SlideShare a Scribd company logo
1 of 34
Download to read offline
Preventing Account Sharing
Andrei Kaleshka
@ka8725
ka8725
ka8725
ka8725
Multi-factor Authentication (MFA)?
ka8725
Multi-factor Authentication (MFA)?
ka8725
Possible Solution Simple
Needs more data
from user Precise
OK for long
run
Business is OK
with it
Third-party Y N N N Y
Logs analysis N N N Y Y
Limit by device
type Y N Y Y N
MFA via phone Y Y Y Y N
MFA via
Authenticator Y Y Y Y N
MFA via email Y N Y Y Y
Consider solutions
Multi-factor Authentication (MFA)?
ka8725
Multi-factor Authentication (MFA)?
MFA?
ka8725
Multi-factor Authentication (MFA)?
Scaffolding - in construction. Data - in IT
ka8725
Multi-factor Authentication (MFA)?
Strategy/Plan
- Collect data about login sessions
- Measure necessary indicators
- Enable MFA only for those who share account
- Monitor the indicators
ka8725
Multi-factor Authentication (MFA)?
Indicators
- Number of signups per day/week/month
- Users’ Retention (how many leave/stay)
- Number of login sessions per user
- Revenue (in Stripe)
ka8725
Multi-factor Authentication (MFA)?
Our expectations
- Number of signups per day/week/month
- Users Retention (how many leave/stay)
- Number of login sessions per user
- Revenue (in Stripe)
ka8725
Multi-factor Authentication (MFA)?
Collect Data
- Paper_trail gem for history of signups/subscription changes
- Login_sessions table. It’s ID is injected into cookies
User logs in -> login session record created
logs out -> login session gets deactivated
ka8725
Multi-factor Authentication (MFA)?
Build indicators and visualize data with
Metabase
ka8725
Multi-factor Authentication (MFA)?
Active login sessions per user with MFA
ka8725
Multi-factor Authentication (MFA)?
Active login sessions per user with MFA: SQL
ka8725
Learn SQL!
Multi-factor Authentication (MFA)?
Active login sessions per user without MFA
q1, q2
ka8725
Multi-factor Authentication (MFA)?
Active login sessions per user for all
q1, q2
ka8725
Multi-factor Authentication (MFA)?
Login sessions created per day
ka8725
Multi-factor Authentication (MFA)?
Retention of users
ka8725
Multi-factor Authentication (MFA)?
User signups trend
ka8725
Multi-factor Authentication (MFA)?
User signups trend
ka8725
Multi-factor Authentication (MFA)?
Success!!!
ka8725
Multi-factor Authentication (MFA)?
Organic search could also impact the results
ka8725
Multi-factor Authentication (MFA)?
How we implemented MFA
- Devise-two-factor gem. The codes sent via email
- “Remember” the code pass in cookies 30 days
ka8725
Multi-factor Authentication (MFA)?
How we implemented login sessions concept
ka8725
Multi-factor Authentication (MFA)?
How we implemented login sessions concept
ka8725
Multi-factor Authentication (MFA)?
How we implemented login sessions concept
ka8725
Multi-factor Authentication (MFA)?
How we implemented login sessions concept
Cookies are encrypted!
ka8725
Multi-factor Authentication (MFA)?
How we implemented login sessions concept
ka8725
Multi-factor Authentication (MFA)?
Future plans: login sessions limit per user
ka8725
Multi-factor Authentication (MFA)?
Takeaways
ka8725
Multi-factor Authentication (MFA)?
Takeaways
- Define indicators and measure them for a risky feature
- Analyze data
- AI SQL is the future skill
- MFA made our app healthier
ka8725
Andrei Kaleshka
dev@widefix.com
@ka8725
Contacts
ka8725

More Related Content

Similar to How we prevented account sharing with MFA

Microsoft SQL Server 2008 R2 and BizTalk Server Presentation
Microsoft SQL Server 2008 R2 and BizTalk Server PresentationMicrosoft SQL Server 2008 R2 and BizTalk Server Presentation
Microsoft SQL Server 2008 R2 and BizTalk Server PresentationMicrosoft Private Cloud
 
Overview of business intelligence
Overview of business intelligenceOverview of business intelligence
Overview of business intelligenceAhsan Kabir
 
