Auth on the web: better authentication
- 1. Auth on the web: Better Authentication Kelley Robinson Account Security Developer Evangelist | Twilio
- 8. Auth on the web: Better Authentication Kelley Robinson Account Security Developer Evangelist | Twilio
- 9. 🐦 @KelleyRobinson 📍 Brooklyn, NY 🔐 Account Security @ Twilio 🥪 Home cook & sandwich enthusiast
- 10. 👀 Biometric authentication 🌐 Background signals 📱 Devices as keys 💡 Recommendations AGENDA
- 11. It is mainly time, and not money, that users risk losing when attacked. It is also time that security advice asks of them. ” Cormac Herley, The Rational Rejection of Security Advice by Users (2009) ”
- 12. © 2019 TWILIO INC. ALL RIGHTS RESERVED. What is friction in account security? • Additional time or steps taken by the end user to prove their identity. • Decreases fraud and spam; helps ensure real users.
- 13. © 2019 TWILIO INC. ALL RIGHTS RESERVED. What is frictionless authentication? • Controls shifted from the end user to the application technology. • Requires less (or no) time or action from the end user.
- 15. © 2019 TWILIO INC. ALL RIGHTS RESERVED. 👀 Biometric authentication Something you are or do; an inherence factor
- 16. Examples CHARACTERISTICS iPhone Touch ID or Android face unlock VOICE RECOGNITION More often used in call centers KEYSTROKE DYNAMICS Behavior based analysis
- 17. 😃 Pros • Everyone has access to what they are • Can't lose the factor* • Less concern for account recovery 🤔 Cons • Often per-device • Elevated risk of underlying data being targeted if using cloud storage • User privacy concerns • Documented bias in voice recognition models BIOMETRICS
- 21. © 2019 TWILIO INC. ALL RIGHTS RESERVED. 👀 Biometric authentication Incredibly useful, as long as we build applications to use it responsibly
- 23. © 2019 TWILIO INC. ALL RIGHTS RESERVED. Contextual data, often provided by the end user's platform or device 🌐 Background signals
- 24. Examples GEOLOCATION Used for authorization and more. HEADER ENRICHMENT AKA silent authentication sends device details like IMSI HISTORICAL BEHAVIOR Purchase history or usage patterns
- 25. BACKGROUND CHECKS 😃 Pros • Outliers are apparent with robust data • Basic checks are easy to implement 🤔 Cons • Outliers can be legitimate use cases • More complex analysis requires more data engineering • Privacy and regulatory concerns
- 26. © 2019 TWILIO INC. ALL RIGHTS RESERVED. 🌐 Background signals A useful signal for step up authentication but not always a complete solution
- 27. 📱 DEVICES AS KEYS
- 28. © 2019 TWILIO INC. ALL RIGHTS RESERVED. 📱 Devices as keys Uses public key cryptography to turn your phone into a secure key
- 29. Examples WEBAUTHN Open standard for web authentication. Uses browser APIs (~90% supported). PUSH AUTHENTICATION Approve/deny framework similar to WebAuthn but built into a mobile or web application.
- 30. DEVICES AS KEYS 🤔 Cons • Per-device • Account recovery is challenging • Device support is not ubiquitous 😃 Pros • Can be a password replacement • Phishing & spoofing proof • Already using devices like our phones and computers every day
- 31. Limited authenticator availability for WebAuthn • Roaming authenticators are expensive • Platform authenticators are not ubiquitous
- 32. © 2019 TWILIO INC. ALL RIGHTS RESERVED. 📱 Devices as keys Excellent for heavy mobile usage companies. Will be more common as more devices become platform authenticators.
- 34. Limit the data you need to store RECOMMENDATIONS
- 35. Use contextual data and behavior biometrics as background signals to trigger step up authentication RECOMMENDATIONS
- 36. Offer device authentication for users that can support it RECOMMENDATIONS
- 37. Embrace fallback options in case of lost devices or biometric glitches RECOMMENDATIONS
- 38. © 2019 TWILIO INC. ALL RIGHTS RESERVED. Open discussion • What do you do to decrease friction in your high risk transactions? • What tools do you wish existed for better authentication?
- 40. © 2019 TWILIO INC. ALL RIGHTS RESERVED. References • A usability study of five two-factor authentication methods • A Tale of Two Studies: The Best and Worst of YubiKey Usability • Google security exec: 'Passwords are dead' • Frictionless mobile authentication coming to the UK • A simpler and safer future — without passwords • The Rational Rejection of Security Advice by Users (2009) • Remote testing monitored by AI is failing the students forced to undergo it • There Is a Racial Divide in Speech-Recognition Systems, Researchers Say (Published 2020) • Yubikey 5 Series • https://caniuse.com/?search=webauthn • https://twitter.com/mholt6/status/1033809745755365376 • https://twitter.com/jessitron/status/1425255150998937604 • https://twitter.com/kelleyrobinson/status/ 1369385723615404033 • https://twil.io/webauthn • Photos: Unsplash