easy storage and to show it to the user. The 'ensureTotp' middleware makes sure that if 2FA is enabled, then the user has logged in using a TOTP code (see below for the implementation).

### Step two: a new authentication step
Once 2FA is enabled, logins will now have two steps: a username and password will be required as usual, and then, a six-digit code will be input, which the user will need to get from Google Authenticator every time he or she wants to login. So, we will add the necessary code to perform the login and allow the user to enter the code after the first step is complete.

#### Logins are now performed in two steps if the user has 2FA enabled

```javascript
app.post('/login',
 passport.authenticate('local', { failureRedirect: '/login' }),
 function(req, res) {
 if(req.user.key) {
 req.session.method = 'totp';
 res.redirect('/totp-input');
 } else {
 req.session.method = 'plain';
 res.redirect('/totp-setup');
 }
 }
);
```

After the usual username + password authentication, we check whether a TOTP code is required. If so, we redirect the user to the "totp-input" page. Otherwise we send him or her to the usual place after logging in (in this case, for simplicity, we just keep a totp-setup page as the landing page after a successful login). Keep in mind that all places that require authentication need to check for both the standard login and the TOTP login (which is optional) for this to be secure. For instance:

```javascript
app.get('/totp-setup',
 isLoggedIn,
 ensureTotp,
 function(req, res) {
 var url = null;
 if(req.user.key) {
 var qrData = sprintf('otpauth://totp/%s?secret=%s',
 req.user.username, req.user.key);
 url = "https://chart.googleapis.com/chart?chs=166x166&chld=L|0&cht=qr&chl=" +
 qrData;
 }

 res.render('totp-setup', {
 strings: strings,
 user: req.user,
 qrUrl: url
 });
 }
);
```

And here are the implementations of the middleware elements that perform the check:

```javascript
function isLoggedIn(req, res, next) {
 if(req.isAuthenticated()) {
 next();
 } else {
 res.redirect('/login');
 }
}

function ensureTotp(req, res, next) {
 if((req.user.key && req.session.method == 'totp') ||
 (!req.user.key && req.session.method == 'plain')) {
 next();
 } else {
 res.redirect('/login');
 }
}
```

As you can see, for the TOTP check, we make use of a helper variable ('method') inside the session. Session information is stored on the server, so this is safe to do. The client just keeps a session ID. This extra session variable is set in the login handler (POST), which we have shown above.

## Is this production ready?
In the previous paragraphs we covered the basics of 2FA. Here's what you need to keep in mind when going into production:

- **Phone or device unavailable:** Consider what happens when users lose access to their code-generating device or application (or shared-secret). Provide a means for users to recover access to their account without compromising security (email links, SMS messages, etc.).
- **Reset 2FA from backend:** Depending on your use case, it may be necessary to add the means to disable or reset 2FA data directly from the backend. Usually, this is accomplished by requiring the user to perform the enrollment step one more time after login.
- **Fallback for people who don't have smartphones:** If a user chooses not to use a smartphone, any of the recovery methods may be enabled indefinitely.
- **Audit and notify users of changes:** Provide convenient ways for users to see if the authentication details (or methods) have been changed or enabled in their accounts. This allows for early detection of suspicious activity. Automated emails are a good choice.
- **Encrypt shared secrets**: Per [RFC 6238](https://tools.ietf.org/html/rfc6238#section-5), you should store shared-secrets using a cryptographically secure reversible algorithm and keep the keys in memory only as long as necessary. Do not reinvent the wheel; use existing and well-tested libraries for this.

<include src="TweetQuote" quoteText="Shared secrets should be stored using a cryptographically secure reversible algorithm"/>

## Conclusion
We showed in this blog post how easy it is to get started with 2FA using TOTP. It does not require a lot of infrastructure. Google Authenticator, Microsoft Authenticator, Authy and other TOTP applications are available in multiple platforms which makes adoption easy. But don't forget to take into account the non-happy-path: people reset their phone, it gets lost or stolen, or sometimes they don't even have one.

For simplicity, the code in our example uses a simple JSON file as storage. In production you would normally keep user data in a proper (and secure) database. Get the code: [app.js](https://github.com/sebadoom/auth0/blob/master/twofa/backend/app.js).

## Aside: How it works in Auth0
Auth0 provides convenient [2FA](https://auth0.com/learn/multifactor-authentication) methods that can easily be enabled. Check this out:

![Auth0 2FA](https://images.ctfassets.net/23aumh6u8s0i/wahzDruzjVuI0zcaeFPEq/d40a1eee5aec4843c87524ce82ea5d97/mfa.png "Easy 2FA with Auth0")

- **A Switch Away:** 2FA is enabled with just a toggle. No changes are required to your application.
- **Multiple TOTP Clients:** Auth0 works with various client-side TOTP-generating apps: Google Authenticator, Microsoft Authenticator, Authy, etc.
- **Contextual and Programmable 2FA:** Contextual 2FA: enforce 2FA for users according to your own scripted rules.

Check the [docs](https://auth0.com/docs/mfa) and the [multi factor authentication page](https://auth0.com/learn/multifactor-authentication).

"two-factor"