Using Amazon Neptune to power identity resolution at scale - ADB303 - Atlanta...
Using Amazon Neptune to power identity resolution at scale - ADB303 - Atlanta...Using Amazon Neptune to power identity resolution at scale - ADB303 - Atlanta...
Using Amazon Neptune to power identity resolution at scale - ADB303 - Atlanta...Amazon Web Services
 
Tegsoft Contact Center Introduction
Tegsoft Contact Center Introduction Tegsoft Contact Center Introduction
Tegsoft Contact Center Introduction Tuba Gürsoy
 
Assyst 9 Overview Roadmap
Assyst 9 Overview RoadmapAssyst 9 Overview Roadmap
Assyst 9 Overview RoadmapDCL1963
 
Meet AgilOne: The #1 CDP for Enterprise Brands
Meet AgilOne: The #1 CDP for Enterprise BrandsMeet AgilOne: The #1 CDP for Enterprise Brands
Meet AgilOne: The #1 CDP for Enterprise BrandsAcquia
 
Connect 2017 catalyst accelerator for banking
Connect 2017 catalyst accelerator for bankingConnect 2017 catalyst accelerator for banking
Connect 2017 catalyst accelerator for bankingMuleSoft
 
Intro of Key Features of SoftCAAT Ent SQL Software
Intro of Key Features of SoftCAAT Ent SQL SoftwareIntro of Key Features of SoftCAAT Ent SQL Software
Intro of Key Features of SoftCAAT Ent SQL Softwarerafeq
 
Intro to AgilOne for Acquia Partners: The #1 CDP for Enterprise Brands
Intro to AgilOne for Acquia Partners: The #1 CDP for Enterprise Brands Intro to AgilOne for Acquia Partners: The #1 CDP for Enterprise Brands
Intro to AgilOne for Acquia Partners: The #1 CDP for Enterprise Brands Acquia
 
Deliver Dynamic Customer Journey Orchestration at Scale
Deliver Dynamic Customer Journey Orchestration at ScaleDeliver Dynamic Customer Journey Orchestration at Scale
Deliver Dynamic Customer Journey Orchestration at ScaleDatabricks
 
Kde jsou limity zákaznické 360°?
 Kde jsou limity zákaznické 360°? Kde jsou limity zákaznické 360°?
Kde jsou limity zákaznické 360°?Taste Medio
 
Go agile with your analytics
Go agile with your analyticsGo agile with your analytics
Go agile with your analyticsAT Internet
 
IRJET- Data Analytics & Visualization using Qlik
IRJET- Data Analytics & Visualization using QlikIRJET- Data Analytics & Visualization using Qlik
IRJET- Data Analytics & Visualization using QlikIRJET Journal
 
Introduction to QPR ScoreCard 8 & Iycon
Introduction to QPR ScoreCard 8 & IyconIntroduction to QPR ScoreCard 8 & Iycon
Introduction to QPR ScoreCard 8 & IyconIycon India
 
Emvigo Data Visualization - E Commerce Deck
Emvigo Data Visualization - E Commerce DeckEmvigo Data Visualization - E Commerce Deck
Emvigo Data Visualization - E Commerce DeckEmvigo Technologies
 
Splunk Business Analytics
Splunk Business AnalyticsSplunk Business Analytics
Splunk Business AnalyticsCleverDATA
 

Similar to How we prevented account sharing with MFA (20)

Microsoft SQL Server 2008 R2 and BizTalk Server Presentation
Microsoft SQL Server 2008 R2 and BizTalk Server PresentationMicrosoft SQL Server 2008 R2 and BizTalk Server Presentation
Microsoft SQL Server 2008 R2 and BizTalk Server Presentation
 
Overview of business intelligence
Overview of business intelligenceOverview of business intelligence
Overview of business intelligence
 
Using Amazon Neptune to power identity resolution at scale - ADB303 - Atlanta...
Using Amazon Neptune to power identity resolution at scale - ADB303 - Atlanta...Using Amazon Neptune to power identity resolution at scale - ADB303 - Atlanta...
Using Amazon Neptune to power identity resolution at scale - ADB303 - Atlanta...
 
