Nesh Popovic

As a Developer and Solutions Engineer for the past 20+ years, I've been involved in developing and selling secure and robust software solutions. When not helping my sales team deal with the complexities of software platforms, you can usually find me playing pickleball, basketball or backgammon.

Principal Solutions Engineer - CIAM

Learn how to set up an Amazon API Gateway and secure the REST API with Okta Customer Identity Cloud (CIC) Adaptive MFA Risk Score

Protecting REST APIs Behind Amazon API Gateway Using Okta

I stream, blog, and make youtube videos about tech stuff. I love coding, I love AI, and I love building stuff!

Staff Developer Advocate

Juan Cruz Martinez

Learn how to leverage Auth0 Actions to create custom MFA (Multi-Factor Authentication) workflows, enforce enrollment of users based on specific conditions, and validate user authentication.

Multi-factor authentication (MFA) is an essential security measure that helps to protect your organization's data and assets. By requiring users to provide an additional authentication factor, such as a security token or fingerprint, in addition to their username and password, MFA can significantly reduce the risk of unauthorized access.

However, implementing MFA can sometimes create friction in the user experience, potentially leading to frustration and reduced productivity. Additionally, not all users or scenarios may require the same level of security, making a one-size-fits-all MFA approach impractical.

Auth0 Actions is a powerful feature that allows you to customize and extend the functionality of Auth0. With Actions, you can create custom workflows that trigger in response to specific events, such as user login or registration. This enables you to tailor your MFA implementation to meet your organization's specific needs.

For example, you can use Actions to:

- **Enforce MFA based on user roles or permissions**: You can require certain users, such as administrators or those with access to sensitive data, to use MFA while allowing others to bypass it.
- **Implement risk-based authentication**: You can use Actions to assess the risk level of a login attempt based on factors such as the user's location, device, and IP address. If the risk is high, you can then require the user to provide an additional factor of authentication.

## Prepare your Tenant

Before diving into customizing your Multi-Factor Authentication (MFA) flows, let's make sure we have the essentials in place. This quick guide will walk you through the initial setup steps:

- **Activate MFA**: Head over to your Auth0 Dashboard (<a href="https://a0.to/blog_signup" data-amp-replace="CLIENT_ID"  data-amp-addparams="anonId=CLIENT_ID(cid-scope-cookie-fallback-name)">Get a free account</a> if you don't already have one) and navigate to [Security > Multi-factor Auth](https://manage.auth0.com/#/security/mfa). Here, you'll be able to activate MFA for your tenant.

- **Choose Your Factors**: [MFA comes in various forms](https://auth0.com/blog/not-all-mfa-is-created-equal/). Decide which factors suit your security needs and enable them on the same Multi-factor Auth page. You might choose options like push notifications, SMS codes, or even biometrics.
    ![Auth0 Dashboard > Security > Multi-factor Auth](https://images.ctfassets.net/23aumh6u8s0i/5NSKKAcGSjkj40ZkTmUlDD/3165f217e14e7a85b9f0304695fdf9d5/MFA_Auth.png)

- **Enable Customization**: To personalize your MFA flows, toggle on the "Customize MFA Factors using Actions" setting. This is like unlocking a secret level – it opens the door to fully customized experiences for your users.
    ![Auth0 Dashboard > Security > Multi-factor Auth > Additional Settings](https://images.ctfassets.net/cdy7uua7fh8z/2hv0ELTkkka3t230SXfxw/46def5395652b2451cfc9e0ad01a371a/MFA_actions.png)

> Actions with `enrollWith` or `enrollWithAny` commands override any existing policies or rules that enable or disable MFA in a tenant.

## Understand the APIs

Once you've enabled Multi-Factor Authentication (MFA) in your Auth0 tenant, you can go beyond the basic settings and create truly customized enrollment flows using Auth0 Actions. Actions are snippets of code that run at specific points in the user's authentication journey, giving you granular control over your authentication workflow and, in particular, how MFA is presented.

To customize your MFA experiences, Auth0 Actions provides a set of APIs designed for enrollment and requiring authentication challenges. Here's a breakdown of the four key APIs you can use: 

### `enrollWith(factor, options)`

Initiates MFA enrollment for a specific factor (e.g., `otp`, `push-notification`, `webauthn-roaming`, etc. Visit the docs to learn about [all supported values](https://auth0.com/docs/customize/actions/flows-and-triggers/login-flow/api-object#:~:text=api.authentication.enrollWith(factor%2C%20options)).

Example:

```javascript
api.authentication.enrollWith({type: 'otp'})
```

### `enrollWithAny(factors)`

Similar to `enrollWith` but prompts the user to select an MFA factor to enroll in from the supplied list.

Example:

```javascript
api.authentication.enrollWithAny([{type: 'otp'}, {type: 'webauthn-roaming'}])
```

### `challengeWith(factor, options)`

Challenge the user with one or more specified multifactor authentication factors. This method presents the default challenge first, then allows the user to select a different option if additional factors have been supplied. If the user has not enrolled in any of the factors supplied (including both the default and any additional factors), the command fails.

Example:

```javascript
api.authentication.challengeWith({type: 'otp'})
```

### `challengeWithAny(factors)`

Trigger a MFA challenge and allow the user to select their preferred factor from the supplied list.

Example:

```javascript
api.authentication.challengeWithAny([{type: 'otp'}, {type: 'webauthn-roaming'}])
```

## Create a New Auth0 Action

To begin, let's create a new [Auth0 Action](https://auth0.com/docs/customize/actions/actions-overview). Actions are serverless functions that run in a secure Auth0 environment.

To create an Action, log into your [Auth0 Dashboard](https://manage.auth0.com/#/actions/flows), select Actions from the left sidebar menu, then select Flows. This page shows the different flows you can customize. For our use case, we’ll choose the “Login” flow.

![The “Actions” page of the Auth0 dashboard.](https://images.ctfassets.net/23aumh6u8s0i/3Es0FEV0EEyNeKgN6LXEeM/67763781d697663da79113ba381e8610/actions_flows.png)

This will take you to the “Login” flow page, where you can install, create, and add Actions to the flow.

![The “Login” flow page of the Auth0 dashboard.](https://images.ctfassets.net/23aumh6u8s0i/5dveq8h22H0Nje8Rub6sa9/7071335d4db1571af98440e527f1b999/actions_login_flow.png)

The screen has two main sections: the diagram in the center of the page shows the login flow and the Actions panel.

On the diagram, we can see the default login flow, which contains two states.

- **Start:** The user completed the login form and is ready to log in.
- **Complete:** The system issues the user’s credentials (an ID token and, if required, an access token).

You can drag and drop Actions in between these states to add custom logic to the login flow or deny the login request before the tokens are issued.

On the right panel, we have the Actions panel with two tabs.

- **Installed**: Pre-installed Actions from the [Auth0 Actions Marketplace](https://marketplace.auth0.com/features/actions)
- **Custom:** Actions created for this tenant

To create an Action, click the plus icon on the Actions panel and select "Build from scratch".

![Create a custom Action using the Actions panel](https://images.ctfassets.net/23aumh6u8s0i/3TABItaKOdq9dpsUIdQIpx/47d5010f5642123942ba3b7afd710300/actions_login_flow_create_menu.png)

After that, a modal window will appear to enter the information for our Action: you’ll have to provide a name, and you can leave the trigger and runtime as the default values. For my Action, I’ll name it “Require webauthn MFA for admins”.

![Enter the Action name and click create](https://images.ctfassets.net/23aumh6u8s0i/H6zvDcXGyg2a773gW790H/07ce6e74ee07f115d0e58d6e3863642f/actions_login_flow_create_dialog.png)

After clicking on "Create", you’ll be taken to the Action’s code editor, where you can write the code for your Action, install packages, test it, and more:

![Auth0 Actions code editor page](https://images.ctfassets.net/23aumh6u8s0i/6OzG8Oe3XU8lFnzLIr5Ver/4644c79782edaa0d279d4cf2112ae32c/actions_editor.png)

An Action can make use of two JavaScript functions to alter the Login flow:

- `onExecutePostLogin`: defines what should happen immediately after the user provides login credentials that Auth0 verified. This method receives two parameters, `event` and `api`.
    - `event`: contains details about the login request, such as the user and the context.
    - `api`: contains methods to manipulate the login’s behavior.
- `onContinuePostLogin`: defines what should happen when control returns to the Login Action after a redirect to another web page. It’s used only when the user returns after being redirected, which is why it’s commented out by default.

For this tutorial, we’ll focus on the `onExecutePostLogin` method.

## Writing the Actions Code

Next, we'll write the Action's code that will require users under the Admin's group to use `webauthn` as an additional authentication step. If the user isn't already enrolled with `webauthn`, the first time they login they will be prompted to do so.

The action will make use of the APIs `challengeWith` and `enrollWith`, in addition to using the user's property `enrolledFactors` to determine if the user has an MFA factor enrolled already.

Here's the actual code:

```javascript
exports.onExecutePostLogin = async (event, api) => {
    // Check if the user is an admin, enforce webauthn
    if (event.authorization?.roles?.includes('Admin')) {
        // Check if the user is already enrolled with webauthn
        if (event.user.enrolledFactors && event.user.enrolledFactors.some(m => m.type === 'webauthn-roaming')) {
            api.authentication.challengeWith({type: 'webauthn-roaming'})
        } else {
            api.authentication.enrollWith({type: 'webauthn-roaming'})
        }
    }
};
```

## Attach an Auth0 Action to the Login Flow

After coding and testing your Actions, it’s time to deploy and use them as part of the login flow. Once you are ok with your testing results, you can hit the `Deploy` button on the top right corner of the screen. This will take the existing code and settings and generate a function snapshot you can use in your login flow.

If you ever need to change the code on the function, all changes will automatically be saved as a new draft, and if you want the changes to become effective, you’ll have to deploy your latest version once again.

Once your code is deployed, it doesn’t mean it is actively used as part of your login flow. To check for that, please refer back to the [login flow screen](https://manage.auth0.com/#/actions/flows/login/), where the login diagram is shown. If you don’t see your Action as part of the diagram, it means that, even if your Action is deployed, it has not yet been activated. To activate the Action as part of the flow, click on the “Custom” tab on the Actions panel, locate your Action by name, and simply drag and drop the box over the login diagram between the "Start" and "Complete" steps. After that, you can apply changes using the “Apply” button on the top right corner of the screen.

![Apply an Auth0 Action to the Login Flow](https://images.ctfassets.net/23aumh6u8s0i/5IKiEeHy8WharqTOjJnSLh/eb5025dfd22de94c2446ccc22f1b524d/actions_attach_to_flow.gif)

## Test Your New Authentication Flow

Now, you can try your new Action by logging into your Auth0-powered application using both admin and non-admin accounts. When you log using any method (e.g. username/password, or social login) with a non-admin user, you'll get direct access to your application or continue with the authentication flow as you have it specified for your tenant.

When you log in using an admin user (a member of the group "Admin", as we defined it on the Action), you'll be prompted to either register or validate your account with webauthn. The screen may look something like this:

![Auth0 MFA Validation Step](https://images.ctfassets.net/23aumh6u8s0i/7duWHgEkhhz2e7rLgLJV1X/d174ce044c7a8011f660cd83be1cc815/mfa_validate.png)

## Conclusion

Auth0 Actions provides a versatile and powerful toolkit to revolutionize your organization's MFA implementation. By harnessing the flexibility of Actions, you can create personalized, risk-based, and context-aware MFA workflows that enhance security without compromising user experience.

The ability to tailor MFA requirements based on user roles, risk assessments, and specific applications empowers you to implement a layered security approach. This means that you can enforce stricter MFA for high-risk scenarios, such as administrative access or sensitive data handling while offering a streamlined experience for regular users.

As you explore the possibilities of Auth0 Actions, remember that Customization is key. By experimenting with different workflows and conditions, you can fine-tune your MFA implementation to perfectly align with your organization's unique security requirements and user expectations.

Thanks for reading!

Using Actions to Customize Your MFA Factors

carla_urrea

I've been working as a software engineer since 2014, particularly as a backend engineer and doing system design. I consider myself a language-agnostic developer but if I had to choose, I like to work with Ruby, Python, and Elixir.  

After realizing how fun it was to create content and share experiences with the developer community I made the switch to Developer Advocacy. I like to learn and work with new technologies. 

When I'm not coding or creating content you could probably find me going on a bike ride, hiking, or just hanging out with my dog, Dasha. 

Senior Developer Advocate

Carla Urrea Stabile

andrea-chiarelli

I have over 20 years of experience as a software engineer and technical author. Throughout my career, I've used several programming languages and technologies for the projects I was involved in, ranging from C# to JavaScript, ASP.NET to Node.js, Angular to React, SOAP to REST APIs, etc.

In the last few years, I've been focusing on simplifying the developer experience with Identity and related topics, especially in the .NET ecosystem.

