Take the 2-minute tour ×
Information Security Stack Exchange is a question and answer site for Information security professionals. It's 100% free, no registration required.

My local bank uses a 2 factor authentication where customers key in password AND a One Time PIN delivered via SMS to mobile phone OR from a security token device.

I am doing a web startup in the ecommerce space.

I already have implemented https for important pages like login. I have chosen a, shall we say, cost effective SSL CA that has the initials GD.

This may be in the future, but what is a cost effective solution for me to implement a 2 factor authentication like my local bank for my users?

Which vendor would provide a cost effective solution just like I approached GD for my SSL certs?

PS: can someone create a tag for 2-factor-authentication?

share|improve this question
3  
@keisimone - when you say you have implemented https for important pages, have you ensured you don't use any tokens/cookies etc from your http session in your https session? In addition, you might need to explain your measurement of 'cost effective' as this could vary a lot. Do you consider the industry standard RSA tokens as a cost effective hardware solution? –  Rory Alsop Feb 27 '11 at 16:52
2  
@keisimone - have a quick read of this article on firesheep. en.wikipedia.org/wiki/Firesheep which is useful, if not 100% relevant. The important thing is to realise that anything used in the unencrypted session should be considered vulnerable, so when logging into a secure session, you should create new session cookies for the secure session. –  Rory Alsop Feb 27 '11 at 18:05
2  
@Rory I don't think anybody considers RSA tokens to be cost-effective... (Powerful product, but cost is not the strong point). –  AviD Feb 27 '11 at 19:31
1  
@keisimone - The way to ensure cookies aren't shared across sessions is to (1) use https sitewide, and (2) enable the SECURE flag on all cookies. –  D.W. Feb 28 '11 at 9:06
1  
@keisimone - Many sites use mixed http/https because it's cheaper, or because they think it will be cheaper (it may not actually be), or they aren't aware of the risks or don't think bad things will happen to them. As for the SECURE flag, google what is the secure flag on cookies? and you'll find many explanations (e.g., 1, 2, 3). Use Google -- it is your friend! –  D.W. Mar 2 '11 at 6:37
show 6 more comments

10 Answers

Might I recommend LaunchKey as they provide true multi-factor authentication as a service and their API and mobile apps are all free. It should also be noted that multi-factor authentication combines all 3 possible auth factor types (knowledge, possession, inherence) and is considered more secure than two-factor which would only utilize 2 of the 3. From a security perspective, you should be pursuing MFA rather than 2FA.

share|improve this answer
1  
Hello inf0sec. When you're affiliated with a product you're recommending, according to our rules, you must disclose your affiliation in the body of your post, or you risk having them flagged as spam. More here: security.stackexchange.com/help/behavior –  Xander Jan 15 at 21:23
add comment

SMS has never been a Quality Assured channel as it mostly works in "fire and forget" mode, with delivery speed depending on many factors outside the sender's control. Also you have to maintain the current user phone number and have a secure procedure for changing it. Furthermore, the cost of an SMS is still relatively high. I didn't test, i don't know how much it costs, but the solution looks interesting, the problem, as with SMS, that you force mobile telephone as requirement to use your site. the solution: http://www.cronto.com/visual_cryptogram.htm

share|improve this answer
add comment

Apache TripleSec might be of interest, although I haven't tried it, so I'm not sure how stable it is.

share|improve this answer
    
Not very; as they don't even have a release and haven't committed any code this year. –  Antonius Bloch May 29 '11 at 5:07
    
That URL is now 404. I found a French language Usenet discussion via Google search. The search result "snippet" noted with some surprise that Triplesec hadn't been updated in 7 years. Google must have taken custody of that Usenet group as Google gave me a 404 too. It is odd, as Apache still lists "Apache Triplesec" as a trademark in its website footer. –  Feral Oink Nov 12 '13 at 2:38
add comment

If you're willing to delegate your user authentication function to someone else, then Google's two factor authentication is a good option.

share|improve this answer
    
I use Google's two factor auth with gmail and can tell you that it is a well implemented and well thought out platform. –  Antonius Bloch May 29 '11 at 5:03
    
I'd second the Google 2-factor app that's available for IPhone, Android, BB + more. The code is open source and you can add SMS or phone calls as a backup? –  Jim Sep 6 '11 at 11:58
    
I read the docs. but not sure if it means that my users must have a google account? –  Kim Stacks Jan 16 at 10:59
add comment

Although not an answer, I'll post it here. I sure hope that common everyday e-commerce sites do NOT start using 2-factor authentication as standard. It should always be optional for users unless there is large liability (unacceptable risk+cost) leveraged against your business. I hate them, and they're horribly annoying when traveling. It slows down my web experience while I wait for a text message or email and transcribe the one-time code.

Here's my suggestion: use email addresses verification and HTTPS until you've got time+money to go further. Then add it as an option, just like OpenID.