MaheshCV_Yepme
MaheshCV_YepmeMaheshCV_Yepme
MaheshCV_Yepme
 
Tegsoft Contact Center Introduction
Tegsoft Contact Center Introduction Tegsoft Contact Center Introduction
Tegsoft Contact Center Introduction
 
Assyst 9 Overview Roadmap
Assyst 9 Overview RoadmapAssyst 9 Overview Roadmap
Assyst 9 Overview Roadmap
 
Meet AgilOne: The #1 CDP for Enterprise Brands
Meet AgilOne: The #1 CDP for Enterprise BrandsMeet AgilOne: The #1 CDP for Enterprise Brands
Meet AgilOne: The #1 CDP for Enterprise Brands
 
Connect 2017 catalyst accelerator for banking
Connect 2017 catalyst accelerator for bankingConnect 2017 catalyst accelerator for banking
Connect 2017 catalyst accelerator for banking
 
Retail Point of Sales Software
Retail Point of Sales Software  Retail Point of Sales Software
Retail Point of Sales Software
 
Intro of Key Features of SoftCAAT Ent SQL Software
Intro of Key Features of SoftCAAT Ent SQL SoftwareIntro of Key Features of SoftCAAT Ent SQL Software
Intro of Key Features of SoftCAAT Ent SQL Software
 
Intro to AgilOne for Acquia Partners: The #1 CDP for Enterprise Brands
Intro to AgilOne for Acquia Partners: The #1 CDP for Enterprise Brands Intro to AgilOne for Acquia Partners: The #1 CDP for Enterprise Brands
Intro to AgilOne for Acquia Partners: The #1 CDP for Enterprise Brands
 
Deliver Dynamic Customer Journey Orchestration at Scale
Deliver Dynamic Customer Journey Orchestration at ScaleDeliver Dynamic Customer Journey Orchestration at Scale
Deliver Dynamic Customer Journey Orchestration at Scale
 
Kde jsou limity zákaznické 360°?
 Kde jsou limity zákaznické 360°? Kde jsou limity zákaznické 360°?
Kde jsou limity zákaznické 360°?
 
Go agile with your analytics
Go agile with your analyticsGo agile with your analytics
Go agile with your analytics
 
IRJET- Data Analytics & Visualization using Qlik
IRJET- Data Analytics & Visualization using QlikIRJET- Data Analytics & Visualization using Qlik
IRJET- Data Analytics & Visualization using Qlik
 
Introduction to QPR ScoreCard 8 & Iycon
Introduction to QPR ScoreCard 8 & IyconIntroduction to QPR ScoreCard 8 & Iycon
Introduction to QPR ScoreCard 8 & Iycon
 
marutibabu
marutibabumarutibabu
marutibabu
 
Emvigo Data Visualization - E Commerce Deck
Emvigo Data Visualization - E Commerce DeckEmvigo Data Visualization - E Commerce Deck
Emvigo Data Visualization - E Commerce Deck
 
Deep visibility to secure network access with aruba ClearPass Insight
Deep visibility to secure network access with aruba ClearPass InsightDeep visibility to secure network access with aruba ClearPass Insight
Deep visibility to secure network access with aruba ClearPass Insight
 
Splunk Business Analytics
Splunk Business AnalyticsSplunk Business Analytics
Splunk Business Analytics
 

More from Andrei Kaleshka

Business domain isolation in db
Business domain isolation in dbBusiness domain isolation in db
Business domain isolation in dbAndrei Kaleshka
 
Корпоративное приложение на Rails
Корпоративное приложение на RailsКорпоративное приложение на Rails
Корпоративное приложение на RailsAndrei Kaleshka
 

More from Andrei Kaleshka (7)

Business domain isolation in db
Business domain isolation in dbBusiness domain isolation in db
Business domain isolation in db
 
Rails data migrations
Rails data migrationsRails data migrations
Rails data migrations
 
Корпоративное приложение на Rails
Корпоративное приложение на RailsКорпоративное приложение на Rails
Корпоративное приложение на Rails
 
Ruby exceptions
Ruby exceptionsRuby exceptions
Ruby exceptions
 
Rails3 way
Rails3 wayRails3 way
Rails3 way
 
Complete ruby code
Complete ruby codeComplete ruby code
Complete ruby code
 
Rails 3 assets pipeline
Rails 3 assets pipelineRails 3 assets pipeline
Rails 3 assets pipeline
 

