You may recognize Two-factor Authentication (2FA) as an additional safeguard for protecting accounts, but do you really know how it works? This talk will show you how to implement One Time Passwords (including what's happening under the hood of those expiring tokens) and even provide a legitimate use case for QR codes! You'll come away recognizing the different approaches to implementing a 2FA solution and have a better understanding of the solution that's right for your application.

1. 2FA, WTF?!
Kelley Robinson

2. 2 FA T W O - FAC TO R AU T H E N T I C AT I O N
W T F ? !

3. 👋 "
@kelleyrobinson

4. " ☎
@kelleyrobinson

5. +
☎ 🔐
@kelleyrobinson

7. haveibeenpw n ed. c om

8. haveibeenpw n ed. c om

9. Password Count
1 123456 22,390,492
2 123456789 7,481,454
3 qwerty 3,752,262
4 111111 3,006,809
5 12345678 2,840,404
6 abc123 2,803,614
7 1234567 2,425,568
8 12345 2,308,872
9 234567890 2,187,868
10 123123 2,143,807
11 000000 1,910,126
12 iloveyou 1,581,914
MOST COMMON
PASSWORDS
. . . myspace1 735,605
@kelleyrobinson

10. @kelleyrobinson

11. PA S S WO R D S
A R E N ' T
E N O U G H

12. Factors
• Something you know
• Something you have
• Something you are
@kelleyrobinson

13. @kelleyrobinson

14. “We learned that SMS-based
authentication is not nearly as secure as
we would hope.
”Reddit Security Incident Disclosure - 2018-08-01
@kelleyrobinson

15. Why is SMS 2FA "Bad"?
• SS7 vulnerabilities
• SIM swapping
(social engineering)
Link: The Post SS7 Future of 2FA
Artwork Credit: Vitostone
@kelleyrobinson

16. SMS Alternatives
• YubiKey
• Push
• TOTP

17. YubiKey

18. Push
@kelleyrobinson

19. TOTP
(Time-based One Time Passwords)
@kelleyrobinson

20. (Time-based One Time Passwords)
It works offline.
@kelleyrobinson
Stop trying to make fetch happen.
TOTP

21. TOT P A LG O R I T H M

22. 1 . S E C R E T K E Y

23. 2 . C U R R E N T T I M E

24. 3 . S I G N I N G
F U N C T I O N

25. 4 . T R U N C AT E

26. __________________
| |
Don't roll
your own crypto!
|__________________|
(__/) ||
(•ㅅ•) ||
/ づ
@kelleyrobinson

27. How do you push
your users into being
more secure?

28. “Requiring token-based 2FA
[for employees] to gain entry.
”Reddit Security Incident Disclosure - 2018-08-01
@kelleyrobinson

29. Employees
Moderators
Everyone else
Potential Reddit 2FA Model
Required token
based 2FA
Required 2FA
Optional 2FA
*
*might be managed by IT, not dev

30. Balance over $250k
Balance over $10k
Everyone else
Potential Banking 2FA Model
Required token
based 2FA
Required 2FA
Optional 2FA

31. The risk profile of
your users is
specific to your
high school
business

32. SMS 2FA is still
better than
no 2FA
@kelleyrobinson

33. Happy October 3rd!
@kelleyrobinson
On October 3rd, he asked me what day it was.
It's October 3rd.