My local bank uses a 2 factor authentication where customers key in password AND a One Time PIN delivered via SMS to mobile phone OR from a security token device.

I am doing a web startup in the ecommerce space.

I already have implemented https for important pages like login. I have chosen a, shall we say, cost effective SSL CA that has the initials GD.

This may be in the future, but what is a cost effective solution for me to implement a 2 factor authentication like my local bank for my users?

Which vendor would provide a cost effective solution just like I approached GD for my SSL certs?

closed as off-topic by WhiteWinterWolf, techraf, Anders, John Deters, Matthew Jul 15 '16 at 8:42

This question appears to be off-topic. The users who voted to close gave this specific reason:

If this question can be reworded to fit the rules in the help center, please edit the question.

  • 3
    @keisimone - when you say you have implemented https for important pages, have you ensured you don't use any tokens/cookies etc from your http session in your https session? In addition, you might need to explain your measurement of 'cost effective' as this could vary a lot. Do you consider the industry standard RSA tokens as a cost effective hardware solution? – Rory Alsop Feb 27 '11 at 16:52
  • 2
    @keisimone - have a quick read of this article on firesheep. en.wikipedia.org/wiki/Firesheep which is useful, if not 100% relevant. The important thing is to realise that anything used in the unencrypted session should be considered vulnerable, so when logging into a secure session, you should create new session cookies for the secure session. – Rory Alsop Feb 27 '11 at 18:05
  • 2
    @Rory I don't think anybody considers RSA tokens to be cost-effective... (Powerful product, but cost is not the strong point). – AviD Feb 27 '11 at 19:31
  • 1
    @keisimone - The way to ensure cookies aren't shared across sessions is to (1) use https sitewide, and (2) enable the SECURE flag on all cookies. – D.W. Feb 28 '11 at 9:06
  • 1
    @keisimone - Many sites use mixed http/https because it's cheaper, or because they think it will be cheaper (it may not actually be), or they aren't aware of the risks or don't think bad things will happen to them. As for the SECURE flag, google what is the secure flag on cookies? and you'll find many explanations (e.g., 1, 2, 3). Use Google -- it is your friend! – D.W. Mar 2 '11 at 6:37

11 Answers 11


If you're willing to delegate your user authentication function to someone else, then Google's two factor authentication is a good option.

  • 2
    I use Google's two factor auth with gmail and can tell you that it is a well implemented and well thought out platform. – Antonius Bloch May 29 '11 at 5:03
  • 1
    I'd second the Google 2-factor app that's available for IPhone, Android, BB + more. The code is open source and you can add SMS or phone calls as a backup? – Tim Sep 6 '11 at 11:58
  • I read the docs. but not sure if it means that my users must have a google account? – Kim Stacks Jan 16 '14 at 10:59

I would recommend looking into PhoneFacter. I have looked at them in the past and found it to be a very interesting concept. Much like your bank they use telephones as the second factor, and offer either SMS or direct voice calls for verification.

Whether they are "Cost Effective" will, of course, depend on what those words mean to you.

  • This PhoneFactor is interesting. Does it work for non US companies? and have you use it before? Either as a client of an enterprise which bought PhoneFactor's services or the client of PhoneFactor itself? – Kim Stacks Mar 1 '11 at 2:05
  • I just an email to PhoneFactor. Hopefully they work for non US companies. THank you. – Kim Stacks Mar 4 '11 at 3:33
  • You should be able to get a free version (10 users or less) of Phone Factor. www.phonefactor.com - I use this in a much larger sense and I really like it. It can call you and require a PIN, or just to press #, or it can send texts too (I think) – LVLAaron Feb 11 '12 at 2:50

Although I have not personally used them, I have heard very good things from several sources about YubiKey, which is a tiny hardware key that's plugged into a computer USB port and basically provides a one time password which changes each time it is used.

  • 3
    If you use them, I hope you'll come back and update your experience. – Knox Feb 28 '11 at 13:08
  • I am looking at all options. Thank you Knox. I prefer something that users already have instead of giving them another piece of equipment which they may lose or misuse. I have seen people unable to use USB devices. They exist, believe it or not. – Kim Stacks Mar 1 '11 at 2:01
  • I bought a Yubikey for personal use. I think the reason banks (at least in the UK) don't use something similar is because it's not immediately obvious to non-technical users and the decision makers at the banks how it works. – Stephen Paulger May 13 '11 at 15:03
  • I use a yubikey. If availability of a USB port to end users isn't an issue, its a very nice 2 factor option. I'd recommend them to people for use in such an environment, perhaps not if you want to use ipads or other crippled devices. – Sirex Jul 5 '11 at 6:57

We provide a two-factor solution at Duo Security which can use voice, SMS, mobile device, and hardware tokens. Our open-source web and unix clients may also help you evaluate your options (both ours, others, and towards rolling your own). Disclaimer, I am a Duo developer.