Principal Developer Advocate

Andrea Chiarelli

Learn about the different MFA options and how weak or strong they are in comparison.

Using [Multi-Factor Authentication (MFA)](https://auth0.com/docs/secure/multi-factor-authentication) to secure your accounts is something you should always do. MFA adds a layer of security during login that requires users to provide more than one credential to prove their digital identity. 

[Why is it so important?](https://auth0.com/docs/secure/multi-factor-authentication#why-use-multi-factor-authentication-) Well, it's not so unlikely for attackers to steal usernames and passwords or programmatically attack user accounts. Having additional steps to prove your identity can nullify the effectiveness of these violations.

However, not all MFA options provide the same level of security assurance. So, let's review them and understand why some are stronger than others.


## Factors, Authenticators, and Assurance

[**Okta's Businesses at Work Report 2023**](https://www.okta.com/blog/2023/02/businesses-at-work-2023/) shows that *more organizations realize that not all multi-factor authentication (MFA) is created equal*.

> Low-assurance security questions are experiencing the slowest growth across the board, while high-assurance security keys and biometrics (including WebAuthn) are growing more quickly

&mdash; <cite>Todd McKinnon on the [Businesses at Work Report post](https://www.okta.com/blog/2023/02/businesses-at-work-2023/)</cite>

**But what does low-assurance or high-assurance mean?** 

To understand how strong or weak an MFA option is, we need to explore a few related concepts: authenticators, authentication factors, and authenticator assurance level.

### Authenticators

An [**authenticator**](https://pages.nist.gov/800-63-3/sp800-63-3.html#def-and-acr) is something that can confirm the user identity. It can be a shared secret, such as a security question or a password, but it can also be a device or something the user needs to demonstrate to possess or control.

Based on the specific authenticator, there are _methods_ to demonstrate the possession or control of the authenticator. For example, sending a code via SMS is a method used to prove a user possesses a device. Another method could be an authenticator app like Google Authenticator or a Security Key.

### Authentication factors

In the authentication process, there are many options you can use to prove your digital identity. These are called [**authentication factors**](https://auth0.com/docs/secure/multi-factor-authentication/multi-factor-authentication-factors) and there are three main types:

  - **Knowledge**: Something you know, like a password or the answer to a security question. 
    - Users are familiar with authenticating with a password or answering a security question and are easy to use. Still, this information is usually easy to lose or guess, making it vulnerable to data breaches, social engineering, and phishing. 
  - **Possession**: Something you own, like a device or other physical tokens. 
    - The device stores or receives the user information, making it more secure than knowledge-based factors. Users are familiar with, for example, [SMS authentication](https://www.okta.com/blog/2020/10/sms-authentication/), where they receive an MFA code or [one-time password (OTP)](https://www.okta.com/blog/2020/06/what-is-a-one-time-password-otp/) to their phone. At the same time, devices can be lost or stolen, making them vulnerable to person-in-the-middle and phishing attacks.
  - **Biometrics/Inherence**: Something you are or is inherent to you, like a fingerprint.
    - Biometrics are unique for each user; they don't have to remember or store their fingerprints or face. These factors are phishing-resistant and offer a seamless end-user experience but have yet to be widely adopted.

Every authenticator has one or more authentication factors.

### Authenticator Assurance Level (AAL)

[**Assurance**](https://support.okta.com/help/s/article/How-authenticators-and-assurance-levels-are-described?language=en_US) refers to the degree of confidence that an end user signing in to an application is the same end user who previously signed in to the application.

The **[Authenticator Assurance Level (AAL)](https://pages.nist.gov/800-63-3-Implementation-Resources/63B/AAL/)** is measured based on the use of one or more authenticators and the characteristics of their methods, as we will see in a moment.


## What Makes an Authenticator Stronger than Another?

Now that you know the concept of assurance, factors, and authenticators, how can they help you understand when an authenticator is stronger? We said that the **level of assurance** is based on the authenticators and the characteristics of their methods. To measure this level of assurance, we need to answer the following question: "How confident am I that the user is who they say they are?"

### Authenticators and assurance level

For example, a password provides some confidence in the user's identity. Only the user should know this password. But passwords can be stolen and used by other users. If I can get the user's fingerprint, I have more confidence in their identity: stealing their fingerprint is way more complicated than stealing their password. In other words, the user's fingerprint provides a higher level of assurance than a password.

There are intermediate levels of assurance between a password and a fingerprint. For example, proving that a user possesses a device provides a higher level of assurance than a password but lower than a fingerprint. While a password can be stolen and used by an attacker without the user realizing it, a device is less likely to be stolen, and if it happens, the user is usually aware of the theft in a short time.

The following diagram shows the different factor types and assurance levels for some of the most common authenticators:  

<br/><br/>
![Authenticators by Assurance Level and Factor](https://images.ctfassets.net/23aumh6u8s0i/6lndb4OGHrhpfUnkeB9C4b/ed1e79f85cc48bad42ee8a5e6e47c3a9/MFA_factors_by_assurance__1_.jpg)
<br/><br/>

Depending on the authenticator method, you can be more or less confident about the user's identity. As you see in the diagram, security questions and passwords have low assurance because it is easier for the user to forget them and for attackers to guess when users use weak answers or passwords. On the other hand, FIDO2/WebAuthn credentials and biometrics have the highest assurance level because they rely on cryptographic algorithms and inherent characteristics that are hard to break.

### MFA and assurance level

Authenticator assurance levels are not intended to measure the level of assurance of individual authenticators. They measure [the level of assurance of the authenticated session](https://pages.nist.gov/800-63-3-Implementation-Resources/63B/AAL/). Therefore, if you use one authenticator to authenticate your user, the AAL of that authenticated session will match the AAL of the authenticator used. However, by combining authenticators, you can achieve a higher AAL for a session than you could with individual authenticators. That's where MFA comes in.

Also, using **authenticators with different factor types** is strongly recommended to make MFA effective. For example, by combining password and SMS authentication, you get an authenticated session with a higher assurance level than just the password. In this case, you combine a knowledge factor authenticator (the password) with a possession factor authenticator (the phone) through the SMS method.

If you use a combination of password and security key as your MFA, the assurance level of the authenticated session is stronger than the password and SMS combination. Indeed, the assurance level of the security key is higher than the SMS authentication.

## Low-Assurance Authenticators

Following the [NIST's Digital Identity Guidelines](https://pages.nist.gov/800-63-3-Implementation-Resources/), low-assurance authenticators provide some confidence that the user controls an authenticator that confirms their identity. These authenticators **permit single-factor authentication**, provide baseline security at low cost, and most users are familiar with the authenticating process. Some of these authenticators are:  

- Passwords 
- Security Questions
- SMS, Voice, and Email One-Time Password (OTP)
- One-Time Password (OTP) Apps

In addition to single-factor authentication, this level of assurance allows multi-factor authentication based on the proof that the user possesses and controls an additional authenticator. However, no mandatory cryptography is required at this level, so you can find MFA options based on the combination of password and email or password and SMS, for example.

Most of the authenticators falling in this assurance level are low-cost, and users are familiar with them. However, their vulnerability ranges from being easy to guess or discover to being exposed to social engineering and phishing.

![MFA factors](https://images.ctfassets.net/23aumh6u8s0i/4EmRhsgk2yQw5l21Xqwbr7/a99be0023a811661bb7e7e02784d0b53/Debunking_Misconceptions_About_Passwordless_Separator_V02_3x.jpg)


## Mid-Assurance Authenticators

This level of assurance offers a higher level of confidence of the user's identity. It **requires using two authentication factors**, which are either a physical authenticator and a memorized secret or a physical authenticator and a biometric associated with it. Some of these authenticators are:

- Push Notifications
- Physical token One-Time Password (OTP)

MFA can be performed using either a multi-factor authenticator or through the use of two independent authenticators. Multi-factor authenticators use an additional factor, either something you know or have, to unlock a secret stored in the (physical) authenticator.


## High-Assurance Authenticators

Authenticators with a high level of assurance introduce a new requirement beyond the mid-level assurance: using **multiple authentication factors** with a hardware-based authenticator. Some authenticators with a high level of assurance are:

- FIDO2/WebAuthn with security keys or biometrics

[FIDO2](https://www.yubico.com/authentication-standards/fido2/) is an open authentication standard hosted by the FIDO Alliance that consists of the W3C Web Authentication specification (WebAuthn API), and the [Client to Authentication Protocol (CTAP2)](https://www.yubico.com/resources/glossary/ctap/).

[WebAuthn](https://webauthn.me/introduction) is a W3C recommendation for defining an API enabling the creation and use of strong, attested, scoped, public key-based credentials by web applications for strongly authenticating users.

Using FIDO2/WebAuthn credentials guarantees users a phishing-resistant and seamless end-user experience. The use of higher-assurance security keys and biometrics ticked up to 24% in 2022, up from 21% a year ago, according to the [2023 Businesses at Work Report](https://www.okta.com/blog/2023/02/businesses-at-work-2023/) so even though it is not widely adopted yet, using high-assurance MFA is growing rapidly. 

![Passwordless Biometric](https://images.ctfassets.net/23aumh6u8s0i/50DnWYiAPCa18mVZOfrOBP/c29ceb90bd492ae124f89ff23ca1f237/Debunking_Misconceptions_About_Passwordless_Separator_V01_3x.jpg)

<include src="SignupCTA" text="Sign up to try out Auth0 for free." linkText="Get started →" />


## Conclusion 

In this post, you learned about Multi-Factor Authentication and the different types of authenticators, assurance levels, and existing factors. 

Depending on your authenticator method, you can be more or less confident about the user's identity. When you combine authenticators, you can achieve a higher level of assurance that the user is who they say they are than when you use individual authenticators. Therefore it's recommended that you use authenticators with different factor types.

If you want to learn more about MFA, factors, and authenticator assurance levels, you can download the [Factor Types and Authenticator Assurance Levels datasheet](https://www.okta.com/resources/datasheet-factor-assurance/) or download the entire [2023 Businesses at Work Report](https://www.okta.com/blog/2023/02/businesses-at-work-2023/). 

Not All MFA Is Created Equal

Robert Panasiuk 

Deduce CTO Robert Panasiuk has worked on the front lines of the fight against fraud for nearly a decade. He's helped deliver risk, fraud, and security solutions for clients across retail, travel, banking, and payments, including Mastercard and large online retailers. As a technology leader, Panasiuk balances a passion for revenue with a commitment to helping organizations succeed, grow, and solve challenges even in the most fast-paced environments.

Deduce's CTO

Robert Panasiuk

Deduce Intelligent MFA reduces false positive MFA challenges

Despite its overall effectiveness, multi-factor authentication (MFA) can sometimes feel like [“More Frustrating Authentication”](https://www.deduce.com/why-mfa-translates-to-more-frustrating-authentication/).

Many MFA solutions trigger far too many false positives and burden legitimate users with circuitous verification processes. This often leads to churn and potentially a costly hit to the company's reputation.

[A recent CMO Council report](https://cmocouncil.org/thought-leadership/reports/authentication-frustration) validated this point, indicating that 81% of users preferred companies that enabled easy and secure account verification, with more than 60% have canceled a transaction due to an inefficient authentication process.

To mitigate the friction caused by false positives, [Deduce](https://www.deduce.com/) launched its Intelligent MFA. After garnering praise from Fast Company as [the most innovative security solution of 2022](https://www.deduce.com/fast-company-names-deduce-the-most-innovative-security-solution-of-2022/), Deduce’s Intelligent MFA is now available on the [Auth0 Marketplace](https://marketplace.auth0.com/integrations/deduce-intelligent-mfa), delivering increased security and real-time identity insights to deliver a better user experience to a large swath of customers.

## A Smooth User Experience

Using augmented risk models with 75 risk and trust signals that curtail false positive challenges by more than 50%, Deduce helps customers ensure that real account takeover (ATO) threats—not legitimate users—are flagged.

Powering these risk signals is the Deduce Identity Network: a real-time identity graph for online fraud in the US. With over [500 million anonymized user profiles and upwards of 1.4 billion daily activities at its disposal](https://www.deduce.com/resource/idv-solution-brief/), the Deduce Identity Network and its Intelligent MFA application provide a critical layer of identity fraud defense to your Auth0 Identity Platform.

![A Smooth User Experience](https://images.ctfassets.net/23aumh6u8s0i/5xWnzpfcpngSdaYGqM6mGE/5afd01ce0ba9b66c2a95d860e976502e/Uploaded_from_Deduce_Hits_the_Auth0_Marketplace)

Deduce’s Intelligent MFA accounts for the following risk signals, sourcing real-time data to enable a smooth user experience:

* **New IP Found:** Is this IP new to this identity?
* **New Device Found:** Is this a new device for this identity?
* **Suspicious Activity—Time of Day:** Is this time of day not normal or suspicious for this identity?
* **Impossible Travel Detected:** Would it be impossible for a user to travel to a new location from the last known location in the given timeframe?
* **IP / Account Cycling Detected:** Has this IP frequently cycled over many different accounts?
* **Malicious IP Detected:** What malicious activity was observed for this IP across our network?
* **Network Proxy:** Is this identity using a malicious proxy?
* **Network Hosting:** Is this identity using a hosted network?

