19

My local bank uses a 2 factor authentication where customers key in password AND a One Time PIN delivered via SMS to mobile phone OR from a security token device.

I am doing a web startup in the ecommerce space.

I already have implemented https for important pages like login. I have chosen a, shall we say, cost effective SSL CA that has the initials GD.

This may be in the future, but what is a cost effective solution for me to implement a 2 factor authentication like my local bank for my users?

Which vendor would provide a cost effective solution just like I approached GD for my SSL certs?

Improve this question
11
  • 3
    @keisimone - when you say you have implemented https for important pages, have you ensured you don't use any tokens/cookies etc from your http session in your https session? In addition, you might need to explain your measurement of 'cost effective' as this could vary a lot. Do you consider the industry standard RSA tokens as a cost effective hardware solution?
    – Rory Alsop ♦
    Feb 27, 2011 at 16:52
  • 2
    @keisimone - have a quick read of this article on firesheep. en.wikipedia.org/wiki/Firesheep which is useful, if not 100% relevant. The important thing is to realise that anything used in the unencrypted session should be considered vulnerable, so when logging into a secure session, you should create new session cookies for the secure session.
    – Rory Alsop ♦
    Feb 27, 2011 at 18:05
  • 2
    @Rory I don't think anybody considers RSA tokens to be cost-effective... (Powerful product, but cost is not the strong point).
    – AviD ♦
    Feb 27, 2011 at 19:31
  • 1
    @keisimone - The way to ensure cookies aren't shared across sessions is to (1) use https sitewide, and (2) enable the SECURE flag on all cookies.
    – D.W.
    Feb 28, 2011 at 9:06
  • 1
    @keisimone - Many sites use mixed http/https because it's cheaper, or because they think it will be cheaper (it may not actually be), or they aren't aware of the risks or don't think bad things will happen to them. As for the SECURE flag, google what is the secure flag on cookies? and you'll find many explanations (e.g., 1, 2, 3). Use Google -- it is your friend!
    – D.W.
    Mar 2, 2011 at 6:37

11 Answers 11

Reset to default
15

If you're willing to delegate your user authentication function to someone else, then Google's two factor authentication is a good option.

Improve this answer
3
  • 2
    I use Google's two factor auth with gmail and can tell you that it is a well implemented and well thought out platform.
    – Antonius Bloch
    May 29, 2011 at 5:03
  • 1
    I'd second the Google 2-factor app that's available for IPhone, Android, BB + more. The code is open source and you can add SMS or phone calls as a backup?
    – Tim
    Sep 6, 2011 at 11:58
  • I read the docs. but not sure if it means that my users must have a google account?
    – Kim Stacks
    Jan 16, 2014 at 10:59
10

I would recommend looking into PhoneFacter. I have looked at them in the past and found it to be a very interesting concept. Much like your bank they use telephones as the second factor, and offer either SMS or direct voice calls for verification.

Whether they are "Cost Effective" will, of course, depend on what those words mean to you.

Improve this answer
3
  • This PhoneFactor is interesting. Does it work for non US companies? and have you use it before? Either as a client of an enterprise which bought PhoneFactor's services or the client of PhoneFactor itself?
    – Kim Stacks
    Mar 1, 2011 at 2:05
  • I just an email to PhoneFactor. Hopefully they work for non US companies. THank you.
    – Kim Stacks
    Mar 4, 2011 at 3:33
  • You should be able to get a free version (10 users or less) of Phone Factor. www.phonefactor.com - I use this in a much larger sense and I really like it. It can call you and require a PIN, or just to press #, or it can send texts too (I think)
    – LVLAaron
    Feb 11, 2012 at 2:50
9

Although I have not personally used them, I have heard very good things from several sources about YubiKey, which is a tiny hardware key that's plugged into a computer USB port and basically provides a one time password which changes each time it is used.

Improve this answer
4
  • 3
    If you use them, I hope you'll come back and update your experience.
    – Knox
    Feb 28, 2011 at 13:08
  • I am looking at all options. Thank you Knox. I prefer something that users already have instead of giving them another piece of equipment which they may lose or misuse. I have seen people unable to use USB devices. They exist, believe it or not.
    – Kim Stacks
    Mar 1, 2011 at 2:01
  • I bought a Yubikey for personal use. I think the reason banks (at least in the UK) don't use something similar is because it's not immediately obvious to non-technical users and the decision makers at the banks how it works.
    – Stephen Paulger
    May 13, 2011 at 15:03
  • I use a yubikey. If availability of a USB port to end users isn't an issue, its a very nice 2 factor option. I'd recommend them to people for use in such an environment, perhaps not if you want to use ipads or other crippled devices.
    – Sirex
    Jul 5, 2011 at 6:57
9

We provide a two-factor solution at Duo Security which can use voice, SMS, mobile device, and hardware tokens. Our open-source web and unix clients may also help you evaluate your options (both ours, others, and towards rolling your own). Disclaimer, I am a Duo developer.

Improve this answer
4

Can I suggest something a little less standard, and consider going with software-based biometric authentication?
I'm familiar with a few (stealth) startups working in this space... this can include things like keyboard dynamics, fingerprint recognition via webcam, others...

