The document discusses best practices for implementing two-factor authentication (2FA) using Authy. It covers why 2FA is important for security, different 2FA methods like SMS, push notifications, and time-based one-time passwords. The document also discusses potential issues with SMS 2FA, alternatives to SMS, onboarding users for 2FA, user experience with 2FA, and practical cryptography techniques used in 2FA apps like Authy. Several Twilio engineers provide insights into building phone verification at scale and preventing social engineering attacks using Twilio Flex.

1. 2FA BEST PRACTICES
How to secure your applications with Authy
TWILIOUSER&DEVELOPERCONFERENCE

2. KELLEY ROBINSON
DEVELOPER EVANGELIST
2FA BEST PRACTICES
How to secure your applications with Authy
© 2018 TWILIO, INC. ALL RIGHTS RESERVED.
FERDINAND PEREZ
SOLUTIONS ARCHITECT

3. © 2018 TWILIO, INC. ALL RIGHTS RESERVED.
WHY 2FA?

4. haveibeenpw n ed. c om

6. © 2018 TWILIO, INC. ALL RIGHTS RESERVED.
2FA TERMINOLOGY

7. OTP (ONE TIME PASSWORD)
• Generic term
• Single use tokens, usually numeric
© 2018 TWILIO, INC. ALL RIGHTS RESERVED.

8. © 2018 TWILIO, INC. ALL RIGHTS RESERVED.
WHY IS SMS 2FA "BAD"?
• SS7 vulnerabilities
• SIM swapping (social engineering)
Link: The Post SS7 Future of 2FA

9. But it's not perfect
SMS 2FA IS
BETTER THAN
NO 2FA
© 2018 TWILIO, INC. ALL RIGHTS RESERVED.

10. © 2018 TWILIO, INC. ALL RIGHTS RESERVED.
SMS ALTERNATIVES

11. © 2018 TWILIO, INC. ALL RIGHTS RESERVED.
Push

12. © 2018 TWILIO, INC. ALL RIGHTS RESERVED.
TOTP
(Time-based One Time Passwords)

13. © 2018 TWILIO, INC. ALL RIGHTS RESERVED.
2FA ONBOARDING

14. © 2018 TWILIO, INC. ALL RIGHTS RESERVED.

15. © 2018 TWILIO, INC. ALL RIGHTS RESERVED.

16. © 2018 TWILIO, INC. ALL RIGHTS RESERVED.

17. © 2018 TWILIO, INC. ALL RIGHTS RESERVED.

18. © 2018 TWILIO, INC. ALL RIGHTS RESERVED.

19. © 2018 TWILIO, INC. ALL RIGHTS RESERVED.

20. © 2018 TWILIO, INC. ALL RIGHTS RESERVED.

21. © 2018 TWILIO, INC. ALL RIGHTS RESERVED.

22. © 2018 TWILIO, INC. ALL RIGHTS RESERVED.
🔓SIGNED IN CONTENT🔓

23. © 2018 TWILIO, INC. ALL RIGHTS RESERVED.
2FA USER
EXPERIENCE

24. © 2018 TWILIO, INC. ALL RIGHTS RESERVED.

25. © 2018 TWILIO, INC. ALL RIGHTS RESERVED.

26. © 2018 TWILIO, INC. ALL RIGHTS RESERVED.

27. © 2018 TWILIO, INC. ALL RIGHTS RESERVED.

28. © 2018 TWILIO, INC. ALL RIGHTS RESERVED.
ACCOUNT SECURITY
SESSIONS AT SIGNAL

29. LUCAS VIDAL
ENGINEERING MANAGER
2FA IMPLEMENTATION
BEST PRACTICES
© 2018 TWILIO, INC. ALL RIGHTS RESERVED.
JOSH STAPLES
SENIOR SALES ENGINEER
Dive deeper into 2FA implementation

30. DAN KILLMER
SALES ENGINEERING MANAGER
BUILDING PHONE VERIFICATION
AT SCALE
Phone verification seems like a simple thing to build on Twilio right? Create
a random code, send it via SMS and then check it? Not so fast!
© 2018 TWILIO, INC. ALL RIGHTS RESERVED.

31. SIMON THORPE
DIRECTOR, PRODUCT MARKETING
HOW TO AUTHENTICATE CALLERS AND PREVENT
SOCIAL ENGINEERING ATTACKS USING TWILIO FLEX
© 2018 TWILIO, INC. ALL RIGHTS RESERVED.
JULIAN CANTILLO
SOFTWARE ENGINEER
With Twilio Flex, we have much more modern methods of authentication to
simplify not only inbound, but also outbound calls.

32. KELLEY ROBINSON
DEVELOPER EVANGELIST
PRACTICAL CRYPTOGRAPHY
Get an introduction to Public Key Cryptography and learn how Twilio uses it
inside the Authy app.
© 2018 TWILIO, INC. ALL RIGHTS RESERVED.

33. THANK YOU!
TWILIOUSER&DEVELOPERCONFERENCE
KELLEY ROBINSON
KROBINSON@TWILIO.COM
FERDINAND PEREZ
FPEREZ@TWILIO.COM