0

For a project we working on we need to implement multi-factor authentication. We where planning to do this with an NFC card and an NFC reader which we are going to build with an Arduino.

The planned workflow:

  1. A user logs in on the site; credentials are checked. There will be a flag in the database saying that the users needs to use their keycard.
  2. The website will use ajax to call a desktop service which is installed. The service calls the usb connected Arduino to say that the user needs to hold the keytag for the device.
  3. The user does this. The key inside the keycard is transmitted back to the service. The service passes this trough to the server. When accepted:

    1: The server set the flag in the database on true
    2: It answers to ajax request from the browser to tell it can continue.

Would it be a good idea to implement your own method like this? There is some discussion about it. How else can this be implemented? With a existing protocol?

A requirement is that the multi-factor works on multiple devices (Windows, Mac, Android) and in all browsers.

Edit
Thanks for the replies. As I expected there are better options. But I can't find the right solution. I need all browser support. (http://caniuse.com/#feat=u2f). Is there a program that extends u2f support to all browsers?

I don't want to use phones. Just keycards.

  • 3
    Yours is a bad idea. Home-made cards are not secure against cloning. If you really want to use an hardware card you should go with an industry standard (e.g. yubikey to give one example). Sure you have to buy them and they aren't extremely cheap (but if you buy 500 of them the cost shouldn't be that high per-key) but at least you end up with a secure authentication. – Bakuriu Sep 9 '16 at 9:55
1

The answer is more or less the same for all type of development work:

  1. Start with your requirements. What are they really and specifically ? Think usability requirement, security requirements, compatibility, etc. Everything counts.
  2. Once you have the requirements, have someone perform some research to see if there is an existing protocol (or better, an existing implementation) that will fit your needs (regarding requirements, tooling, skills and budget).
  3. Only then, start implementation (which might or might not require coding).

Based on your question there is nothing in the announced requirements ("we need to implement multi-factor authentication") that cannot be solved easily and cheaply by using TOTP and one of the many soft clients that supports it. Form more complex solutions, there are plenty of commercial offering.

  • Thanks for the answer. I did some research, but I just can't find a solution which is supported for all browsers. Can you point me in the right direction? – Andreas Furster Sep 13 '16 at 7:57
  • No because you haven't given us your requirements: there are too many possible solutions – Stephane Sep 13 '16 at 9:20
  • What do you need more? My solution does discribe what I want? – Andreas Furster Sep 13 '16 at 11:03
  • You've described your solution to your problem, you haven't described your requirements beyond "we need to implement multi-factor authentication" (see: meta.stackexchange.com/questions/66377/what-is-the-xy-problem) – Stephane Sep 14 '16 at 14:23

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.