[Deduce’s](https://www.deduce.com/) Intelligent MFA allows Auth0 Identity Platform customers to benefit from the collective intelligence of the Deduce Identity Network. The eight most significant risk signals listed above increase ATO fraud capture at authentication for returning customers.

Considering [one in three consumers](https://www.pwc.com/us/en/advisory-services/publications/consumer-intelligence-series/pwc-consumer-intelligence-series-customer-experience.pdf) abandons a brand after a negative user experience, these risk signals play a crucial role in mitigating false positives and the resultant friction. Deduce’s Intelligent MFA unclutters the user experience via real-time insights that identify legitimate customers who otherwise might have been flagged for logging in at an unfamiliar location or on a new device.

## Easy Setup

With a no-code integration, Auth0 customers can deploy the Deduce Intelligent MFA solution without building custom code. Simple drag and drop tools enable users to add Deduce to any Auth0 workflow and choose the appropriate risk signals for their needs.

[Check out our solution brief](https://www.deduce.com/resource/deduce-intelligent-mfa-for-auth0/) to see how integrating Intelligent MFA into Auth0 can help you reduce friction, improve conversions, combat fraud, and keep customers happy. Additionally, [this guide](https://marketplace.auth0.com/integrations/deduce-intelligent-mfa) walks Auth0 users through the Intelligent MFA activation process.

The video below shows just how easy it is to set up.

<NonAmpContent>
<div style="padding:65.4% 0 0 0;position:relative;"><iframe src="https://player.vimeo.com/video/679349956?h=5b9b416be9" style="position:absolute;top:0;left:0;width:100%;height:100%;" frameborder="0" allow="autoplay; fullscreen; picture-in-picture" allowfullscreen></iframe></div><script src="https://player.vimeo.com/api/player.js"></script><br>
</NonAmpContent>

As for prerequisites, there aren’t many: an Auth0 account and tenant (sign up for free [here](https://auth0.com/signup)); an API Key and a Site ID (reach out to [support@deduce.com](mailto:support@deduce.com)); and a tenant with [MFA enabled](https://auth0.com/docs/secure/multi-factor-authentication/enable-mfa).

To learn more about our partnership with Auth0, read [the official press release](https://www.prweb.com/releases/2022/3/prweb18555208.htm).

Deduce Hits the Auth0 Marketplace

Mikhael Chammaa

As the Marketing Lead at Haventec, Mikhael is responsible for communicating the value of passwordless authentication to developers and product managers worldwide. Based in Australia, Mikhael is focused on the technology sector and has led the marketing function at several cybersecurity organizations.

Marketing Director at Haventec

As cyberattacks become more sophisticated and demand for seamless user experiences grows, developers and technology leaders must evaluate whether the traditional password approach is going to fit in a modern digital era.

Offering your customers single-step passwordless multi-factor authentication (MFA) can reduce the risk of credential theft.

Haventec Authenticate, a winner of cybersecurity awards at the Australian Technologies Competition and InnovationAus, enables you to:

* Decentralize identity 
* Remove passwords from your environment
* Leverage advanced cryptography to validate users
* Seamlessly onboard existing users to single-step passwordless MFA 

![Haventec Authenticate](https://images.ctfassets.net/23aumh6u8s0i/1yGSn7oCqMLJCPAkglA1ab/b53b65ab2eec2dd9f38f14fbdbfb6b01/haventec_image.png)

For application owners and developers, this eliminates unsecured usernames and passwords and the need to store them. The platform makes it easy to transition existing users to an improved authentication experience without disruption while empowering them with a seamless and consistent digital experience across all devices.   

---

## How Haventec Authenticate Works

Haventec Authenticate provides a genuinely passwordless technology that eliminates passwords and shared secrets. This significantly reduces risk while providing customers with a seamless and secure passwordless MFA experience. All they need is a simple PIN or Biometric factor to authenticate.

A PIN is a secret between a user and their device, so an application does not need to hold or protect it. In fact, the PIN is not stored anywhere and is known only to the user.

Haventec Authenticate breaks access to the user's identity into multiple parts, separated into multiple locations. Two sets of keys (public and private) are changed and re-encrypted for every Haventec Authenticate transaction, and the architecture is quantum computer resistant.

The best part is that the user never sees any of this – all they know is that they were able to access the application securely in a split second.

Customers with an application registered with Auth0 can utilize Haventec as their identity provider by leveraging the OpenID Connect standard. Start by setting up your application in Haventec to receive a unique identifier that allows you to create, enable and test your enterprise connection in Auth0 with Haventec Authenticate as the IDP. Please see the [installation documentation](https://marketplace.auth0.com/integrations/haventec-authenticate) for step by step guidance. 

See a demo video for an overview of Haventec's technology.

<AmpContent>
<amp-youtube
    data-videoid="2Z0OjLWg4zM"
    layout="responsive"
    width="480" height="270">
</amp-youtube>
</AmpContent>
<NonAmpContent>
<div class='embed-container' style="position: relative; padding-bottom: 56.25%; height: 0; overflow: hidden; max-width: 100%;margin-bottom:40px;"><iframe style="position: absolute; top: 0; left: 0; width: 100%; height: 100%;" src='https://www.youtube.com/embed/2Z0OjLWg4zM' frameborder='0' allowfullscreen></iframe></div>
</NonAmpContent>

---

## A Phased Approach to Achieving Passwordless Authentication

Your journey towards passwordless authentication will largely depend on your product's maturity and development lifecycle.

Developers of a greenfield application can easily forgo the decades-long paradigm of UserIDs and passwords. Considerations at this stage will revolve around the features, benefits, and scalability of a passwordless solution. In particular, how it can improve customer experience and lifetime value.

For mature applications, developers looking to leverage the security and experience benefits of passwordless authentication should consider a phased approach that minimizes customer disruption. After all, your customers may have been conditioned to authenticate with UserIDs and passwords and see this method as familiar and secure. 

Haventec Authenticate supports a phased approach to passwordless authentication by enabling you to offer your customers:

* **Traditional username and password authentication but with MFA silently enabled to reduce risk.**

 MFA is now a common practice to mitigate against identity theft, phishing attacks, account takeovers, and other digital threats. However, the effort and support required to educate and onboard users are one of the reasons MFA remains optional in many consumer applications. Haventec is solving this challenge through the introduction of Silent MFA.

 Product leaders can activate 'silent' (invisible to the end-user) MFA for their customers without disruption. Customers do not need to install authentication apps, switch devices or apps for another authentication factor, or worry about physical tokens. MFA becomes a single-step experience offering strong customer authentication and peace of mind.

* **Elimination of UserIDs and passwords**

 Organizations looking to further reduce risk, simplify the user experience, and differentiate their product, can leverage Haventec Authenticate's passwordless technology by integrating it with their Auth0 subscription.

 Customers will have the option to use a PIN or Biometric to replace username/password combinations and enjoy a genuinely passwordless MFA experience that is consistent across devices. 

## There's Never Been a Better Time to Go Passwordless

With its optimized user experience and easy integration with your existing Auth0 infrastructure, Haventec Authenticate enables you to make an effortless and customer-centric shift to passwordless for a consistent and secure access experience every time.

To learn more, check out our integration at [marketplace.auth0.com](http://marketplace.auth0.com/)

Seamless and Secure Passwordless MFA from Haventec

Brittney

Brittney Liburd has been helping teams go to market with SaaS and security technologies for over 12 years. An avid researcher and writer, Brittney has a passion for artificial intelligence, machine learning, and the #goodIDmovement. She also has a near-encyclopedic knowledge of George RR Martin's “ A Song of Ice and Fire” book series.

Sr. Product Marketing Manager at authID

Brittney Liburd

Advanced facial biometrics can enhance Auth0 MFA workflows to provide secure authentication experiences that simplify common challenges for technical roles.

On a daily basis, CIAM professionals battle data breaches, account compromise, ransomware, and fraud. In 2021, digital fraud rates increased 22%, ransomware rates increased 62%, data breach rates increased 17%, — and cybercriminals shifted to softer targets with more valuable data and motivation for ransom payout. Huge shifts in remote work, distance learning, telemedicine, and BYOD trends also added layers of complexity as organizations struggled to protect systems and data.  

These trends illustrate the complex CIAM challenges facing technical roles in B2B, B2C, and B2E environments. Developers, engineers, systems architects who are responsible for CIAM and fraud prevention will find this post most valuable, as we will discuss how facial biometric authentication can strengthen identity assurance while simplifying challenges in implementation, operations costs, security needs, and CX expectations.  

## Facial Biometric Authentication

> Facial Biometric Authentication can help technical roles secure enterprise assets while simplifying the user experience.

Finding the right balance between user convenience, privacy, and security is today’s biggest challenge for developers. CIAM is a convergence of IAM, fraud detection, and authentication tools that are used for controlling user access by both internal users (your workforce) and external users (your customers). However, according to Gartner, no single tool can deliver on all the identity administration, fraud detection, access management, content management, and analytics needed to build out a holistic solution.

As a result, technical roles are left cobbling together solutions that may leave gaps in security or may increase friction in user experience that requires additional investment to remedy. Advanced facial biometric authentication seamlessly woven into the Auth0 login workflow can provide the needed balance between a frictionless user experience and protection against password-related fraud, phishing, and account takeover. 

## 4 Ways to Leverage Auth0 and Advanced Facial Biometric Authentication to Strengthen CIAM

Auth0 simplifies biometric multi-factor authentication for the technical teams responsible for implementing CIAM strategies and tools. This simplification is delivered in four main areas.  

* Easy Implementation with Broad Solution Support
* Operational Efficiency and Cost Reduction 
* Improved Security and Fraud Reduction  
* Enhanced User Experience 

### Easy Implementation with Broad Solution Support

Users today shop, play and work using a broad range of mobile devices and desktop computers, and operating systems. So technical roles need a strong authentication solution that is device-agnostic and capable of supporting everyone interacting with your platform. Biometric authentication that offers portability without being tied to a specific device, an authenticator fob, or an authenticator app also provides the right balance between enhanced platform security and increased user satisfaction and adoption.

### Operational Efficiency and Cost Reduction

Operational inefficiencies caused by complex authentication experiences impact customer loyalty and workforce productivity, with negative impacts on revenue and profits as businesses move slower and customers are lost. B2B, B2C, and B2E focused organizations using Auth0 can improve operational efficiencies and reduce related costs with authentication solutions that are applicable for many use cases across multiple devices. To simplify CIAM for technical roles - focus on finding a solution for user authentication that can serve internal, external, and developer use cases. Facial biometrics can support authentication use cases, including online or mobile app login, chat or call center support, as well as strong authentication for valued transactions and account activity. Also, remember solutions that require complex maintenance should be avoided in lieu of a solution that simplifies administration requires no additional hardware, training, or mental burden on behalf of the user. 

### Improved Security and Fraud Reduction

Advanced facial biometric authentication reduces the risk of account misuse and takeover by requiring the live face of a registered user as a factor for authentication and a condition for access. Even in the event of password or credential compromise, advanced facial biometrics will stop unauthorized access from occurring. Facial biometric multi-factor authentication addresses many fraud-related concerns, including the ability to stop account takeover and quickly authenticate the validity of transactions flagged for manual review. 

### Enhanced User Experience

Including advanced facial biometrics as a factor for authentication within your Auth0 workflow delivers a sophisticated digital experience by balancing strong authentication with customer expectations of low friction authentication and easy access. Today’s users—whether they are shopping, working, or banking – sitting on the train or at their desks are demanding portability with less friction. Advanced biometric authentication eases the user burden as there is no need to download additional software or employ multiple devices for authentication. 

## Conclusion

When evaluating CIAM tools to reduce friction in or further secure your MFA workflow, consider Verified CloudConnect—the ideal bolt-on integration for Auth0. Verified™ CloudConnect delivers fortified, in-browser biometric authentication—supported across all mobile and desktop devices used to access enterprise data and resources. At login or for any transaction you deem to require additional identity assurance, the Verified browser-based UX adds an additional factor of authentication – a live selfie. Verified analysis of the selfie in real-time for biometric matching and liveness, defending user accounts from deep fakes and other spoofing attempts. 

Verified CloudConnect is a flexible, drop-in solution that seamlessly extends the Auth0 Identity Platform to secure B2B, B2C, and B2E environments without additional authentication hardware, mobile apps, or single-use pin-codes. As Gartner has noted – no one single vendor can deliver for all aspects of identity and access management. Adding a tool like Verified CloudConnect for Auth0 will improve user experience, thereby increasing user adoption and retention. Deployed easily with a simple line of code, Verified enhances your current security stack while reducing operational costs and overall solution complexity.  

