apidays London 2023 - Building Multi-Factor Authentication into your applications, Nathaniel Okenwa, Twilio

apidays London 2023 - APIs for Smarter Platforms and Business Processes
September 13 & 14, 2023

Building Multi-Factor Authentication into your applications
Nathaniel Okenwa, Staff Developer Evangelist at Twilio

------

Check out our conferences at https://www.apidays.global/

Do you want to sponsor or talk at one of our conferences?
https://apidays.typeform.com/to/ILJeAaV8

Learn more on APIscene, the global media made by the community for the community:
https://www.apiscene.io

Explore the API ecosystem with the API Landscape:
https://apilandscape.apiscene.io/

Transcript

1. Building Multi-Factor Authentication into your applications Nathaniel Okenwa, Developer Evangelist
2. 422 Unprocessable Entity: Suspicious Phone Number! Nathaniel Okenwa, Developer Evangelist
3. Nathaniel Okenwa Developer Evangelist @ Twilio @ChatterboxCoder Loves: Coding 󰞵/ MMA 🥊 / Anime 🀄 / Superheroes󰭅󰭄 / Action Movies 🎬
4. Blade Runner 1982 A blade runner must pursue and terminate four replicants who stole a ship in space and have returned to Earth to find their creator.
5. Blade Runner
6. 422 Unprocessable Entity: Suspicious Phone Number! Spotting Suspicious Entities on 2FA
7. Untrustworthy Users Fake/Spam Users Hackers or Bot
8. Voight-Kampff test
9. Identifying Real Users
11. User Verification Along Your Customer Journey Verify users at sign up Protect logins Authorize Transactions
12. Sending Your Own OTP Can Be Difficult Additional dev requirements Security Gaps Costly in some countries Regulations
13. SMS Pumping This happens when fraudsters request OTPs over and over, in order to generate SMS traffic for which they are incentivised by small local carriers.
14. SMS Pumping Fraudster Mobile Network Operator
15. SMS Pumping Fraudster Mobile Network Operator Revenue Share
16. SMS Pumping Fraudster Many Verifications Mobile Network Operator Revenue Share
17. Can Cost $$$$$$$$$$...
18. Fraud Indicators Conversion behaviour Monitor OTP Conversion Rates Detect Non-Human Behaviour Traffic Spikes Spike in Account Activity Country-Specific Spikes Number Prefix (Bulk) Unexpected Destinations Carrier Ranking Maintain Telco Fraud Rank
19. Alternative Channels WhatsApp Email Already have Phone Number Works over WiFi SMS Pumping doesn’t work Strong User Adoption
20. Demo
21. OTP/TOTP • Works offline • Private & Secure • Bring your own App
22. Silent Network Auth • Relies on secure carrier network technology • Not vulnerable to common OTP Phishing/Hijacking • Silent & fast! No end-user friction ✅ 15% increase in conversion ✅ ZERO reported Account Takeover incidents ✅ Keep user’s attention on your app ✅ Save 30 seconds or more during registration and logins
23. Why don’t we just use Authenticator Apps?
27. Usability is Imperative When security introduces too much friction. Users are more likely to skip or ‘turn off’ these security features.
29. Balancing Act
30. Bank Security Model (Not Trademarked)
32. Bank Tellers ▢ High Frequency Low Risk Activities ▢ Get users verified quickly
33. Vault ▢ Higher Risk Activities ▢ Prioritise most secure form of Authentication
34. ▢ Highest Risk ▢ Requires User Education Safety Deposit Boxes
35. Github
37. One solution for all channels “Silent authentication” / biometric authentication Verify Verification request Has the request come from browser or mobile? Verification request from Mobile App (Best Case) Verification request from browser, user received a push notification on app with verification code Verification request from browser, if push notifications aren’t enabled, TOTP is used Verification request from browser, but user doesn’t have app installed. User receives the code via SMS, WhatsApp, Email or Phone Call
38. Demo
39. A complete verification solution SMS Email Voice WhatsApp Silent Network Auth Push Authentication TOTP Future Channels WebAuthn (FIDO2) Device Authentication User Registrations & Logins Logins & Transaction Authorization Pre-approved templates Automatic SMS fraud detection Rate limiting Phone numbers, short codes, Alpha ID Route optimization, redundancy, failover Localization & translation Monitoring & reports Global customer support Security & Business Logic
40. Where to find out More…
41. THANK YOU FOR LISTENING!! Do you have any questions? nokenwa@twilio.com @ChatterboxCoder CREDITS: This presentation template was created by Slidesgo, including icons by Flaticon and infographics & images by Freepik