Improve this answer
5
  • 2
    @AviD - this sounds interesting...
    – Rory Alsop ♦
    Feb 27, 2011 at 20:01
  • 2
    My understanding of biometrics is that they make a very poor security token, as they're not secret and easy to replicate?
    – growse
    Feb 28, 2011 at 10:35
  • @growse, I don't think you're wrong about that, biometrics are inherently a "close enough" solution (as opposed to "something you have" or even a password, where an exact match is possible, and required). I am of the mind that biometrics are usually closer to "identification" rather than "authentication"... That said, as a second factor, they can add a lot of value - though they're often not secret, its not always easy to replicate (and that depends on the implementation, there should be protection against "reuse"). Point is, it's a lot cheaper than a hardware token....
    – AviD ♦
    Feb 28, 2011 at 10:59
  • It's a good point - I can appreciate that for certain applications they may have a good application. I'm just wary because I've seen an unjustified amount of faith put into biometrics as a token, where people think they solve all security problems.
    – growse
    Feb 28, 2011 at 11:20
  • @growse, oh absolutely. Definitely don't "solve all security problems", not even authentication - I see it as a sort of compromise, because the credentials are "easy". Credential management, on the other hand, becomes a very sticky business. But more than that, biometrics are always based on a sliding scale, i.e. "we think this is really you, more than we think that it's not". It really comes back to a tradeoff, and with software biometrics being more available - and now even cheaper than hw tokens (used to be the opposite) - I see it being a much more suitable solution in most cases.
    – AviD ♦
    Feb 28, 2011 at 11:43
3

The shame on me, I don't know the cost figures but maybe you want to try ex-VeriSign cloud based two-factor authentication. The web site claims it is low cost.

Improve this answer
1
3

Although not an answer, I'll post it here. I sure hope that common everyday e-commerce sites do NOT start using 2-factor authentication as standard. It should always be optional for users unless there is large liability (unacceptable risk+cost) leveraged against your business. I hate them, and they're horribly annoying when traveling. It slows down my web experience while I wait for a text message or email and transcribe the one-time code. My worst experience was trying to receive an SMS verification code while overseas and my phone on roaming.

Here's my suggestion: use email addresses verification and HTTPS until you've got time+money to go further. Then add it as an option, just like OpenID.

Even phone-number-based 2-factor authentication relies on identifying the user's phone number. I know people who would rather give you a credit card to verify their address than give their phone number to a random website. Especially if you're in the e-commerce space. Consider identity verification as an extra step to registration rather than an extra step to login.

Improve this answer
1
  • 3
    The problems you mention are all in the implementation. For example some two factor products only require the second factor only when you log in from a new ip, or with a new cookie. Password based authentication is horribly broken, so I hope to see more sites using two factor. Hopefully we can find a sweet spot between usability and security.
    – Antonius Bloch
    May 29, 2011 at 5:16
2

SMS has never been a Quality Assured channel as it mostly works in "fire and forget" mode, with delivery speed depending on many factors outside the sender's control. Also you have to maintain the current user phone number and have a secure procedure for changing it. Furthermore, the cost of an SMS is still relatively high. I didn't test, i don't know how much it costs, but the solution looks interesting, the problem, as with SMS, that you force mobile telephone as requirement to use your site. the solution: http://www.cronto.com/visual_cryptogram.htm

Improve this answer
0

Apache TripleSec might be of interest, although I haven't tried it, so I'm not sure how stable it is.

Improve this answer
2
  • Not very; as they don't even have a release and haven't committed any code this year.
    – Antonius Bloch
    May 29, 2011 at 5:07
  • That URL is now 404. I found a French language Usenet discussion via Google search. The search result "snippet" noted with some surprise that Triplesec hadn't been updated in 7 years. Google must have taken custody of that Usenet group as Google gave me a 404 too. It is odd, as Apache still lists "Apache Triplesec" as a trademark in its website footer.
    – Ellie Kesselman
    Nov 12, 2013 at 2:38
0

As a consultant for authentication and authorisation solutions I have looked at several products using OTP, Biometrics and other challenge response systems. I find Snorkel-TX from Odyssey Technologies Limited, is a comprehensive and well engineered security solution for Web applications. It is cost effective compared to many other solutions. It can be implemented in a very short time without any coding changes to the web application.

Improve this answer
-1

Might I recommend LaunchKey as they provide true multi-factor authentication as a service and their API and mobile apps are all free. It should also be noted that multi-factor authentication combines all 3 possible auth factor types (knowledge, possession, inherence) and is considered more secure than two-factor which would only utilize 2 of the 3. From a security perspective, you should be pursuing MFA rather than 2FA.

Improve this answer
1
  • 4
    Hello inf0sec. When you're affiliated with a product you're recommending, according to our rules, you must disclose your affiliation in the body of your post, or you risk having them flagged as spam. More here: security.stackexchange.com/help/behavior
    – Xander
    Jan 15, 2014 at 21:23

Not the answer you're looking for? Browse other questions tagged .