Ready to get started with Verified CloudConnect for Auth0? Visit [authID.ai listing](https://marketplace.auth0.com/integrations/verified-biometric-mfa) on the Auth0 Marketplace for more information.

4 Ways to Strengthen Identity Authentication for Technical Roles

william_johnson

  Will Johnson is a Developer Advocate at Auth0. He loves teaching topics in a digestible way to empower more developers. He writes blog posts, records screencasts, and writes eBooks to help developers. He's also an instructor on <a target='_blank' rel='noopener noreferrer' href='https://egghead.io'><strong><b>egghead.io</b></strong></a>.


Developer Advocate

Will Johnson

Use Auth0 Actions to enable SMS-based MFA with Plivo.

Logging into a website with your username and password is a straightforward way to log in and access your content. You've been doing it for years, you've created several passwords, and it works. Logging in with **just** a password isn't as secure for your users as it used to be. Hackers can steal passwords from one site and use [credential stuffing](https://auth0.com/blog/what-is-credential-stuffing/) to pose as your user and gain access to other sites. It's common for your users to re-use passwords since they have several to remember across all their applications. You can help keep your users' data secure by offering another layer of protection by enabling Multi-factor Authentication (MFA).

> To learn more, read [this guide about MFA and its different methods on the Auth0 blog](https://auth0.com/blog/multifactor-authentication-mfa/).


You've likely experienced MFA in real life. For example, if you start working for a new company, they may ask for your ID card and a birth certificate. Those are two different *factors* of identification. It helps verify you are who you say you are to make sure your paycheck goes to you and lowers the success rate of someone posing as you.

In this blog post, you'll learn how to implement SMS-based MFA with Auth0 Actions and [Plivo](https://www.plivo.com/).

## Prerequisites

- An Auth0 account
- A Plivo account
- A Plivo phone number

If you do not have a Plivo account or an Auth0 account, you can sign up for a [free Plivo account](https://console.plivo.com/accounts/register/) and a <a href="https://auth0.com/signup" data-amp-replace="CLIENT_ID" data-amp-addparams="anonId=CLIENT_ID(cid-scope-cookie-fallback-name)">free Auth0 account</a>.

If you already have an application created in your Auth0 account, you can skip to [Create Action for MFA](#Create-Action-for-MFA).


## Set up & Configure a React App Application with Auth0

In the Auth0 dashboard, create a new application by clicking on **Applications > Applications > Create Application**. On the next screen, create a name for your application and select **Single Page Web Applications** since you're using a React app. 


![Auth0 Create Application Page](https://images.ctfassets.net/23aumh6u8s0i/7ffrE0TIKPuvwAmyAHETGV/3704b624e8b568fba9288b1c6236872d/auth0-create-application-page.png)


The next screen will ask you, "What technology are you using for your web app?" Select **React**.


![Auth0 Technology Selection Page](https://images.ctfassets.net/23aumh6u8s0i/3Is0KXk07ueIJadkrrHnbl/804f4ad53e8af5b28916481b92778fdc/auth0-technology-selection-page.png)


To get up and running quickly, you can download a sample [React application integrated with Auth0 on GitHub](https://github.com/auth0-samples/auth0-react-samples/tree/master/Sample-01).
Once it is downloaded, type `cd auth0-react-samples` on your terminal, then run `npm install` to install the dependencies.

## Configure Auth0 Credentials

For the authentication flow to work, the project needs your Auth0 domain and client ID. In your code editor, copy the content of `src/auth_config.json.example` into a new file in the same src folder called `auth_config.json`, and replace the values with your own Auth0 application credentials:

```js
{
  "domain": "{YOUR AUTH0 DOMAIN}",
  "clientId": "{YOUR AUTH0 CLIENT ID}",
}
```
You can get the client ID and domain from the settings tab on your new application page.

![Auth0 Application Settings Page](https://images.ctfassets.net/23aumh6u8s0i/1GFtgZeJursgHKHzNXQFVh/7496cb3bc06a7411096386c3109be8ed/auth0-application-settings.png)

Next, scroll down to the Application URIs section to fill in Allowed Callback URLs, Allowed Logout URL, and Allowed Web Origins. This example is running locally, so enter `http://localhost:3000` into each field. When you're finished, scroll to the bottom of the page and click _Save Changes_.

![Auth0 Dashboard Application URIs section](https://images.ctfassets.net/23aumh6u8s0i/6kXeY9LVo5sincLcxSdrk1/e25a7bfd89bcda641f6c6625ad143aa5/Screen_Shot_2021-12-03_at_8.37.26_AM.png)


## Create Action for MFA

With an application linked to the Auth0 dashboard, you can create an Action that will run globally for all applications in your Auth0 tenant. Actions are functions written in Node.js that you set to run at specific events based on your users' actions. Actions let you write custom code that fits your needs and integrates third-party vendors with Auth0 to work together. This post is going to focus on integrating with Plivo. 

To get started with Actions, you need to add an Action to your library. On the Auth0 dashboard side menu, click **Actions > Library**.

![Auth0 Actions Selection](https://images.ctfassets.net/23aumh6u8s0i/6q9LRH1DvQMiF3mU7t6Wy7/8481bc4376718299a2806a165e49ed56/auth0-action-selection.png)


On the Library Page, click **Add Action**. On the Browse Actions page, search for **Plivo** and click on it. On the next page, click on **Add Integration**.
You'll then be met with a prompt telling you, "Plivo will need access to: Read and share user profile information" if you agree, click **Continue**.

## Access and Add Plivo Credentials

This will bring up a page to enter your Plivo credentials such as Plivo authorization ID, Plivo phone number, and Plivo authorization token. You can find the authorization ID and Token on the Account and Payments section of your Plivo dashboard.

![Plivo Accounts and Payments Page](https://images.ctfassets.net/23aumh6u8s0i/3Dttg4mSQ9R20tnFzsRuVr/01c5fe787a262c6e5793642703785064/plivo-accounts-and-payments.png)

Access your Plivo phone number by clicking on **Phone Numbers** on the left side menu. If you don't have a Plivo phone number, you can rent one [following these instructions on the Plivo Docs](https://www.plivo.com/docs/numbers/guides/buy-a-number/).

> Make sure you add the phone number in the E.164 format(ex. +15554443232)

Then click **Create**, and you'll go to the Library page. You can create an Action Flow from here. You'll learn how to use flows next.

## Create Send Phone Message Flow

You should now see the Plivo Action on the installed tab of the Library page. Click the three dot menu on the right and select **Add to flow**. 

![Actions Library Page](https://images.ctfassets.net/23aumh6u8s0i/5IbEG0QKPAbyIoi9buA2NL/ba6df3e83c1cc498b248eafd48fc5362/auth0-add-to-flow.png)


This will take you directly to the **Send Phone Message** flow. Flows are the steps your application takes when using Auth0 as your identity provider. You'll see the **Start** and **Complete** trigger points in the flow in Action flow visualizer in the middle of the screen. On the ride side of the screen, you'll see the **Add Action** section. This will show a list of installed Actions like the Plivo one we created, and there is also a tab for custom Actions.

![Auth0 Actions Visualizer](https://images.ctfassets.net/23aumh6u8s0i/ITasqHfe5OIyRImhGGxis/0a125823cda2f4ee84c2f19d5f6b97ae/auth0-actions-flow-visualizer.png)

You can drag and drop the Actions to the point in the flow that you want them to trigger. Grab the Plivo Action and drop it in between **Start** and **Complete**, then click **Apply**.

![Auth0 Actions Flow Visulizer](https://images.ctfassets.net/23aumh6u8s0i/YYUxv5wmVMjjcFA6ictqN/0683342bf45d6a9e0661e7cbd0febd7e/auth0-actions-added.png)

Now, when an SMS message is requested, your application will signal Pilvo to send an SMS message. But how do you trigger the message request? You have to turn on SMS-based Multi-factor Authentication.

## Turn on MFA in Auth0 Dashboard

On the left side menu in the Auth0 dashboard, click **Security > Multi-factor Auth**. 

![Auth0 MFA page](https://images.ctfassets.net/23aumh6u8s0i/4UUXYlr7UjlSqt3mxPoyrq/17d0e5470369da629062de484fb59862/auth0-mfa-page.png)


In the **Factors** section, scroll down and click **Phone Message**. Click the toggle on the upper right side of the screen to enable Phone Message. With this turned on, it requests a phone message be sent to your users with a code to verify their login. 

Under **Choose a delivery provider**, select **Custom**, since you created the Plivo "Send Phone Message" hook to handle sending an SMS to users. For **Choose a delivery method**, choose **SMS**. 


![Auth0 Phone Message Screen](https://images.ctfassets.net/23aumh6u8s0i/3lfkktB82h2DkLrnl8OCBy/1fa9fb6ec90eb3519b6cc48546cbaeae/auth0-phone-message-screen.png)


Scroll to the bottom of the page and click **Save** to save these settings.

Return to the **Multi-factor Authentication** page and scroll down to the **Define policies** section. This section tells Auth0 when you want the Phone Message MFA request to trigger. For this example, select **Always** to ensure your users have an extra layer of protection each time they log in. Then click **Save**.

You will then be asked, "Are you sure you want to continue?" This prompt also lets you know that all users will be required to enroll in MFA and that all applications in your Auth0 tenant will now use MFA. Click **Continue**. 

You have everything set up to require your users to receive an SMS message with a verification code from Plivo after logging in. But it's always a good idea to test out new features after you add them.

## Test Your MFA Login Flow

Run your sample application locally by launching the `npm run dev` command in the project's root folder. Then, head your browser to the [http://localhost:3000](http://localhost:3000) address and click **Login** on the home page. On the login page, enter your email and password. Next, you'll be prompted to add a phone number to secure the account. This is what your users will see the next time they log in after you enable MFA.

You can select the code for your country on the first line, then type in your phone number and click **Continue**. You'll revieve an SMS message with a verification code. Enter that code into the input box on your application.

You've successfully added another factor of protection for your users!

## Test MFA flow in Auth0 Dashboard

Another way you can test the MFA flow is by using the Auth0 dashboard. You can test Actions you created without having to run your entire application.

Click **Getting Started** at the top of the left menu on the Auth0 dashboard. You'll go to the **Getting Started** page, where you'll see the option to **Try your Login box**. Clicking **Try it out** will bring you to the login box that your app will use. 

![Auth0 Dashboard Getting Started page](https://images.ctfassets.net/23aumh6u8s0i/6x1ti069gOiQQEfKMxJOkA/1a574fcaa21a63c27af49c46f945ac5d/auth0-try-login-box.png)

Log in as one of the users in your tenant (If you don't have any users, click **Sign up**).

Once logged in, you'll be asked to provide a phone number. Enter the number for your mobile phone. You'll receive an SMS message from your Plivo phone number with a six-digit code. Enter this code into the Auth0 login box and click **Continue**. You'll be greeted with the **It Works** page, confirming that your MFA Action worked!

![Auth0 It Works web page](https://images.ctfassets.net/23aumh6u8s0i/2TPUwfu11Te9Yb27M3920C/34f3bc3c726eeb0b76cc971c7fd1f5c3/auth0-it-works-screen.png)

## Conclusion

Congrats! You just added another layer of protection to keep your users' data safe. First, you included the Plivo integration from Actions Library. You then created a "Send Phone Message" flow using the Plivo integration and the Actions drag and drop interface. After that, you enabled the Action by turning on MFA in the Auth0 dashboard. Finally, you tested everything out using "Try your Login box" in the Auth0 dashboard.


Enable SMS MFA with Plivo and Auth0 Actions

andres

I’ve been at Auth0 since 2017. I’m currently working as a Product Manager for the Auth0 FGA and OpenFGA products. Previously, I worked in the teams that owned the Login and MFA flows. <br>
I spent my entire 20+ year career building tools for developers, wearing different hats. When I'm not doing that, I enjoy spending time with my family, singing in a choir, cooking, or trying new kinds of local cheese.

Product Manager

Andrés Aguiar

WebAuthn Authenticators offer a streamlined user experience and enhanced security

In the last few years, the [FIDO Alliance](https://fidoalliance.org/) has been working relentlessly towards the vision of helping users authenticate with maximum security and minimum friction. The resulting [WebAuthn standard](https://www.w3.org/TR/webauthn-1/) provides the foundation for that to happen. Now it is up to the industry to make that technology available to end users. 

WebAuthn is the only standard-based authentication method that makes phishing impossible, as it binds the public/private key to a specific web domain. You cannot mistakenly authenticate into a phishing website.

A few weeks ago, [we announced](https://auth0.com/blog/fido-security-key-support-comes-to-auth0/) the support for [FIDO Security Keys for MFA](https://auth0.com/docs/mfa/fido-authentication-with-webauthn) using WebAuthn. Security Keys are a great way to secure access to your account, but their adoption is mostly limited to tech-savvy users or corporate environments with relatively high-security requirements.