Recently uploaded

The Significance of Transliteration Enhancing
The Significance of Transliteration EnhancingThe Significance of Transliteration Enhancing
The Significance of Transliteration Enhancingmohamed Elzalabany
 
1:1原版定制利物浦大学毕业证(Liverpool毕业证)成绩单学位证书留信学历认证
1:1原版定制利物浦大学毕业证(Liverpool毕业证)成绩单学位证书留信学历认证1:1原版定制利物浦大学毕业证(Liverpool毕业证)成绩单学位证书留信学历认证
1:1原版定制利物浦大学毕业证(Liverpool毕业证)成绩单学位证书留信学历认证ppy8zfkfm
 
Displacement, Velocity, Acceleration, and Second Derivatives
Displacement, Velocity, Acceleration, and Second DerivativesDisplacement, Velocity, Acceleration, and Second Derivatives
Displacement, Velocity, Acceleration, and Second Derivatives23050636
 
SCI8-Q4-MOD11.pdfwrwujrrjfaajerjrajrrarj
SCI8-Q4-MOD11.pdfwrwujrrjfaajerjrajrrarjSCI8-Q4-MOD11.pdfwrwujrrjfaajerjrajrrarj
SCI8-Q4-MOD11.pdfwrwujrrjfaajerjrajrrarjadimosmejiaslendon
 
Credit Card Fraud Detection: Safeguarding Transactions in the Digital Age
Credit Card Fraud Detection: Safeguarding Transactions in the Digital AgeCredit Card Fraud Detection: Safeguarding Transactions in the Digital Age
Credit Card Fraud Detection: Safeguarding Transactions in the Digital AgeBoston Institute of Analytics
 
1:1原版定制伦敦政治经济学院毕业证(LSE毕业证)成绩单学位证书留信学历认证
1:1原版定制伦敦政治经济学院毕业证(LSE毕业证)成绩单学位证书留信学历认证1:1原版定制伦敦政治经济学院毕业证(LSE毕业证)成绩单学位证书留信学历认证
1:1原版定制伦敦政治经济学院毕业证(LSE毕业证)成绩单学位证书留信学历认证dq9vz1isj
 
obat aborsi Tarakan wa 081336238223 jual obat aborsi cytotec asli di Tarakan9...
obat aborsi Tarakan wa 081336238223 jual obat aborsi cytotec asli di Tarakan9...obat aborsi Tarakan wa 081336238223 jual obat aborsi cytotec asli di Tarakan9...
obat aborsi Tarakan wa 081336238223 jual obat aborsi cytotec asli di Tarakan9...yulianti213969
 
Audience Researchndfhcvnfgvgbhujhgfv.pptx
Audience Researchndfhcvnfgvgbhujhgfv.pptxAudience Researchndfhcvnfgvgbhujhgfv.pptx
Audience Researchndfhcvnfgvgbhujhgfv.pptxStephen266013
 
How to Transform Clinical Trial Management with Advanced Data Analytics
How to Transform Clinical Trial Management with Advanced Data AnalyticsHow to Transform Clinical Trial Management with Advanced Data Analytics
How to Transform Clinical Trial Management with Advanced Data AnalyticsBrainSell Technologies
 
原件一样(UWO毕业证书)西安大略大学毕业证成绩单留信学历认证
原件一样(UWO毕业证书)西安大略大学毕业证成绩单留信学历认证原件一样(UWO毕业证书)西安大略大学毕业证成绩单留信学历认证
原件一样(UWO毕业证书)西安大略大学毕业证成绩单留信学历认证pwgnohujw
 
Aggregations - The Elasticsearch "GROUP BY"
Aggregations - The Elasticsearch "GROUP BY"Aggregations - The Elasticsearch "GROUP BY"
Aggregations - The Elasticsearch "GROUP BY"John Sobanski
 
What is Insertion Sort. Its basic information
What is Insertion Sort. Its basic informationWhat is Insertion Sort. Its basic information
What is Insertion Sort. Its basic informationmuqadasqasim10
 
