apidays London 2023 - APIs for Smarter Platforms and Business Processes September 13 & 14, 2023 Building Multi-Factor Authentication into your applications Nathaniel Okenwa, Staff Developer Evangelist at Twilio ------ Check out our conferences at https://www.apidays.global/ Do you want to sponsor or talk at one of our conferences? https://apidays.typeform.com/to/ILJeAaV8 Learn more on APIscene, the global media made by the community for the community: https://www.apiscene.io Explore the API ecosystem with the API Landscape: https://apilandscape.apiscene.io/

1. Building Multi-Factor
Authentication into
your applications
Nathaniel Okenwa, Developer Evangelist

2. 422 Unprocessable
Entity: Suspicious
Phone Number!
Nathaniel Okenwa, Developer Evangelist

3. Nathaniel
Okenwa
Developer Evangelist @ Twilio
@ChatterboxCoder
Loves: Coding 󰞵/ MMA 🥊 / Anime
🀄 / Superheroes󰭅󰭄 / Action
Movies 🎬

4. Blade Runner
1982
A blade runner must pursue and
terminate four replicants who stole
a ship in space and have returned to
Earth to find their creator.

5. Blade Runner

6. 422 Unprocessable
Entity: Suspicious
Phone Number!
Spotting Suspicious Entities on 2FA

7. Untrustworthy Users
Fake/Spam Users Hackers or Bot

8. Voight-Kampff test

9. Identifying Real Users

11. User Verification Along
Your Customer Journey
Verify users at
sign up
Protect logins
Authorize
Transactions

12. Sending Your Own OTP Can Be
Difficult
Additional dev
requirements
Security Gaps
Costly in some
countries
Regulations

13. SMS Pumping
This happens when fraudsters
request OTPs over and over, in
order to generate SMS traffic for
which they are incentivised by small
local carriers.

14. SMS Pumping
Fraudster
Mobile Network
Operator

15. SMS Pumping
Fraudster
Mobile Network
Operator
Revenue Share

16. SMS Pumping
Fraudster
Many Verifications
Mobile Network
Operator
Revenue Share

17. Can Cost $$$$$$$$$$...

18. Fraud Indicators
Conversion
behaviour
Monitor OTP
Conversion Rates
Detect Non-Human
Behaviour
Traffic
Spikes
Spike in Account
Activity
Country-Specific
Spikes
Number Prefix (Bulk)
Unexpected
Destinations
Carrier
Ranking
Maintain Telco Fraud
Rank

19. Alternative Channels
WhatsApp
Email
Already have Phone Number
Works over WiFi
SMS Pumping doesn’t work
Strong User Adoption

20. Demo

21. OTP/TOTP
● Works offline
● Private & Secure
● Bring your own
App

22. Silent Network Auth
● Relies on secure carrier network
technology
● Not vulnerable to common OTP
Phishing/Hijacking
● Silent & fast! No end-user friction
✅ 15% increase in conversion
✅ ZERO reported Account Takeover incidents
✅ Keep user’s attention on your app
✅ Save 30 seconds or more during registration
and logins

23. Why don’t we just use
Authenticator Apps?

27. Usability is
Imperative
When security introduces too much friction.
Users are more likely to skip or ‘turn off’ these
security features.

29. Balancing Act

30. Bank Security Model (Not Trademarked)

32. Bank
Tellers
▢ High Frequency
Low Risk Activities
▢ Get users verified
quickly

33. Vault
▢ Higher Risk Activities
▢ Prioritise most secure
form of Authentication

34. ▢ Highest Risk
▢ Requires User
Education
Safety
Deposit Boxes

35. Github

37. One solution for all channels
“Silent authentication” /
biometric authentication
Verify
Verification
request
Has the request
come from browser
or mobile?
Verification
request from
Mobile App
(Best Case)
Verification request from
browser, user received a
push notification on app
with verification code
Verification request from
browser, if push
notifications aren’t enabled,
TOTP is used
Verification request from
browser, but user doesn’t
have app installed. User
receives the code via SMS,
WhatsApp, Email or Phone
Call

38. Demo

39. A complete verification solution
SMS Email Voice
WhatsApp
Silent
Network
Auth
Push
Authentication
TOTP
Future
Channels
WebAuthn
(FIDO2)
Device
Authentication
User Registrations & Logins Logins & Transaction Authorization
Pre-approved templates Automatic SMS fraud
detection
Rate limiting Phone numbers, short codes,
Alpha ID
Route optimization,
redundancy, failover
Localization & translation Monitoring & reports Global customer support
Security &
Business Logic

40. Where to find
out More…

41. THANK YOU FOR
LISTENING!!
Do you have any questions?
nokenwa@twilio.com
@ChatterboxCoder
CREDITS: This presentation template was created
by Slidesgo, including icons by Flaticon and
infographics & images by Freepik