We are now announcing support for [**FIDO Device Biometrics for MFA using WebAuthn**](https://auth0.com/docs/mfa/fido-authentication-with-webauthn). This makes the security and convenience of WebAuthn-powered flows available to anybody who has a device and browser who can support the biometric challenge, not just those who have security keys. Now all users can reap the benefits of this technology, regardless of how tech-savvy they are. 

<include src="WebAuthnMeCTA" group="A"/>

Enabling users to authenticate using their device biometrics has two benefits: it **greatly reduces friction** during the authentication challenge, which impacts user **retention and revenue**, and **it increases security** since the flow is not phishable by bad actors. 

The data we collected during Beta testing shows biometrics performing much better than other MFA options:

![Internal Auth0 study, March 2021](https://images.ctfassets.net/23aumh6u8s0i/wD2JeWObWymymRv7Xs7gf/8d5c021776667b1e87d691cf7429e37a/graphics.jpg)
<p align="center"><i>Internal Auth0 study, March 2021</i></p>
<br>

The Y axis shows time to complete, and the X axis represents the % of users that can complete the MFA challenge. WebAuthn platform authenticators have the highest passing rate (94%) and the shortest time to complete (5 seconds).

## WebAuthn With Device Biometrics Availability

For users to take advantage of biometric authentication on the web, they need to have devices that support WebAuthn. It’s hard to know precisely how many devices are capable of WebAuthn Device Biometrics, as there is no specific information. We can only approximate with operating system and browser usage statistics, as in Android and Windows, it depends on the device in addition to the OS/Browsers.

<table border="1">
<tbody>
<tr>
<td><b>Operating System & Browsers with WebAuthn Device Biometrics Support</b></td>
<td><b>OS Adoption March 2021 Source: <i>StatCounter</i></b></td>
</tr>
<tr>
<td>Mac OS Catalina (Chrome, Edge, Brave)</td>
<td><a href="https://gs.statcounter.com/os-version-market-share/macos/desktop/worldwide#monthly-202103-202103-bar">67%</a></td>
</tr>
<tr>
<td>Mac OS Big Sur (Chrome, Edge, Safari, Brave)</td>
<td>Unknown</td>
</tr>
<tr>
<td>iOS 14+ (Safari)</td>
<td><a href="https://gs.statcounter.com/os-version-market-share/ios/mobile-tablet/worldwide#monthly-202103-202103-bar">76.24%</a></td>
</tr>
<tr>
<td>Windows 10 + (All modern browsers)</td>
<td><a href="https://gs.statcounter.com/os-version-market-share/windows/desktop/worldwide#monthly-202103-202103-bar">78.28%</a></td>
</tr>
<tr>
<td>Android 7+ (Chrome)</td>
<td><a href="https://gs.statcounter.com/android-version-market-share/mobile-tablet/worldwide/#monthly-202103-202103-bar">82.08%</a></td>
</tr>
</tbody>
</table>
<br>

You can get additional information about browser support on our [webauth.me](https://webauthn.me/browser-support) site.

## Enrolling With Device Biometrics

Authenticating using WebAuthn with Device Biometrics presents two unique challenges:

* Given the authentication method is bound to a specific device, it cannot be **the only** authentication method the user has, or they will be unable to log in from a different device. 
* Users would want to use biometrics to login from all of their devices, and applications should make it possible to enroll all of them.

Auth0’s solution addresses both problems. It will always ensure that users’ have another way to authenticate. When MFA is enabled, users can only enable biometric authentication if they also enable another option.

The enrollment flow would be as follows:

![The enrollment flow](https://images.ctfassets.net/23aumh6u8s0i/skfRYpG6f4PbJAfT5jcji/98afcec8e1653c389b6344099a2ff003/unnamed-2.png)

* The user authenticates with a username and password.
* Enrolls in any other MFA Factor (e.g., a security key, a TOTP application like Google Authenticator, Push, SMS)
* If the device is capable of using Webauthn Device Biometrics, users will get the option of enrolling with it.
* If they do, the next time they login from that device, they can use Device Biometrics as the second factor.

#### Progressive Enrollment

Auth0 employs progressive enrollment to aid users in authenticating from different, WebAuthn-capable devices. Whenever a user presents this type of device for authentication, they will first be prompted to enroll it. This is a progressive process that is only activated once new, WebAuthn-capable devices are used so that they will be able to authenticate with biometrics in all of their devices capable of this functionality. 

For example, when a user initially authenticates from a MacBook with a Touchbar, they authenticate with their username and password and enroll in another MFA factor. However, since the MacBook has biometric capabilities, they will be prompted to enroll if they like. Later, if they wish to use their iPhone with FaceID capabilities, they will be automatically asked to use Face ID before proceeding. This process guides users through a progressive enrollment flow that is easy, seamless, and friction-free.

Here’s a quick demo of WebAuthn with Auth0:
<include src="Vidyard" id="CPw4UfSZxmTPkFvJSEC1x2" />

## Enabling WebAuthn With Device Biometrics

If you are currently using MFA with Auth0, biometrics can be enabled from the Auth0 dashboard. 

![Auth0 dashboard](https://images.ctfassets.net/23aumh6u8s0i/4UC4NaiiciIpjLGBPwab9h/07ea4d71950ba229bd3be05d8fb48696/unnamed-3.png)

After you enable it, users will receive prompts from enrolling their devices when authenticating; no code change is necessary.

Please refer to our documentation to learn more about [Auth0’s WebAuthn implementation](https://auth0.com/docs/mfa/fido-authentication-with-webauthn) in general and [WebAuthn for Device Biometrics](https://auth0.com/docs/mfa/configure-webauthn-device-biometrics-for-mfa) specifically.

## What’s Next

WebAuthn with Device Biometrics combines two authentication factors in one: something you have (the device) and something you are (the biometrics). In case you can’t use biometrics in the device, e.g., if you are wearing a mask, you’ll use something you have plus something you know (the passcode). As it’s stronger than a password and simpler to use, the next step is bringing it to passwordless authentication. Auth0 will support this in the same way we are doing it for MFA by letting users progressively enroll all of their devices. Stay tuned!

MFA With WebAuthn for FIDO Device Biometrics Now Available

Nabeel-Saeed

Nabeel is a product marketer focused on all things security and identity. He has contributed to publications like Wirecutter, Information Age, and Professional Security. He has also been a guest speaker at the Bay Area Cybersecurity Meetup, and delivered talks on IAM across the US, Canada, Israel, and Singapore. He is passionate about helping build secure auth experiences that amaze users and delight businesses.

Product Marketing

Nabeel Saeed

Common cognitive biases may be impacting your MFA adoption rates; here are some ways to counter those impacts.

Multi-factor Authentication (MFA) has been shown capable of blocking up to [99.9% of brute force attacks](https://www.zdnet.com/article/microsoft-using-multi-factor-authentication-blocks-99-9-of-account-hacks/). Yet a recent IBM/Ponemon Institute study found that only [36% of responding organizations require it](https://www.ibm.com/security/data-breach). And adoption numbers for the general public aren’t encouraging either, with a report from LastPass finding that only [37% of respondents](https://www.lastpass.com/resources/psychology-of-passwords-2020) use MFA for their work accounts. When you add the finding by Verizon that [80% of data breaches](https://enterprise.verizon.com/resources/reports/dbir/) involves the use of stolen credentials, these numbers beg the question, why?

If MFA has been proven so effective as a defense against data theft and brute force attacks, why are adoption numbers still so low? A common set of issues revolve around what are called cognitive biases. We’re going to look at some of the most common cognitive biases, why they’re so effective at keeping adoption of new security measures down, and how you can turn the tables and work with these same psychological ideas to counter their impact and potentially increase MFA adoption. 

![Cognitive Bias Overview](https://images.ctfassets.net/23aumh6u8s0i/3X31s04spm3rcZHMbsjkli/3d974e2b7075f5c5ffc3cf4c37fe4f89/adaptive-mfa-sep2)

## Cognitive Bias Overview

Before we dive in and look at the ins and outs of cognitive biases, it would be helpful to ensure we’re all on the same page about just what is meant by that phrase. A cognitive bias is a subjective reality that we all create for ourselves, most often based on available information and our own life experiences.

Cognitive biases are often the result of using [heuristics](https://www.behavioraleconomics.com/resources/mini-encyclopedia-of-be/heuristic/), a type of mental shortcut or rule of thumb, to speed decision making amidst uncertainty. People walking through the steps of creating a new account, for example, will know, based on experience, if the process seems to contain too many, or too few, actions. If they don’t find what they expect, they may abandon the process in favor of one that feels like it has a better mix of ease-of-use and security.

With all of that in mind, we turn to a sampling of the cognitive biases that may be impacting the adoption of security features like MFA. We will also address how each cognitive bias has a flip side or a way to approach it that can flip its effect from detrimental to beneficial for your adoption rates. A quick note: more information on each bias/heuristic discussed here can be found on [Decision Lab’s list of cognitive biases](https://thedecisionlab.com/biases/).

## 1. Optimism Bias

**What it is &mdash;** People tend to overestimate the chances of positive events while simultaneously underestimating the chances of negative ones. This has the result of giving us a feeling of control over situations where, in fact, we may have little to no control. 

**How it can impact adoption &mdash;** The basic argument looks like this: “data theft happens to other people; it will never happen to me.” Therefore, people who feel this way don’t see the point in adopting additional security measures such as MFA, especially if doing so feels at all invasive or time-consuming. This feeling was verified in a recent report from cybersecurity company Balbix which found that [99% of enterprise users](https://www.balbix.com/resources/state-of-password-use-report-2020/) reuse their passwords, either across work accounts or between corporate and private logins. 

**How to work with it &mdash;** The underlying shortcut being used here says that since something has never happened before, it won’t happen now. Remember that you’re asking people to take steps to protect themselves and your organization. You can use their optimism in your favor by offering an incentive for adoption. For example, the online game Fortnite offered a [free victory dance emote](https://www.epicgames.com/fortnite/en-US/news/2fa) for everyone who opted into their new MFA feature. Other companies like Google are deciding to [require users to enable MFA](https://www.cyberscoop.com/google-multifactor-authentication-2sv-default/). For most companies, this strong-arm tactic may not be the best route to take for customer satisfaction, especially when you can work with these psychological ideas to achieve the same goal while maintaining a great CX.

## 2. Fundamental Attribution Error

**What it is &mdash;** The habit of attributing dispositional factors, rather than situational ones, for other people’s behavior. For example, when someone cuts you off in traffic, our instinct is to assume they’re just a bad person, instead of taking into account the possibility of their being late for an interview or on the way to the hospital because a loved one was injured.

**How it can impact adoption &mdash;** People will think, “I don’t need the extra security because I’m not like those other people who don’t know how to create good passwords.” This thinking combines the fundamental attribution error with its opposite, the actor-observer bias, which states that we overemphasize situational factors to our own behavior over dispositional ones. 

**How to work with it &mdash;** Use the actor-observer effect to your advantage by showing customers how quick and easy it is to set up and use MFA. This eliminates the primary situational excuse of “I’m too busy.” Adaptive MFA allows you to only confront your customer with additional verification steps when the situation calls for it. At the same time, variable options for that authorization keep the additional step as low-friction as possible. For example, using the biometric features of the visitor’s smartphone is an extremely secure and low-friction second verification method that users already trust.

## 3. Status Quo Bias (Psychological Inertia Effect)

**What it is &mdash;** A basic preference for the current state of affairs. Psychological inertia further describes our reluctance to make changes to the systems we see as working just fine, despite the appearance of disconfirming evidence. 

**How it impacts adoption &mdash;** Thinking that “how I do it has worked for years, why should I change now?” can lead to things like reused passwords and a general lack of willingness to adopt new processes despite the mounting evidence that factors like MFA are key to slowing down or stopping data theft.

**How to work with it &mdash;** The need to maintain control is often at the root of status quo bias. That means that a gentle reframing of the ask (enable this new feature) may be called for. Wording like “keep control of your account with MFA” can be enough to sway users who are on the fence. Point out that with adaptive MFA, the user won’t even see the additional step on every login, only in situations where a special circumstance is detected. Circumstances like impossible travel, where a login attempt makes it look like the user has traveled farther than possible in the time since their last login, for example. 

## 4. The Framing Effect

**What it is &mdash;** Choices can be presented in ways that highlight positive and/or negative aspects of the decision being made. The context in which the options are presented can make the difference in how the decision-maker feels and which option they ultimately choose.

**How it can impact adoption &mdash;** If MFA looks like an extra step in what is already viewed as an overly complicated process that you’re imposing on your audience, they’re less likely to be willing to adopt it.

