I work for an AWS managed service provider, and we are brainstorming the best way to authenticate someone who calls for support over the phone. Yes, we could use a verbal password, but this can be shared or easily stolen. Is there any way we can easily generate a QR code for our customers to configure MFA and match the token we see for each customer with the customer calling in?
asked Dec 16, 2015 at 23:23
-
You mean, like Google Authenticator does? Have you checked out their process?– schroeder ♦Commented Dec 17, 2015 at 0:34
Add a comment
|
1 Answer
There are a few common ways to do that:
- SMS tokens: send a random password to a registered mobile phone. That's basically the lowest possible standard for 2FA since SMS aren't exactly secret and many smart phones will (by default) display the content of the SMS message without requiring the user to unlock it. Basically, it just verifies that the user can view the phone's screen.
- HOTP/TOTP: Defined by two RFCs, 4226 (HOTP) and 6238 (TOTP), these are one-time passwords that are generated by a small software. Google authenticator is a famous implementation of that standard. It's very easy to implement and requires next to nothing in therms of fixed costs. It's a bit better in terms of security than SMS but requires more work from the user. It's therefore used in more technical-oriented environment.
- Security tokens (RSA SecureID, Sefenet SafeWord, for instance) are dedicated security devices that will generate single-use or time-based passwords according to a key that is stored in a tamper-proof container. The reason these are safer than software tokens is that the tokens are VERY hard to copy and the secret key is therefore well protected. Deploying these is pretty expensive, though.
There are plenty of other two-factors systems out there for a variety of costs and functionality. These are just a few examples that fits your requirements
