📍How we managed to improve the situation around the problem of app sharing. 📍What methods did we use to combat the problem? 📍What results were obtained and how they were measured. 📍And also how you can do it even better and why all this is needed.

1. Preventing Account Sharing
Andrei Kaleshka
@ka8725

2. ka8725

3. ka8725

4. ka8725

5. Multi-factor Authentication (MFA)?
ka8725

6. Multi-factor Authentication (MFA)?
ka8725
Possible Solution Simple
Needs more data
from user Precise
OK for long
run
Business is OK
with it
Third-party Y N N N Y
Logs analysis N N N Y Y
Limit by device
type Y N Y Y N
MFA via phone Y Y Y Y N
MFA via
Authenticator Y Y Y Y N
MFA via email Y N Y Y Y
Consider solutions

7. Multi-factor Authentication (MFA)?
ka8725

8. Multi-factor Authentication (MFA)?
MFA?
ka8725

9. Multi-factor Authentication (MFA)?
Scaffolding - in construction. Data - in IT
ka8725

10. Multi-factor Authentication (MFA)?
Strategy/Plan
- Collect data about login sessions
- Measure necessary indicators
- Enable MFA only for those who share account
- Monitor the indicators
ka8725

11. Multi-factor Authentication (MFA)?
Indicators
- Number of signups per day/week/month
- Users’ Retention (how many leave/stay)
- Number of login sessions per user
- Revenue (in Stripe)
ka8725

12. Multi-factor Authentication (MFA)?
Our expectations
- Number of signups per day/week/month
- Users Retention (how many leave/stay)
- Number of login sessions per user
- Revenue (in Stripe)
ka8725

13. Multi-factor Authentication (MFA)?
Collect Data
- Paper_trail gem for history of signups/subscription changes
- Login_sessions table. It’s ID is injected into cookies
User logs in -> login session record created
logs out -> login session gets deactivated
ka8725

14. Multi-factor Authentication (MFA)?
Build indicators and visualize data with
Metabase
ka8725

15. Multi-factor Authentication (MFA)?
Active login sessions per user with MFA
ka8725

16. Multi-factor Authentication (MFA)?
Active login sessions per user with MFA: SQL
ka8725
Learn SQL!

17. Multi-factor Authentication (MFA)?
Active login sessions per user without MFA
q1, q2
ka8725

18. Multi-factor Authentication (MFA)?
Active login sessions per user for all
q1, q2
ka8725

19. Multi-factor Authentication (MFA)?
Login sessions created per day
ka8725

20. Multi-factor Authentication (MFA)?
Retention of users
ka8725

21. Multi-factor Authentication (MFA)?
User signups trend
ka8725

22. Multi-factor Authentication (MFA)?
User signups trend
ka8725

23. Multi-factor Authentication (MFA)?
Success!!!
ka8725

24. Multi-factor Authentication (MFA)?
Organic search could also impact the results
ka8725

25. Multi-factor Authentication (MFA)?
How we implemented MFA
- Devise-two-factor gem. The codes sent via email
- “Remember” the code pass in cookies 30 days
ka8725

26. Multi-factor Authentication (MFA)?
How we implemented login sessions concept
ka8725

27. Multi-factor Authentication (MFA)?
How we implemented login sessions concept
ka8725

28. Multi-factor Authentication (MFA)?
How we implemented login sessions concept
ka8725

29. Multi-factor Authentication (MFA)?
How we implemented login sessions concept
Cookies are encrypted!
ka8725

30. Multi-factor Authentication (MFA)?
How we implemented login sessions concept
ka8725

31. Multi-factor Authentication (MFA)?
Future plans: login sessions limit per user
ka8725

32. Multi-factor Authentication (MFA)?
Takeaways
ka8725

33. Multi-factor Authentication (MFA)?
Takeaways
- Define indicators and measure them for a risky feature
- Analyze data
- AI SQL is the future skill
- MFA made our app healthier
ka8725

34. Andrei Kaleshka
dev@widefix.com
@ka8725
Contacts
ka8725