**How to work with it &mdash;** Most of us frame our decision-making based on availability and affect (how we feel in the moment). If you can slow down the process just enough for people to realize the importance of the decision, they’re more likely to take more aspects into consideration and will therefore be more willing to take the extra moment or two to set up added security for the peace of mind it will give them down the road. Reframing the decision as being about maintaining control over your personal information by removing mention of the organization or data breaches overall can also help here. Another step you can take is to leverage Auth0 features like Breached Password Protection (BPP). With this enabled, users will be notified should their credentials be found in a data leak; you can use that to encourage adoption of MFA to block a possible attack on their information. Now they know you’re watching out for them, making them more receptive to doing their part by enabling MFA protection.

## 5. Dunning-Kruger Effect

**What it is &mdash;** This bias states that people with limited knowledge of a topic tend to overestimate their ability in that area. This effect is often misinterpreted as saying something about the intelligence of people in general, which is unfortunate because that means it’s often used incorrectly. In our scenario, this effect will most often look like someone saying, “my password is uncrackable,” or “I’m smarter than some criminal.”

**How it impacts adoption &mdash;** Once someone is overconfident in their ability to maintain security over their information, they are not likely to think they need what they now view as unnecessary added steps. The thinking is that since they’re so much smarter than criminals and have created an uncrackable password, why should they bother setting up additional protection?

**How to work with it &mdash;** Slow down and make MFA the default.[ David Dunning](https://www.vox.com/science-and-health/2019/1/31/18200497/dunning-kruger-effect-explained-trump), one of the psychologists credited with the effect’s discovery, has this to say, “The first rule of the Dunning-Kruger club is you don’t know you’re a member of the Dunning-Kruger club.” In essence, we all suffer from this bias at some point and likely have no idea that it’s happening. The way to combat this is to add just enough friction to the account creation process that people take the time to realize the importance of MFA. Add to that making MFA an opt-out feature, rather than opt-in, so it becomes faster and easier to leave the default setting and enable it.

![Cognitive Biases Need To Be Accounted For](https://images.ctfassets.net/23aumh6u8s0i/40V8USPBHCJ0K9SxZHISMw/b7488bb599ce8d9f83a3aeea0e4334fa/adaptive-mfa-sep1)

## Cognitive Biases Need To Be Accounted For

Keeping in mind the possible cognitive biases at play allows you to design customer experiences (CX) that encourage your audience to make safer decisions. Paying special attention to your CX, along with the content and specific wording used, can go a long way toward increasing customer adoption of MFA.  By using framing to encourage adoption, remembering to keep things positive, and showing how MFA use enables the user to maintain control over their own personal information — you’re setting yourself up for better adoption rates.

Auth0 provides the flexibility to A/B test different CX designs and content so you can find the right way to frame the decision for your audience. And the scalability we offer means that as more users opt-in, the infrastructure will be there to support your growing user base. Adaptive MFA will also play a large role in the success of your MFA adoption efforts. With features like Bot Detection, impossible travel, and IP reputation scoring, your users will only be presented with the MFA window when the situation warrants it. When you’re ready to learn more about how Auth0 can help you create a CX environment that fosters better MFA adoption, start with our [MFA Guide blog post](https://auth0.com/blog/multifactor-authentication-mfa/), then[ reach out to our experts](https://auth0.com/contact-us) to start the conversation. 

<include src="asides/AboutAuth0" />

How to Use Psychology to Increase MFA Adoption

auziros:jeana-tahnk

Jeana has been in the tech industry for 15+ years, both as a communications professional and writer. As Director of Global Communications at Auth0, she works with her internal team and external agencies to amplify the company's visibility worldwide and establish its leadership in the identity industry. When she is not working, she can most likely be found on a field watching one of her three kids playing sports, or cleaning up after her one-year-old retriever who chews everything.

Senior Director, Global Communications

Jeana Tahnk

Advanced contextual-based feature only triggered by risky logins, mitigating hacking attacks, and reducing threat of data breaches while preserving user experience.



**BELLEVUE, Wash. – Dec. 15, 2020 –** The [Auth0](https://auth0.com/) Identity Platform, a product unit within Okta, today launched [Adaptive Multi-factor Authentication (MFA)](https://auth0.com/blog/auth0-introduces-adaptive-mfa), a sophisticated security feature that helps reduce the threat of hacks and data breaches. Adaptive MFA is an important addition to Auth0's expanding security portfolio&mdash;which also includes Bot Detection, Breached Password Detection, Brute Force Protection, and Suspicious IP Throttling&mdash;and is one of the platform's most advanced context-based security features.

Adaptive MFA is designed to help companies address the inherent challenges of enabling security while preserving user experience. Unlike traditional MFA, which is triggered upon every login attempt and creates an additional step for the end user, Adaptive MFA only appears when a login is deemed risky. This is calculated by an overall risk score that measures abnormal behavior from known devices, impossible travel, and/or IP reputation. Customers can have the confidence that with Adaptive MFA, their end users are asked for secondary authentication only when behavioral signals don't conform to usual patterns for a particular user. 

For example, for a user who normally signs into their account at the same time every morning in San Francisco from a personal laptop, Adaptive MFA would only present a second-factor authenticator if login was attempted outside of the region, usual timeframe, or from a different computer or IP address. Developers can determine how much weight each signal is given to define the risk score that sets off the trigger. 

Many companies are reluctant to implement MFA&mdash;proven to be an effective defense against account hacking attacks&mdash;out of fear of negatively impacting user experience and thus their conversion and retention performance. However, additional friction during the signup, login, or checkout experiences can affect user conversion/retention, resulting in lost sales, and can potentially increase support incidents. Forrester predicts that the MFA market will grow to $2 billion by 2023[1], and this anticipated growth signals the need for a more intelligent and contextually-based MFA solution.   

"Auth0's mission is to provide secure access for everyone. Securing identities is core to that mission, and this new capability adds to the already powerful features in our security profile, designed to counter a variety of sophisticated threats, such as automated attacks, account takeovers, and phishing attacks," said Shiven Ramji, Chief Product Officer at Auth0. "Adaptive MFA should be a key consideration for any enterprise that has previously had to make a tradeoff between security and user experience. The ability to reduce friction while increasing security is a competitive differentiator for our customers."

More detailed information on Adaptive MFA can be found here: [When is MFA the Right Choice?](https://auth0.com/resources/whitepapers/is-mfa-the-right-choice) (whitepaper) and on Auth0's [Multi-factor Authentication](https://auth0.com/multifactor-authentication) page.

<include src="asides/AboutAuth0" />

### Media Contacts
Global Communications <br />
Auth0 <br />
[press@auth0.com](mailto:press@auth0.com) <br />

Matter for Auth0 <br />
[auth0@matternow.com](mailto:auth0@matternow.com) <br />

(1): Forrester Analytics: IAM Software Forecast, 2018 to 2023 (Global)


Auth0 Launches Adaptive MFA to Increase Security and Reduce Friction for End Users

randy_nasson

Director of Product Management for Customer Identity Cloud (formerly Auth0) in our Identity and Access Management (IAM) domain. I joined Auth0 in 2018 and assembled a world-class IAM product team dedicated to delivering customer value and enabling developers to quickly implement secure, robust, and seamless identity solutions. In addition to my current work with CIC, I regularly work with our Auth0 Lab team on greenfield initiatives and with our Strategic and Technical Partner teams on opportunities to drive revenue.

Director, Product Management (IAM)

Randy Nasson

antoniofuentes

Antonio is a Product Manager in charge of features and functions used by thousands of customers implementing identity systems to keep their users safe and prevent malicious activity.

Product Manager, Continuous Auth

Antonio Fuentes

Adaptive MFA Improves Security and Customer Experience



## Key takeaways

* [Multi-factor authentication (MFA)](https://auth0.com/docs/mfa) provides added security for protected content, but usability concerns can adversely affect the user experience.
* Using [custom MFA options](https://auth0.com/docs/mfa/customize-mfa-user-pages) can help reduce friction, but custom MFA requires [writing rules](https://auth0.com/docs/rules) (coding) or explicit user opt-in to minimize prompts for secondary factors.
* Auth0 now offers Adaptive MFA, which only prompts users for secondary authentication factors if the login or authorization attempt is considered risky.

## The Password Problem

The rapid growth of internet and software services means that user accounts are growing at a dizzying rate. According to [Dashlane](https://blog.dashlane.com/world-password-day/), the average US internet user has over 150 online accounts, with that number projected to double by 2022. That’s a ridiculous number of passwords to remember and an equally ridiculous amount of personal data to protect. 

Given the [rampant password reuse problem](https://securityboulevard.com/2020/04/8-scary-statistics-about-the-password-reuse-problem/) (65% of people reuse passwords across multiple sites), when data breaches occur, a vast number of accounts are vulnerable. While protective measures like [Breached Password Detection](https://auth0.com/docs/attack-protection/breached-password-detection) can help minimize risks associated with known stolen credentials, there nevertheless remains a substantial risk for potential credential theft in the future.

### Securing accounts with MFA

Fortunately, [MFA](https://auth0.com/docs/mfa) offers an excellent defense against password-related account compromise. [According to Open Web Application Security Project (OWASP)](https://cheatsheetseries.owasp.org/cheatsheets/Credential_Stuffing_Prevention_Cheat_Sheet.html), MFA is “by far the best defense against the majority of password-related attacks.” 

MFA is used to protect accounts and resources across a variety of industries and comes in myriad forms to accommodate various use cases. However, it remains woefully under-adopted in many areas, especially in consumer products and services. With some solutions, MFA can be overly complex or prohibitively costly to implement. And even when it is offered, many end-users reject it because they don’t want to worry about having access to the secondary factor when they are just trying to shop online, access an article behind a paywall, play a game, or stream music. Even for developer tools like NPM, [fewer than 10% of developers use secondary factors](https://www.zdnet.com/article/only-9-27-of-all-npm-developers-use-2fa/).

Balancing security and usability has historically been very difficult, with industry trends often overcompensating in one direction, then the other, causing even more user frustration. Fortunately, Auth0 makes it easy for you to provide the security of MFA without the poor user experience of having to provide a second factor with each login attempt.

![Introducing Adaptive MFA](https://images.ctfassets.net/23aumh6u8s0i/40V8USPBHCJ0K9SxZHISMw/b7488bb599ce8d9f83a3aeea0e4334fa/adaptive-mfa-sep1)

## Introducing Adaptive MFA

Adaptive MFA bridges the gap between user experience and account security by providing a secondary factor for end-users but only prompting them for secondary verification when the primary factor login looks suspicious or unusual. For example, if the user logs in from a new device or logs in from previously unseen geolocation, these signals can indicate low confidence that a login attempt is legitimate and that the user should be prompted to authenticate via the second factor.

![AMFA How it works](https://images.ctfassets.net/23aumh6u8s0i/1NOHOVPjLZsNsuklb3Cw2e/c5ac893b034e2bf9df235deacb04966f/adaptive-mfa-graphic-1)

By only prompting for second-factor authentication when confidence is low, users who access applications on a regular basis from the same device and location never have to be interrupted with a second-factor prompt.

Auth0 is pleased to announce that Adaptive MFA is available for all hosted customers as of December 15, with Private Cloud availability in the first quarter of 2021. 

### How it works

Traditional MFA prompts users to authenticate using first a primary factor, often a username/password, and then a secondary factor, such as a code sent via SMS or push notification. This ensures that the individual logging in using the primary credentials has possession of or access to the secondary factor as well.

Adaptive MFA assesses the confidence level of each login and, based on that level, decides whether to prompt the user for a secondary factor or not. The confidence level is assessed using:

* The reputation of the requesting IP address
* The frequency of requests from differing geolocations (impossible travel)
* Whether the device is known or not

Assessing these data points for every login attempt, Auth0 determines the confidence of a legitimate login attempt and then:

* Allows the primary authentication to succeed, or
* Challenges the user with an additional factor, or
* Prompts the user to enroll a secondary factor if they currently don’t have one, or 
* Denies the login and blocks the user account

![AMFA How to enable it](https://images.ctfassets.net/23aumh6u8s0i/34gC9R0va1Kd15JtBNdHUd/ec80c9b34f6232ee44410027d8e7aaf4/adaptive-mfa-graphic-3)

### What’s included

With Adaptive MFA, you will have access to a number of tools to help you define flexible policies and make the right tradeoff between security and user experience:

* An Adaptive MFA flow that triggers MFA only when a login attempt appears to be risky
* Risk assessments that can be used to build your own rules to trigger MFA
* Support for managing the feature programmatically via the Management API
* Rule templates to get you started in case you want to write your own custom business logic
* Tenant log metadata to help you understand the risk levels and impact on user experience

### How to enable it

Using Auth0’s updated Admin Dashboard, you can easily configure Adaptive MFA for applications by selecting the **Use Adaptive MFA** option in the **Security > Multi-factor Auth > Define policies** section.

![Use Adaptive MFA](https://images.ctfassets.net/23aumh6u8s0i/7CKjaRixRDYnypIFL2cTiA/85fd1e38bda162575c1fdd7016738526/use-adaptive-mfa)

### Supported configurations

Adaptive MFA can be enabled for all MFA-supported flows and applications where an email address is available. This is because an email address is required to keep the login flow safe in scenarios where the risk is high, and an end-user has no registered additional authenticators. Most connection types fit this category.  