Data Analytics for Digital Marketing Lecture for Advanced Digital & Social Me...
Data Analytics for Digital Marketing Lecture for Advanced Digital & Social Me...Data Analytics for Digital Marketing Lecture for Advanced Digital & Social Me...
Data Analytics for Digital Marketing Lecture for Advanced Digital & Social Me...Valters Lauzums
 
obat aborsi Banjarmasin wa 082135199655 jual obat aborsi cytotec asli di Ban...
obat aborsi Banjarmasin wa 082135199655 jual obat aborsi cytotec asli di  Ban...obat aborsi Banjarmasin wa 082135199655 jual obat aborsi cytotec asli di  Ban...
obat aborsi Banjarmasin wa 082135199655 jual obat aborsi cytotec asli di Ban...siskavia95
 
Identify Rules that Predict Patient’s Heart Disease - An Application of Decis...
Identify Rules that Predict Patient’s Heart Disease - An Application of Decis...Identify Rules that Predict Patient’s Heart Disease - An Application of Decis...
Identify Rules that Predict Patient’s Heart Disease - An Application of Decis...ThinkInnovation
 
Predictive Precipitation: Advanced Rain Forecasting Techniques
Predictive Precipitation: Advanced Rain Forecasting TechniquesPredictive Precipitation: Advanced Rain Forecasting Techniques
Predictive Precipitation: Advanced Rain Forecasting TechniquesBoston Institute of Analytics
 
Formulas dax para power bI de microsoft.pdf
Formulas dax para power bI de microsoft.pdfFormulas dax para power bI de microsoft.pdf
Formulas dax para power bI de microsoft.pdfRobertoOcampo24
 
Jual Obat Aborsi Bandung (Asli No.1) Wa 082134680322 Klinik Obat Penggugur Ka...
Jual Obat Aborsi Bandung (Asli No.1) Wa 082134680322 Klinik Obat Penggugur Ka...Jual Obat Aborsi Bandung (Asli No.1) Wa 082134680322 Klinik Obat Penggugur Ka...
Jual Obat Aborsi Bandung (Asli No.1) Wa 082134680322 Klinik Obat Penggugur Ka...Klinik Aborsi
 
社内勉強会資料_Object Recognition as Next Token Prediction
社内勉強会資料_Object Recognition as Next Token Prediction社内勉強会資料_Object Recognition as Next Token Prediction
社内勉強会資料_Object Recognition as Next Token PredictionNABLAS株式会社
 

Recently uploaded (20)

The Significance of Transliteration Enhancing
The Significance of Transliteration EnhancingThe Significance of Transliteration Enhancing
The Significance of Transliteration Enhancing
 
1:1原版定制利物浦大学毕业证(Liverpool毕业证)成绩单学位证书留信学历认证
1:1原版定制利物浦大学毕业证(Liverpool毕业证)成绩单学位证书留信学历认证1:1原版定制利物浦大学毕业证(Liverpool毕业证)成绩单学位证书留信学历认证
1:1原版定制利物浦大学毕业证(Liverpool毕业证)成绩单学位证书留信学历认证
 
Displacement, Velocity, Acceleration, and Second Derivatives
Displacement, Velocity, Acceleration, and Second DerivativesDisplacement, Velocity, Acceleration, and Second Derivatives
Displacement, Velocity, Acceleration, and Second Derivatives
 
SCI8-Q4-MOD11.pdfwrwujrrjfaajerjrajrrarj
SCI8-Q4-MOD11.pdfwrwujrrjfaajerjrajrrarjSCI8-Q4-MOD11.pdfwrwujrrjfaajerjrajrrarj
SCI8-Q4-MOD11.pdfwrwujrrjfaajerjrajrrarj
 
Credit Card Fraud Detection: Safeguarding Transactions in the Digital Age
Credit Card Fraud Detection: Safeguarding Transactions in the Digital AgeCredit Card Fraud Detection: Safeguarding Transactions in the Digital Age
Credit Card Fraud Detection: Safeguarding Transactions in the Digital Age
 
1:1原版定制伦敦政治经济学院毕业证(LSE毕业证)成绩单学位证书留信学历认证
1:1原版定制伦敦政治经济学院毕业证(LSE毕业证)成绩单学位证书留信学历认证1:1原版定制伦敦政治经济学院毕业证(LSE毕业证)成绩单学位证书留信学历认证
1:1原版定制伦敦政治经济学院毕业证(LSE毕业证)成绩单学位证书留信学历认证
 
obat aborsi Tarakan wa 081336238223 jual obat aborsi cytotec asli di Tarakan9...
obat aborsi Tarakan wa 081336238223 jual obat aborsi cytotec asli di Tarakan9...obat aborsi Tarakan wa 081336238223 jual obat aborsi cytotec asli di Tarakan9...
obat aborsi Tarakan wa 081336238223 jual obat aborsi cytotec asli di Tarakan9...
 
