Download as PDF, PPTX
![THE SOLUTIONS
SIGN THE FORM
<?php
$code = hash_hmac(
'sha256',
json_encode([
$verifierNonce,
$userID,
$expiration->format('Y-m-dTH:i:s')
]),
$tokenSigningKey
]);](https://image.slidesharecdn.com/multi-factorauthetification2017-en-171023201554/75/Multi-Factor-Authetification-ZendCon-2017-14-2048.jpg)
![PHOTO CREDITS
• Page 3 to 5: By Simeon87 (Own work) [CC BY-SA 3.0 (http://
creativecommons.org/licenses/by-sa/3.0)], via Wikimedia Commons
• Page 11: http://failblog.cheezburger.com/](https://image.slidesharecdn.com/multi-factorauthetification2017-en-171023201554/75/Multi-Factor-Authetification-ZendCon-2017-65-2048.jpg)
Uploaded byPhilippe Gamache
Multi Factor Authetification - ZendCon 2017
Philippe Gamache discusses the importance of multi-factor authentication and the differences between authentication and authorization in his presentation. He highlights common problems with password security and presents various solutions for strong authentication that cater to different budgets. The presentation emphasizes the necessity of using multiple pieces of evidence to verify user identity to enhance security against threats such as phishing and data theft.
More Related Content
Similar to Multi Factor Authetification - ZendCon 2017
![Automating ISP Networks Using Ansible and IPAM as a Source of Truth [SoT]](https://cdn.slidesharecdn.com/ss_thumbnails/automatingispnetworksusingansibleandipamasasourceoftruthsot-v25-1-251124105117-d7d4ca24-thumbnail.jpg?width=640&height=640&fit=bounds)
![[HUN][Hackersuli] Tickets Please - Kerberos](https://cdn.slidesharecdn.com/ss_thumbnails/ticketsplease-251119151220-b4647bd5-thumbnail.jpg?width=640&height=640&fit=bounds)
Multi Factor Authetification - ZendCon 2017
- 1. MULTI-FACTOR AUTHENTICATION AND STRONGAUTHENTICATION
- 2. ABOUT ME PHILIPPE GAMACHE HII’M PHILIPPE I’m a Developer Evangelist for kuzzle.io. Long-time internet developer, author, screen caster, podcaster and speaker. I’m specializes in PHP, Symfony, Kuzzle, security, code quality, performance, real time and geolocation. • Sécurité PHP 5 et MySQL 5 • OWASP Montreal • PHP Quebec • Table Top Game Developer • Pen & Paper RPG Writer
- 4. I'M MISLEADING YOU THISIS NOT THE EIFFEL TOWER
- 5. WHERE IN LASVEGAS EIFFEL TOWER RESTAURANT
- 6. AGENDA • Authentication vsAuthorization • Authentication's Problems • The solutions • Strong Authentication • Solutions for all budgets
- 7. AUTHENTICATION VS AUTHORIZATION •Authentication • Procedure that verifies the identity of an entity (person, computer ...) to allow access to resources (systems, networks, applications ...) • Authorization • Procedure that allows access to resources only to those authorized to use. AUTHORIZATION
- 8. AUTHENTICATION'S PROBLEMS • Accuratelyidentify the entity • Accurately identify the entity type • Accessibility • Broken Password A SIMPLE LIST
- 9. • People useeasy to find password • Easily give their passwords to strangers • without reason • 45 % of woman1 • 10 % of man1 • For a chocolate bar • 64 % of people1 • 21% have 10+ years old password2 • 47% have 5+ years old password2 • 73% use duplicated password2 • 54% have 5 or fewer passwords across the entire life2 • On average, only 6 unique passwords are used to guard 24 online account2 BROKEN PASSWORD THE HUMAN FACTOR 1 Infosec Europe Conference 2008 2 TeleSign Customer Account Security Report 2015
- 10. – Chris Nickerson- Exotic Liability #37 “In the middle of talking to him, he gives me, is online banking username and password.”
- 11. – Chris Nickerson- Exotic Liability #37 “In the middle of talking to him, he gives me, is online banking username and password.”
- 12. THE SOLUTION USE SECURITYQUESTIONS?
- 13. THE SOLUTION USE SECURITYQUESTIONS?
- 14. THE SOLUTIONS SIGN THEFORM <?php $code = hash_hmac( 'sha256', json_encode([ $verifierNonce, $userID, $expiration->format('Y-m-dTH:i:s') ]), $tokenSigningKey ]);
- 15.
- 16.
- 17.
- 18.
- 19.
- 20. FAITHFULLY IDENTIFY THEENTITY AND SHOVE THE SECURITY PROBLEM AWAY
- 21. STRONG AUTHENTICATION • Methodof computer access control; • User is granted access; • After successfully presenting several separate pieces of evidence MULTI-FACTOR AUTHENTICATION
- 22.
- 23.
- 24.
- 25.
- 26.
- 27.