Connection types where an email address is not available are not supported:

* Social connections, if the email claim is not requested
* Azure AD, if the identifier is a username and no email is available
* Passwordless connections, which do not use email

Adaptive MFA is supported in the most commonly used login configurations:

* New Universal Login
* Classic Universal Login (except for passwordless flow)
* Web or Native apps using the latest SDKs
* Flows hosted by a customer using cross-origin authentication

### Fine-tuned control with policies and rules

Auth0’s Adaptive MFA lets you define how to handle low-risk and high-risk login scenarios, including whether to prompt for an additional factor or prompt the user to enroll an additional factor if they don’t have one. In addition, Auth0 enables customization of those policies through the use of rules.

![Adaptive MFA rule](https://images.ctfassets.net/23aumh6u8s0i/3X31s04spm3rcZHMbsjkli/3d974e2b7075f5c5ffc3cf4c37fe4f89/adaptive-mfa-sep2)

#### Adaptive MFA rule templates

Auth0 provides two rule templates out of the box to enable your business to tailor Adaptive MFA behavior to support your needs. 

If you want to prompt users who haven’t enrolled a secondary factor to enroll one during their next login, you can use the **Require MFA Enrollment** rule template. 

```
function requireMfaEnrollment(user, context, callback) {

  const enrolledFactors = user.multifactor || [];
  if (enrolledFactors.length === 0) {
    // The user has not enrolled in any MFA factor yet, trigger an MFA enrollment
    context.multifactor = {
    provider: 'any'
    };
  }

  callback(null, user, context);
}
```

Let’s take a look at the **Adaptive MFA** rule template. The way this rule is written, Adaptive MFA will only be triggered when the confidence level for Impossible Travel is either `medium` or `low`. It provides an example of how you can selectively apply Adaptive MFA to particular assessors and confidence levels.

```
function adaptiveMfa(user, context, callback) {
  const riskAssessment = context.riskAssessment;

  // Example condition: prompt MFA only based on the ImpossibleTravel confidence level.
  let shouldPromptMfa;
  switch (riskAssessment.assessments.ImpossibleTravel.confidence) {
    case 'low':
    case 'medium':
      shouldPromptMfa = true;
      break;
    case 'high':
      shouldPromptMfa = false;
      break;
    case 'neutral':
      // When this assessor has no useful information about the confidence, do not prompt MFA.
      shouldPromptMfa = false;
      break;
  }
```

Then, the code checks if the user is enrolled in MFA using user multi-factor. If the user is enrolled in MFA, then throw the MFA challenge.

```
  // It only makes sense to prompt for MFA when the user has at least one enrolled MFA factor.
  const userEnrolledFactors = user.multifactor || [];
  const canPromptMfa = userEnrolledFactors.length > 0;

  if (shouldPromptMfa && canPromptMfa) {
    context.multifactor = {
      provider: 'any',
      // ensure that we will prompt MFA, even if the end-user has selected to remember the browser.
      allowRememberBrowser: false
    };
  }

  callback(null, user, context);
}
```

### Let’s get started

Ready to learn more about Adaptive MFA and how to enable it to secure your applications and protected resources? Adaptive MFA is available as part of Auth0’s new [Adaptive MFA Security Bundle](https://auth0.com/pricing/). We invite you to learn more by reading the [documentation](https://auth0.com/docs/mfa/adaptive-mfa) and [contact us](https://auth0.com/contact-us) if you have any questions.

Stay safe. And keep your protected resources safe too!


Auth0 Introduces Adaptive MFA

5e074956ee8ba1fea26e30d28c190495?s=300 avatar

5e074956ee8ba1fea26e30d28c190495?s=300

Full stack developer creating content at Auth0. I love taking a deep dive into hard-to-understand concepts and creating content that makes them easier to grasp. In my free time you can usually find me reading, hanging out with my dogs, or curling in the squat rack.

Former Developer Content Manager

Holly Guevara

Learn what multi-factor authentication is and different methods for implementing MFA.


Before you can learn about multi-factor authentication, you must understand authentication itself. Authentication, simply put, is the process of **verifying that someone is who they say they are**.

When you want to sign in to your account on a website, the website must first make sure you're the owner of that account. How do they do that? They ask you for something that only you should know. Typically, this is the **username and password** that you set up when you created the account. Great! You were the one who set it up, so there's no way anyone else could have your password, right?

It turns out that someone providing the correct username and password to access a resource doesn't necessarily prove that they are who they say they are. User credential breaches have become much more prevalent in recent years, so there's a good chance that some of your username and password combinations have been involved in a breach. This means that relying only on a username and password to identify someone isn't a great practice.

This is where multi-factor authentication comes into play.

## What is Multi-factor Authentication

Multi-factor authentication (MFA) provides a method to verify a user's identity by requiring them to provide **more than one piece of identifying information**.

You have most likely encountered multi-factor authentication on some of your favorite websites already. For example, when you sign in to your banking account, you may get a screen requesting that you enter the code that was emailed to you. Once you enter this code, you're then able to access your bank account. This is an example of MFA in action!

Providing a username and password coupled with a code sent to your email is one form of MFA, but there are several other options you have for implementing MFA. Let's look at some of those now.

## Types of Multi-factor Authentication

The category that you use to identify a user is called an **authentication factor**. In general, these identification methods fall into three authentication factor categories:

**Something you know** &mdash; Something you know, such as a password, PIN, personal information like mother's maiden name, etc.

**Something you have** &mdash; A physical item you have, such as a cell phone or a card.

**Something you are** &mdash; Biometric data, such as fingerprint, retina scan, etc.

To implement multi-factor authentication, you need to cover at least two of these categories.

A common scenario would be requiring a user to sign in with their username and password. This covers the "**something you know**" category. After providing their username and password, they'd receive a text to their cell phone with a short code called a one-time password (OTP). This covers the "**something you have**" category. They'll be required to type this code into the website, and if correct, then they'll be authenticated.

<AmpContent>
![One-time password screen](https://images.ctfassets.net/23aumh6u8s0i/5RoVY86v6SZ5OAVtZzRm6B/1ee99b6f7547ece9c5fc3e7ab2563360/one-time-password)

</AmpContent>

<NonAmpContent>
<p>
<img class="img-responsive" src="https://images.ctfassets.net/23aumh6u8s0i/5RoVY86v6SZ5OAVtZzRm6B/1ee99b6f7547ece9c5fc3e7ab2563360/one-time-password" alt="one-time password screen" style="width:50%"/>
</p>
</NonAmpContent>

In this scenario, even if an attacker knows the user's password, *it isn't enough*. They'll have to also gain access to the user's phone to provide the one-time password.

### One-time passwords

In the scenario above, the application sent the user a code known as a **one-time password (OTP)**. This is one of the most commonly used forms of multi-factor authentication. Let's take a closer look at what one-time passwords are.

A one-time password, like its name indicates, is a pseudo-randomly generated password that expires after a short time period and is only valid for one login. They are typically paired with a traditional username and password to make the authentication process more secure. Even if a user has a weak or reused password, the one-time password that is sent to them is a way to indirectly strengthen their credentials.

There are a few different ways to send one-time passwords to users.

#### SMS

SMS is one of the most user-friendly ways to send one-time passwords. The user signs in to your application with their username and password, and then they receive a text message to their cell phone with their OTP. They're able to easily copy the code from the text message and send it back to the application.

While this may be simple for the user, and it's better than not having MFA at all, it's still [not the best way](https://auth0.com/blog/dont-pass-on-the-new-nist-password-guidelines/#The-SMS-Controversy) to send or receive one-time passwords.

Believe it or not, delivering an OTP through SMS carries the risk of compromise. Here are some of the ways that an attacker can gain access to your OTP through SMS:

- **Social Engineering** &mdash; An attacker that has breached a user's username and password may also have access to their phone number. Attackers have been known to obtain SMS-delivered one-time passwords by sending a text to the user telling them that they used to have the same phone number as them, and they are locked out of one of their accounts because they forgot to update the phone number listed on the account. They politely ask for the code that was just sent to the user's cell phone, so they can get back into their account. Many people want to help the person on the other end, so they text them the code without thinking much of it.

- **SIM Swap** &mdash; [SIM swapping](https://www.consumer.ftc.gov/blog/2019/10/sim-swap-scams-how-protect-yourself) (also known as simjacking) is when an attacker gains access to your cell phone number. One interesting (and terrifying) way this can happen is by an attacker calling your cell phone provider and convincing them that they lost their phone and need a new SIM card activated. The SIM card that gets activated is one that the attacker owns. If the cell phone provider obliges, then the attacker now has access to any text messages, phone calls, etc. that come through. So, if they already have your username and password, all they have to do is type in the OTP that is texted to your phone number (which they now have access to), and they're in! This [Hacking Challenge at Defcon video](https://www.youtube.com/watch?v=fHhNWAKw0bY) has an excellent demonstration of this in action.

#### Email

Another option for receiving OTPs is through email. While this does provide another step to access your account, which is great, it still has some downfalls:

- Because [password reuse is so prevalent](https://www.zdnet.com/article/44-million-microsoft-users-reused-passwords-in-the-first-three-months-of-2019/), there's a chance that a user's email password is the same as the account that's requesting the OTP. Assuming the attacker already has this password, then the extra step of the OTP is useless.

- One of the requirements for MFA is that the implemented factors come from at least two of the MFA categories: something you know, something you have, and something you are. The username and password fulfill **something you know**, and OTP is meant to fulfill **something you have**. Ideally, something you have would be a physical item, such as your cell phone. Having access to an email account doesn't necessarily mean that the cell phone is in your possession, as you could access your email from any device. 

#### Authenticator apps

Another common way to manage OTPs is with authenticator apps. Once you install the app up on your cell phone, you can set up any accounts that work with the authenticator app to send your one-time passwords to that app. The OTPs will typically regenerate every 30 seconds, so instead of waiting for an email or a text message, you simply open up the app, and you'll always find a valid OTP there.

There are a lot of authenticator app options. Some of the most popular ones are [Duo](https://duo.com/), [Authy](https://authy.com/), and [Google Authenticator](https://support.google.com/accounts/answer/1066447).

An authenticator app is an excellent choice for receiving one-time passwords. Unlike SMS, an attacker can't access your authenticator app simply by having access to your text messages or phone number. Your one-time passwords also can't be stolen if someone gains access to your email account.

There are, however, still downsides to authenticator apps. Some users may find it too much of a hassle to download a new app and set up all of their accounts on it to receive one-time passwords, especially when it's so much easier to just enter their phone number instead.

Another issue is that if you lose your cell phone, accessing those accounts that have MFA enabled can quickly become a nightmare. Most popular authenticator apps now have [safeguards, such as key backups, built-in](https://authy.com/blog/how-the-authy-two-factor-backups-work/). To enable backups, you have to create a strong password that's used to encrypt your OTPs. Then, if you ever lose your phone, you can install the authenticator app on your new phone and type in your password to decrypt your keys.

## Step-up Authentication

You may have noticed a common theme amongst the downsides to some of the OTP options: **user experience**.

One of the biggest obstacles to mass adoption of MFA is the slight hit that user experience takes. Generally, the more steps you require to sign in to your application, the fewer people will want to use it.

To manage the balance between user experience and security, some people find it best not to require MFA on every login, but instead, require it when accessing more sensitive data.

> With [step-up authentication](https://auth0.com/docs/mfa/concepts/step-up-authentication), applications that allow access to different types of resources can require users to authenticate with a stronger authentication mechanism to access sensitive resources.

For example, say you have an application that requires users to sign in with their email and password to access customer data. However, when a user wants to see employee data, an **extra authentication factor** is required.

![Auth0 step-up authentication](https://images.ctfassets.net/23aumh6u8s0i/7AkLMOctLnHeZk8BFrw3fz/7aa520a8fa86e9f485d809c0aec4f0d2/step-up-authentication-flow)

Step-up authentication is an excellent option to bridge the gap between user experience and security.

## Implementing Multi-factor Authentication with Auth0

Now that you've seen why multi-factor authentication is important, you're probably wondering *how* you can implement it into your own apps. Let's go through how you can get MFA up and running in just minutes using [Auth0](https://auth0.com).

To start, <a href="https://auth0.com/signup" data-amp-replace="CLIENT_ID" data-amp-addparams="anonId=CLIENT_ID(cid-scope-cookie-fallback-name)">sign up for a free Auth0 account</a>. Once you go through setup, leave the tab open, as you'll be returning to it soon.

Next, you're going to clone this [sample React application](https://github.com/auth0-blog/auth0-react-sample) that has already been set up to use Auth0 for authentication.

> If you'd like to know more about how this application was built, check out [The Complete Guide to React User Authentication](https://auth0.com/blog/complete-guide-to-react-user-authentication/).

