Two-factor authentication (2FA) is the most straightforward way for companies to drastically improve the security of their user authentication process. However, not all 2FA implementations are created equal. Thinking of quickly throwing together a workflow using SMS and calling it a day? Think again! Though popular, 2FA via SMS has many security issues and was actually deprecated by NIST in 2017. In this presentation, I dive into the technical details of the most common 2FA implementations and highlight security and usability trade-offs. You will learn how to develop a 2FA implementation strategy that will best serve your users.

1. Effective 2FA
Part 1: the technical stuff
Conor Gilsenan
Editor in Chief, All Things Auth
Founder, Two Factor Buddy (2FB)

2. Audience participation
to avoid afternoon naps

3. If you are a
service provider.
Hint: people log into your service/application

4. If your service
supports 2FA.

5. If you know your
2FA adoption rate.
Hint: What percentage of users enable 2FA?

6. If your
2FA adoption rate
is above 1%

7. If your
2FA adoption rate
is above 10%

8. If your
2FA adoption rate
is above 28%

9. If your
2FA adoption rate
is above 40%

10. Thank you for
participating!
Please, take a seat.

11. Why do you
support 2FA?

12. Compliance

13. https://www.reddit.com/r/CrappyDesign/comments/2ucutv/this_drawer_doesnt_open_because_the_oven_handle/

14. Business goal

16. Quick recap:
What is 2FA?

17. The three authentication factors
1. Knowledge (something you know)
2. Possession (something you have)
3. Inherence (something you are)

18. The three authentication factors
1. Knowledge (something you know)
2. Possession (something you have)
3. Inherence (something you are)

19. The three authentication factors
1. Knowledge (something you know)
2. Possession (something you have)
3. Inherence (something you are)

20. Two factor authentication (2FA)
1. Knowledge (something you know)
2. Possession (something you have)

21. 2FA methods
1. SMS
2. Time-based One-time Passwords
■ e.g. Google Authenticator
3. Push notifications
■ e.g. Google Prompt
4. Universal 2nd Factor (U2F)
■ e.g. USB security keys

22. My goal: convince you of this tweet

23. My goal: convince you of this tweet

24. My goal: convince you of this tweet

25. My goal: convince you of this tweet

26. SMS: the most popular and least secure 2FA

27. SMS: registration flow

28. SMS: registration flow

29. SMS: registration flow

30. SMS: registration flow

31. SMS: authentication flow

32. SMS: phone company === problems

33. SMS: people problems
“People are always the
weakest link in any
security solution”
- Conor, right now

34. SMS: social engineering

35. SMS: social engineering

36. SMS: social engineering

37. SMS: social engineering

38. SMS: social engineering

39. SMS: social engineering
June, 2016

40. SMS: social engineering
December, 2016
August, 2017

41. SMS: social engineering
Phone company, do better
at verifying identities!
Yes! But also...

42. SMS: social engineering
September, 2017

43. SMS: social engineering
February, 2018

44. SMS: social engineering

45. SMS: social engineering
“...our industry is
experiencing a phone
number port out scam
that could impact you…”
“...consider checking with
your bank to see if there is
an alternative to using
text-for-PIN authentication…”

46. SMS: technical problems

47. SMS: Signal System 7 (SS7)

48. SMS: Signal System 7 (SS7)

49. SMS: Signal System 7 (SS7)

50. SMS: Signal System 7 (SS7)

51. SMS: SS7 vulnerabilities
May, 2016
May, 2016

52. SMS: SS7 vulnerabilities
May, 2017
May, 2017

53. “Victims of phishing are
400x more likely to be
successfully hijacked
compared to a random
Google user.”
2017 - https://research.google.com/pubs/pub46437.html

54. SMS: vulnerable to phishing attacks

55. SMS: vulnerable to phishing attacks

56. SMS: vulnerable to phishing attacks

57. SMS: vulnerable to phishing attacks

58. SMS: vulnerable to phishing attacks

59. SMS: vulnerable to phishing attacks

60. SMS: the most popular and least secure 2FA

61. TOTP: way more secure than SMS, more annoying than Push

62. TOTP:
First ever
registration flow

63. TOTP:
First ever
registration flow

64. TOTP:
First ever
registration flow

65. TOTP:
First ever
registration flow

66. TOTP:
First ever
registration flow

67. TOTP: example authenticator app

68. TOTP: the same app works for all TOTP sites

69. TOTP:
registration flow
with app installed

70. TOTP: authentication is even easier

71. TOTP:
authentication
flow

72. TOTP: how is the OTP generated and verified?
HMAC-SHA-1 (shared secret + time) ≈ OTP

73. TOTP: vulnerabilities

74. TOTP: service provider compromise

75. TOTP: trusted device compromise

76. TOTP: vulnerable to phishing attacks

77. TOTP: vulnerable to phishing attacks

78. TOTP: vulnerable to phishing attacks

79. TOTP: vulnerable to phishing attacks

80. TOTP: usability challenges

81. TOTP: what if I lose my trusted device?!

82. TOTP: what if I lose my trusted device?!
https://unsplash.com/photos/2-1wvS-jZZQ

83. TOTP: lots of accounts? locating just one sucks
Page 3Page 1 Page 2
scroll scroll

84. TOTP: the OTP rotates while you are entering it...

85. TOTP: the OTP rotates while you are entering it...

86. TOTP: the OTP rotates while you are entering it...

87. TOTP: the OTP rotates while you are entering it...

88. TOTP: the OTP rotates while you are entering it...

89. TOTP: the OTP rotates while you are entering it...

90. TOTP: way more secure than SMS, more annoying than Push

91. Push: more secure than TOTP & very convenient

92. Push: authentication prompt

93. Push: registration flow

94. Push: registration flow

95. Push: registration flow

96. Push: registration flow

97. Push: registration flow

98. Push: authentication flow

99. Push: authentication flow

100. Push: authentication flow

101. Push: authentication flow

102. Push: authentication flow

103. Push: vulnerabilities

104. Push: vulnerable to phishing attacks

105. Push: vulnerable to phishing attacks

106. Push: vulnerable to phishing attacks

107. Push: vulnerable to phishing attacks

110. Push: usability challenges

111. Push: need a different app for each service

112. Push: what if I lose my trusted device?!

113. Push: more secure than TOTP & very convenient

114. U2F: Secure? Yup! Realistic for consumers? Nope!

115. U2F: gotta get that hardware!

118. U2F: registration flow - user

119. U2F: registration flow - technical
Key pair generated and
bound to origin

120. U2F: authentication flow - user

121. U2F: authentication flow - technical

122. U2F: authentication flow - technical

123. U2F: authentication flow - technical

124. U2F: authentication flow - technical

125. U2F: authentication flow - technical

126. U2F: authentication flow - technical

127. U2F: usability challenges

130. U2F: what if I lose my security key?!

131. U2F: what if I lose my security key?!

132. U2F: Secure? Yup! Realistic for consumers? Nope!

133. Least
common
denominator

135. Effective 2FA
Part 2: everything else
Coming soon to a conference near you!

136. Questions!
Slides: AllThingsAuth.com/talks
conor@allthingsauth.com
@conorgil
linkedin.com/in/conorgilsenan