Even phone-number-based 2-factor authentication relies on identifying the user's phone number. I know people who would rather give you a credit card to verify their address than give their phone number to a random website. Especially if you're in the e-commerce space. Consider identity verification as an extra step to registration rather than an extra step to login.

share|improve this answer
1  
The problems you mention are all in the implementation. For example some two factor products only require the second factor only when you log in from a new ip, or with a new cookie. Password based authentication is horribly broken, so I hope to see more sites using two factor. Hopefully we can find a sweet spot between usability and security. –  Antonius Bloch May 29 '11 at 5:16
add comment

The shame on me, I don't know the cost figures but maybe you want to try ex-VeriSign cloud based two-factor authentication. The web site claims it is low cost.

share|improve this answer
    
Well, unlike many other services, your suggestion has withstood the test of time, and is still supported. The URL still works too! No "shame on you"! The cost structure is here symantec.com/verisign/vip-authentication-service/… –  Feral Oink Nov 12 '13 at 2:46
add comment

We provide a two-factor solution at Duo Security which can use voice, SMS, mobile device, and hardware tokens. Our open-source web and unix clients may also help you evaluate your options (both ours, others, and towards rolling your own). Disclaimer, I am a Duo developer.

share|improve this answer
add comment

Although I have not personally used them, I have heard very good things from several sources about YubiKey, which is a tiny hardware key that's plugged into a computer USB port and basically provides a one time password which changes each time it is used.

share|improve this answer
3  
If you use them, I hope you'll come back and update your experience. –  Knox Feb 28 '11 at 13:08
    
I am looking at all options. Thank you Knox. I prefer something that users already have instead of giving them another piece of equipment which they may lose or misuse. I have seen people unable to use USB devices. They exist, believe it or not. –  Kim Stacks Mar 1 '11 at 2:01
    
I bought a Yubikey for personal use. I think the reason banks (at least in the UK) don't use something similar is because it's not immediately obvious to non-technical users and the decision makers at the banks how it works. –  StephenPaulger May 13 '11 at 15:03
    
I use a yubikey. If availability of a USB port to end users isn't an issue, its a very nice 2 factor option. I'd recommend them to people for use in such an environment, perhaps not if you want to use ipads or other crippled devices. –  Sirex Jul 5 '11 at 6:57
add comment

I would recommend looking into PhoneFacter. I have looked at them in the past and found it to be a very interesting concept. Much like your bank they use telephones as the second factor, and offer either SMS or direct voice calls for verification.

Whether they are "Cost Effective" will, of course, depend on what those words mean to you.

share|improve this answer
    
This PhoneFactor is interesting. Does it work for non US companies? and have you use it before? Either as a client of an enterprise which bought PhoneFactor's services or the client of PhoneFactor itself? –  Kim Stacks Mar 1 '11 at 2:05
    
I just an email to PhoneFactor. Hopefully they work for non US companies. THank you. –  Kim Stacks Mar 4 '11 at 3:33
    
You should be able to get a free version (10 users or less) of Phone Factor. www.phonefactor.com - I use this in a much larger sense and I really like it. It can call you and require a PIN, or just to press #, or it can send texts too (I think) –  LVLAaron Feb 11 '12 at 2:50
add comment

Can I suggest something a little less standard, and consider going with software-based biometric authentication?
I'm familiar with a few (stealth) startups working in this space... this can include things like keyboard dynamics, fingerprint recognition via webcam, others...

share|improve this answer
2  
@AviD - this sounds interesting... –  Rory Alsop Feb 27 '11 at 20:01
2  
My understanding of biometrics is that they make a very poor security token, as they're not secret and easy to replicate? –  growse Feb 28 '11 at 10:35
    
@growse, I don't think you're wrong about that, biometrics are inherently a "close enough" solution (as opposed to "something you have" or even a password, where an exact match is possible, and required). I am of the mind that biometrics are usually closer to "identification" rather than "authentication"... That said, as a second factor, they can add a lot of value - though they're often not secret, its not always easy to replicate (and that depends on the implementation, there should be protection against "reuse"). Point is, it's a lot cheaper than a hardware token.... –  AviD Feb 28 '11 at 10:59
    
It's a good point - I can appreciate that for certain applications they may have a good application. I'm just wary because I've seen an unjustified amount of faith put into biometrics as a token, where people think they solve all security problems. –  growse Feb 28 '11 at 11:20
    
@growse, oh absolutely. Definitely don't "solve all security problems", not even authentication - I see it as a sort of compromise, because the credentials are "easy". Credential management, on the other hand, becomes a very sticky business. But more than that, biometrics are always based on a sliding scale, i.e. "we think this is really you, more than we think that it's not". It really comes back to a tradeoff, and with software biometrics being more available - and now even cheaper than hw tokens (used to be the opposite) - I see it being a much more suitable solution in most cases. –  AviD Feb 28 '11 at 11:43
show 1 more comment

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.