Abortion pills in Riyadh Saudi Arabia (+966572737505 buy cytotec
Abortion pills in Riyadh Saudi Arabia (+966572737505 buy cytotecAbortion pills in Riyadh Saudi Arabia (+966572737505 buy cytotec
Abortion pills in Riyadh Saudi Arabia (+966572737505 buy cytotec
 
Audience Researchndfhcvnfgvgbhujhgfv.pptx
Audience Researchndfhcvnfgvgbhujhgfv.pptxAudience Researchndfhcvnfgvgbhujhgfv.pptx
Audience Researchndfhcvnfgvgbhujhgfv.pptx
 
How to Transform Clinical Trial Management with Advanced Data Analytics
How to Transform Clinical Trial Management with Advanced Data AnalyticsHow to Transform Clinical Trial Management with Advanced Data Analytics
How to Transform Clinical Trial Management with Advanced Data Analytics
 
原件一样(UWO毕业证书)西安大略大学毕业证成绩单留信学历认证
原件一样(UWO毕业证书)西安大略大学毕业证成绩单留信学历认证原件一样(UWO毕业证书)西安大略大学毕业证成绩单留信学历认证
原件一样(UWO毕业证书)西安大略大学毕业证成绩单留信学历认证
 
Aggregations - The Elasticsearch "GROUP BY"
Aggregations - The Elasticsearch "GROUP BY"Aggregations - The Elasticsearch "GROUP BY"
Aggregations - The Elasticsearch "GROUP BY"
 
What is Insertion Sort. Its basic information
What is Insertion Sort. Its basic informationWhat is Insertion Sort. Its basic information
What is Insertion Sort. Its basic information
 
Data Analytics for Digital Marketing Lecture for Advanced Digital & Social Me...
Data Analytics for Digital Marketing Lecture for Advanced Digital & Social Me...Data Analytics for Digital Marketing Lecture for Advanced Digital & Social Me...
Data Analytics for Digital Marketing Lecture for Advanced Digital & Social Me...
 
obat aborsi Banjarmasin wa 082135199655 jual obat aborsi cytotec asli di Ban...
obat aborsi Banjarmasin wa 082135199655 jual obat aborsi cytotec asli di  Ban...obat aborsi Banjarmasin wa 082135199655 jual obat aborsi cytotec asli di  Ban...
obat aborsi Banjarmasin wa 082135199655 jual obat aborsi cytotec asli di Ban...
 
Identify Rules that Predict Patient’s Heart Disease - An Application of Decis...
Identify Rules that Predict Patient’s Heart Disease - An Application of Decis...Identify Rules that Predict Patient’s Heart Disease - An Application of Decis...
Identify Rules that Predict Patient’s Heart Disease - An Application of Decis...
 
Predictive Precipitation: Advanced Rain Forecasting Techniques
Predictive Precipitation: Advanced Rain Forecasting TechniquesPredictive Precipitation: Advanced Rain Forecasting Techniques
Predictive Precipitation: Advanced Rain Forecasting Techniques
 
Formulas dax para power bI de microsoft.pdf
Formulas dax para power bI de microsoft.pdfFormulas dax para power bI de microsoft.pdf
Formulas dax para power bI de microsoft.pdf
 
Jual Obat Aborsi Bandung (Asli No.1) Wa 082134680322 Klinik Obat Penggugur Ka...
Jual Obat Aborsi Bandung (Asli No.1) Wa 082134680322 Klinik Obat Penggugur Ka...Jual Obat Aborsi Bandung (Asli No.1) Wa 082134680322 Klinik Obat Penggugur Ka...
Jual Obat Aborsi Bandung (Asli No.1) Wa 082134680322 Klinik Obat Penggugur Ka...
 
社内勉強会資料_Object Recognition as Next Token Prediction
社内勉強会資料_Object Recognition as Next Token Prediction社内勉強会資料_Object Recognition as Next Token Prediction
社内勉強会資料_Object Recognition as Next Token Prediction
 

How we prevented account sharing with MFA