- 28. MULTI-FACTOR AUTHENTICATION PHYSICAL FACTOR Memorialfactor Physical Factor
- 29. MULTI-FACTOR AUTHENTICATION PHYSICAL FACTOR Memorialfactor Physical Factor
- 30. MULTI-FACTOR AUTHENTICATION PHYSICAL FACTOR Memorialfactor Physical Factor
- 31. MULTI-FACTOR AUTHENTICATION PHYSICAL FACTOR Memorialfactor Physical Factor
- 32. MULTI-FACTOR AUTHENTICATION PHYSICAL FACTOR Memorialfactor Physical Factor
- 33. MULTI-FACTOR AUTHENTICATION PHYSICAL FACTOR Memorialfactor Physical Factor
- 34. MULTI-FACTOR AUTHENTICATION PHYSICAL FACTOR Memorialfactor Physical Factor
- 35. MULTI-FACTOR AUTHENTICATION PHYSICAL FACTOR Memorialfactor Physical Factor
- 36. MULTI-FACTOR AUTHENTICATION PHYSICAL FACTOR Memorialfactor Physical Factor
- 37. MULTI-FACTOR AUTHENTICATION REACTIONAL FACTOR Memorialfactor Reactional factor Physical Factor
- 38. MULTI-FACTOR AUTHENTICATION REACTIONAL FACTOR Memorialfactor Reactional factor Physical Factor
- 39. MULTI-FACTOR AUTHENTICATION MATERIAL FACTOR Memorialfactor Reactional factor Physical FactorMaterial factor
- 40. MULTI-FACTOR AUTHENTICATION MATERIAL FACTOR Memorialfactor Reactional factor Physical FactorMaterial factor
- 41. MULTI-FACTOR AUTHENTICATION MATERIAL FACTOR Memorialfactor Reactional factor Physical FactorMaterial factor
- 42. MULTI-FACTOR AUTHENTICATION MATERIAL FACTOR Memorialfactor Reactional factor Physical FactorMaterial factor
- 43. MULTI-FACTOR AUTHENTICATION MATERIAL FACTOR Memorialfactor Reactional factor Physical FactorMaterial factor
- 44. MULTI-FACTOR AUTHENTICATION MATERIAL FACTOR Memorialfactor Reactional factor Physical FactorMaterial factor
- 45. MULTI-FACTOR AUTHENTICATION MATERIAL FACTOR Memorialfactor Reactional factor Physical FactorMaterial factor
- 46. MULTI-FACTOR AUTHENTICATION MATERIAL FACTOR Memorialfactor Reactional factor Physical FactorMaterial factor
- 47. MULTI-FACTOR AUTHENTICATION MATERIAL FACTOR Memorialfactor Reactional factor Physical FactorMaterial factor
- 48. MULTI-FACTOR AUTHENTICATION MATERIAL FACTOR Memorialfactor Reactional factor Physical FactorMaterial factor
- 49. MULTI-FACTOR AUTHENTICATION MATERIAL FACTOR Memorialfactor Reactional factor Physical FactorMaterial factor
- 50. MULTI-FACTOR AUTHENTICATION MATERIAL FACTOR Memorialfactor Reactional factor Physical FactorMaterial factor
- 51. MULTI-FACTOR AUTHENTICATION TWO-FACTOR AUTHENTICATION Memorialfactor Reactional factor Physical FactorMaterial factor
- 52. TWO-FACTOR AUTHENTICATION EXAMPLES? Memorial factor Reactionalfactor Physical FactorMaterial factor
- 53. SOLUTIONS FOR ALLBUDGETS PERFECT PAPER PASSWORDS
- 54.
- 55.
- 56.
- 57. SOLUTIONS FOR ALLBUDGETS YUBIKEY
- 58.
- 59.
- 60. SOLUTIONS FOR ALLBUDGETS OATH OPEN AUTHENTICATION
- 61. SOLUTIONS FOR ALLBUDGETS OATH OPEN AUTHENTICATION
- 62. SOLUTIONS FOR ALLBUDGETS OATH OPEN AUTHENTICATION https://openauthentication.org
- 63. STRONG AUTHENTICATION • Man-in-the-middleattacks • Session or cookies thefts • Data theft if site not protected • Advance Phishing DOESN'T PROTECT YOU...
- 64. ANY QUESTIONS? THANK YOU! Ifyou want to talk more, feel free to contact me. http://kuzzle.io This presentation was created using Keynote. The text is set in Oswald and Ubuntu. The source code is set in Ubuntu Mono. The iconography is provided by Keynote, kuzzle.io and Font Awesome. Unless otherwise noted, all photographs are used by permission under a Creative Commons license. Please refer to the Photo Credits slide for more information. Copyright © This work is licensed under Creative Commons Attribution-ShareAlike 4.0 International. For uses not covered under this license, please contact the author. hello@kuzzle.io @kuzzleio Kuzzle kuzzleio http://kuzzle.io Presentation © Format_Informations hello@kuzzle.io @kuzzleio philippegamache joind.in/talk/b21f7 Please visit us at:
- 65. PHOTO CREDITS • Page3 to 5: By Simeon87 (Own work) [CC BY-SA 3.0 (http:// creativecommons.org/licenses/by-sa/3.0)], via Wikimedia Commons • Page 11: http://failblog.cheezburger.com/