Can I suggest something a little less standard, and consider going with software-based biometric authentication?
I'm familiar with a few (stealth) startups working in this space... this can include things like keyboard dynamics, fingerprint recognition via webcam, others...

  • 2
    @AviD - this sounds interesting... – Rory Alsop Feb 27 '11 at 20:01
  • 2
    My understanding of biometrics is that they make a very poor security token, as they're not secret and easy to replicate? – growse Feb 28 '11 at 10:35
  • @growse, I don't think you're wrong about that, biometrics are inherently a "close enough" solution (as opposed to "something you have" or even a password, where an exact match is possible, and required). I am of the mind that biometrics are usually closer to "identification" rather than "authentication"... That said, as a second factor, they can add a lot of value - though they're often not secret, its not always easy to replicate (and that depends on the implementation, there should be protection against "reuse"). Point is, it's a lot cheaper than a hardware token.... – AviD Feb 28 '11 at 10:59
  • It's a good point - I can appreciate that for certain applications they may have a good application. I'm just wary because I've seen an unjustified amount of faith put into biometrics as a token, where people think they solve all security problems. – growse Feb 28 '11 at 11:20
  • @growse, oh absolutely. Definitely don't "solve all security problems", not even authentication - I see it as a sort of compromise, because the credentials are "easy". Credential management, on the other hand, becomes a very sticky business. But more than that, biometrics are always based on a sliding scale, i.e. "we think this is really you, more than we think that it's not". It really comes back to a tradeoff, and with software biometrics being more available - and now even cheaper than hw tokens (used to be the opposite) - I see it being a much more suitable solution in most cases. – AviD Feb 28 '11 at 11:43

The shame on me, I don't know the cost figures but maybe you want to try ex-VeriSign cloud based two-factor authentication. The web site claims it is low cost.


Although not an answer, I'll post it here. I sure hope that common everyday e-commerce sites do NOT start using 2-factor authentication as standard. It should always be optional for users unless there is large liability (unacceptable risk+cost) leveraged against your business. I hate them, and they're horribly annoying when traveling. It slows down my web experience while I wait for a text message or email and transcribe the one-time code. My worst experience was trying to receive an SMS verification code while overseas and my phone on roaming.

Here's my suggestion: use email addresses verification and HTTPS until you've got time+money to go further. Then add it as an option, just like OpenID.

Even phone-number-based 2-factor authentication relies on identifying the user's phone number. I know people who would rather give you a credit card to verify their address than give their phone number to a random website. Especially if you're in the e-commerce space. Consider identity verification as an extra step to registration rather than an extra step to login.

  • 3
    The problems you mention are all in the implementation. For example some two factor products only require the second factor only when you log in from a new ip, or with a new cookie. Password based authentication is horribly broken, so I hope to see more sites using two factor. Hopefully we can find a sweet spot between usability and security. – Antonius Bloch May 29 '11 at 5:16

SMS has never been a Quality Assured channel as it mostly works in "fire and forget" mode, with delivery speed depending on many factors outside the sender's control. Also you have to maintain the current user phone number and have a secure procedure for changing it. Furthermore, the cost of an SMS is still relatively high. I didn't test, i don't know how much it costs, but the solution looks interesting, the problem, as with SMS, that you force mobile telephone as requirement to use your site. the solution: http://www.cronto.com/visual_cryptogram.htm


Apache TripleSec might be of interest, although I haven't tried it, so I'm not sure how stable it is.

  • Not very; as they don't even have a release and haven't committed any code this year. – Antonius Bloch May 29 '11 at 5:07
  • That URL is now 404. I found a French language Usenet discussion via Google search. The search result "snippet" noted with some surprise that Triplesec hadn't been updated in 7 years. Google must have taken custody of that Usenet group as Google gave me a 404 too. It is odd, as Apache still lists "Apache Triplesec" as a trademark in its website footer. – Ellie Kesselman Nov 12 '13 at 2:38

As a consultant for authentication and authorisation solutions I have looked at several products using OTP, Biometrics and other challenge response systems. I find Snorkel-TX from Odyssey Technologies Limited, is a comprehensive and well engineered security solution for Web applications. It is cost effective compared to many other solutions. It can be implemented in a very short time without any coding changes to the web application.


Might I recommend LaunchKey as they provide true multi-factor authentication as a service and their API and mobile apps are all free. It should also be noted that multi-factor authentication combines all 3 possible auth factor types (knowledge, possession, inherence) and is considered more secure than two-factor which would only utilize 2 of the 3. From a security perspective, you should be pursuing MFA rather than 2FA.

  • 4
    Hello inf0sec. When you're affiliated with a product you're recommending, according to our rules, you must disclose your affiliation in the body of your post, or you risk having them flagged as spam. More here: security.stackexchange.com/help/behavior – Xander Jan 15 '14 at 21:23

Not the answer you're looking for? Browse other questions tagged or ask your own question.