In your terminal, run the following:

```bash
git clone git@github.com:auth0-blog/auth0-react-sample.git
cd auth0-react-sample
npm install
```

Next, create the `.env` file in your `auth0-react-sample` root directory:

```bash
touch .env
```

This is where you'll store your Auth0 variables so that you can connect your React application to Auth0. Paste the following into `.env`:

```
REACT_APP_AUTH0_DOMAIN=
REACT_APP_AUTH0_CLIENT_ID=
```

Back in the [Auth0 dashboard](https://manage.auth0.com/dashboard/), click on "**Applications**" and then on the "**Create Application**" button.

Name your application anything you'd like, click on "Single Page Web Applications", and then click "Create".

![Auth0 new application](https://images.ctfassets.net/23aumh6u8s0i/4qVyZ0Mpj5B9GhqeZuSc3Y/4aeab2a7cfaf7ebddf030ba9da13106f/new-auth0-application)

Click on the "**Settings**" tab. Paste the development URL for your React application (`http://localhost:4040`) into the text area under "Allowed Callback URLs", "Allowed Logout URLs", and "Allowed Web Origins".

**Allowed Callback URLs**: `http://localhost:4040`

**Allowed Logout URLs**: `http://localhost:4040`

**Allowed Web Origins**: `http://localhost:4040`

❗ Make sure you scroll down to the bottom and click "Save changes".

Next, you'll need to paste some of these values from the Settings page into your React application's `.env` file so that the Auth0 authentication server recognizes your React application.

Back in your code editor, open your `.env` file. Set `REACT_APP_AUTH0_DOMAIN` to the value for "Domain" from the Auth0 Settings page and `REACT_APP_AUTH0_CLIENT_ID` to the value of "Client ID". 

```
REACT_APP_AUTH0_DOMAIN=your-domain.auth0.com
REACT_APP_AUTH0_CLIENT_ID=yourclientidstring
```

Save this and then start your React application by running the following in your terminal:

```bash
npm start
```

Head to [`http://localhost:4040/`](http://localhost:4040/) in your browser to see your application live.

To test it out, click on the "Log In" button. You'll be redirected to the Auth0 Universal Login page (https://your-domain.auth0.com/login), where you can sign up as a new user. 

![Auth0 signup/login page](https://images.ctfassets.net/23aumh6u8s0i/6ToiqA66XF0UEs1OhYZ2Dw/66e51832bd2c5976b128ecf072927494/auth0-login-screen)

And just like that, you've successfully set up authentication on your demo React application! However, as you know from learning about MFA, this username and password approach leaves a little to be desired. Let's see how you can step up your application's security a notch by turning on multi-factor authentication.

### Enabling MFA with Auth0

Head back to the Auth0 dashboard and click on [**Multifactor Auth**](https://manage.auth0.com/dashboard/#/mfa) in the sidebar.

![Auth0 MFA](https://images.ctfassets.net/23aumh6u8s0i/7wWKd6DIOFnWafex1Iu4rT/c3df03c639a32e4679390c5b1223a7d5/mfa-dashboard.png)

There are a few options here that you can choose. To quickly see MFA in action, select "Phone Message". Scroll down a little and select "Always" from the "Require Multi-factor Auth
" dropdown, and then press "Save".

![Auth0 MFA phone number](https://images.ctfassets.net/23aumh6u8s0i/2jbVMojYAIwwnldyQBMCIY/07413d4028ea0afa75caf81f4f151969/auth0-mfa-phone-number)

Head back to your React application, sign out, and then sign back in. After entering your email and password, you'll be prompted to enter your phone number. Once you do, you'll be asked to enter the 6-digit code that was texted to you.

![Auth0 MFA text OTP](https://images.ctfassets.net/23aumh6u8s0i/4TisUePt1RFWO7GCoxiqnN/208fb3f7ab33d6be9120c862e862952c/auth0-mfa-text-otp)

![Auth0 MFA text OTP code](https://images.ctfassets.net/23aumh6u8s0i/7lCkR3RkB3XqjpIDsEk7F0/283bd91de9a1b338493df8d0361c4137/sms-otp)

Type in the code that you received to your cell phone, and then click "Continue". You'll then be asked to copy a recovery code. This is one of the safeguards that we covered back in the Authenticator Apps section that will allow you to recover your account if you ever lose your phone.

![Auth0 MFA recovery code](https://images.ctfassets.net/23aumh6u8s0i/1fK66CyrkCPmjghImTP4Hb/0e6390f24f78f7758cb8bc40b4130bbe/auth0-mfa-recovery)

Once you've copied it and pressed "Continue", you'll be redirected back to the React application, and you're now signed in!

🎉 **You just enabled MFA on your application in a matter of minutes!**

Auth0 offers several different options for MFA. This demo showed how to set up an SMS one-time password for the sake of simplicity, but if you'd prefer an even better option, you can choose from some of the authenticator apps that are offered. Feel free to experiment in the dashboard and see what works best for you!

## Wrap Up

If you need any more convincing about the need for multi-factor authentication, have a look at the popular website [haveibeenpwned.com](https://haveibeenpwned.com/). The website collects data on password breaches. You can type in your email address to see if it has been involved in any publicly known data breaches. As of writing this, there are **over 10 billion accounts** listed. So, even if you have a strong password, you're trusting the websites you use to keep that password safe, which unfortunately doesn't always happen.

While it's on your mind, take this time to go review your important accounts to make sure you have MFA enabled. Nobody wants to deal with the fallout of canceling their credit cards, dealing with stolen funds, and resetting all of their passwords because their bank account was breached due to weak credentials. Make sure you're always on the offensive by securing your accounts as much as possible! And if you run a website, take care of your users by giving them the means to secure their accounts on your application.

Be sure to reach out in the comments below or [find me on Twitter](https://twitter.com/hollylawly) if you have any questions. Thanks for reading!

Multi-factor Authentication Guide

Leverage Auth0’s extensibility to send SMS MFA messages using the provider that best aligns with your business



Auth0 supports different options for enabling MFA to protect user account access: push notifications, authenticator apps like Google Authenticator, and one-time codes delivered through email, SMS, or third party products such as Duo.

Until now, Auth0 has integrated with Twilio as an SMS provider, which has been a great solution for our customers. However, some customers require additional flexibility when selecting SMS providers. For example, larger organizations may use a single provider for multiple purposes and want to leverage that provider for SMS MFA to consolidate payments and enjoy volume discounts.

Organizations have a number of SMS providers they can choose from depending on their business needs. There are a number of factors to consider when selecting an SMS provider: 

* **Cost:** Some SMS providers may offer more favorable pricing and pricing models than others based on the region or country to which you want to send messages.
* **Integration with your existing software infrastructure:** You may already have a provider that helps you consolidate a single view of all the communications with your users, and you want to keep using it.
* **Compliance:** You might require certain certifications from your SMS provider, which not all vendors can provide.
* **Quality of service:** Some SMS providers may have better deliverability rates than others based on the region or country of the receiver.

Selecting the right provider can yield considerable cost savings to your business and deliver a better user experience to your customers. With this in mind, we are pleased to announce that **you can now use _ANY_ provider** for delivering SMS MFA messages. Auth0 is **the first cloud identity product** that gives you that option.

## Extending Auth0

Auth0 has a powerful and scalable extensibility platform where you can write your own code that can be executed when needed. One of the extensibility points is Auth0 Hooks, which are serverless functions that Auth0 calls when a certain event happens.

You can write code to send SMS messages in our new "Send Phone Message Hook." 

To achieve this, you need to follow three simple steps:

* Create a new "Send Phone Message" [Hook from the Hooks Dashboard’s section](https://manage.auth0.com/dashboard/#/hooks) and give it a name. In this case, you'll be creating one to deliver messages using [AWS’s Simple Notification Service](http://aws.com/sns).

![Simple Notification Service 1](https://images.ctfassets.net/23aumh6u8s0i/4pGiT6S8Awe5kDzwsih44N/093c530a25c70d7945df5b130dc7b86a/1_create-new-hook)

![Simple Notification Service 2](https://images.ctfassets.net/23aumh6u8s0i/5k4AYgPss1iRbZmBFUaSU6/da0b0a2d2bca64872926b17be0870cd9/2_new-hook)

* Write the code to send a text message or use a [full example of how to send text messages with Amazon SNS](https://auth0.com/docs/mfa/send-phone-message-hook-amazon-sns).

![Amazon SNS](https://images.ctfassets.net/23aumh6u8s0i/2pqPsBOiS1bOBaOMX9gtzh/88c2847a5495b6620fa4b719bff6efa5/3_sns-hook)

* Configure the SMS MFA Factor to deliver messages using the Phone Message hook:

![SMS MFA](https://images.ctfassets.net/23aumh6u8s0i/2QTRc0KOhiqTxPWbxrTBWw/8fcfda5305900bf23e1280314164b9af/4_sms-provider)

## Using Your Vendor of Choice

We included documentation on how to implement SMS Delivery with [Amazon SNS](https://auth0.com/docs/mfa/send-phone-message-hook-amazon-sns), [Twilio](https://auth0.com/docs/mfa/send-phone-message-hook-twilio), [Infobip](https://auth0.com/docs/mfa/send-phone-message-hook-infobip), [TeleSign](https://auth0.com/docs/mfa/send-phone-message-hook-telesign), [Vonage](https://auth0.com/docs/mfa/send-phone-message-hook-vonage), [Mitto](https://auth0.com/docs/mfa/send-phone-message-hook-mitto), and [Esendex](https://auth0.com/docs/mfa/send-phone-message-hook-esendex). Just copy and paste the examples in your Hook code and start sending messages using your product of choice.

## Enhance Security With MFA
Auth0 provides the most usable and friction-free multi-factor authentication experience in the market. 

You get a state-of-the-art end-user experience for enrolling and authenticating with multiple factors, like push notifications and one-time password (OTP) apps, right out-of-the-box.

Just enable multi-factor authentication in the Auth0 Dashboard and immediately improve the security of your applications and users!

<include src="asides/AboutAuth0" />


Enable SMS MFA Using Any Provider

df6c864847fba9687d962cb80b482764?size=200 avatar

df6c864847fba9687d962cb80b482764?size=200

Martin Gontovnikas, a.k.a Gonto, is a software engineer at heart who moved to the ‘dark side’ and became VP of Marketing at Auth0. He considers himself lucky to have found a way to combine his two passions and apply his engineering thinking model to marketing.<br/><br/> Gonto’s analytical thinking is a huge driver of his data-driven approach to marketing strategy and experimental design. He is based in the Bay area, and in his spare time, can be found eating gourmet food at the best new restaurants, visiting every local brewery he can find, or traveling the globe in search of new experiences.

Former SVP of Marketing and Growth at Auth0

Martin Gontovnikas

New regulation is part of a global push for MFA



At the end of April, the Australian Communications and Media Authority (ACMA) will begin requiring all telcos to implement two-factor authentication (2FA) when customers transfer their phone numbers between providers.

ACMA member Fiona Cameron was quoted in [ZDNet](https://www.zdnet.com/article/australian-government-introduces-new-telco-regulations-to-fight-phone-scams/), explaining her support for this regulation: “Mobile number fraud can have devastating effects as scammers can gain access to bank accounts, email, social media and more... [V]ictims struggle to regain control over personal and financial information, often over the years."

For Australian businesses providing telco services, including virtual networks of any size, this new 2FA requirement demands immediate attention. Telecommunications companies that fail to comply can be [fined up to $250,000](https://www.theguardian.com/money/2020/feb/28/acma-announces-new-rules-on-porting-mobile-numbers-to-tackle-identity). 

But even if you're not directly involved in telecommunications services—and don’t operate in Australia—this news is important. It represents a global movement, in which lawmakers are increasingly treating [multi-factor authentication (MFA)](https://auth0.com/multifactor-authentication) as a requirement rather than a mere recommendation.

## What Australia’s Regulation Entails
On its face, ACMA’s 2FA requirement is fairly limited in scope. The law requires that when customers switch (or “port”) their mobile phone numbers from one provider to another, 2FA must be in use to ensure that the number is not being hijacked by scammers. The telco will implement 2FA by sending a one-time SMS code to a customer’s phone number or email. 

2FA is the most common form of MFA. It’s more secure than logging in using a simple (easily stolen or hacked) password because it communicates with an account or device already associated with a user’s identity. 

However, some have argued that SMS codes aren’t the strongest 2FA choice to break the cycle of fraudulent phone porting. Australian Communications Consumer Action Network chief executive Teresa Corbin told [_The Guardian_](https://www.theguardian.com/money/2020/feb/28/acma-announces-new-rules-on-porting-mobile-numbers-to-tackle-identity), “We’d like to see the Acma require telcos to use highly secure forms of verification, such as hardware or software authentication tokens, which are generated with a mobile app.”

There may not be a perfect consensus on Acma’s solution, but no one denies that Australia’s specific focus on phone porting comes in response to a real security need. [According to Paul Fletcher](https://www.news.com.au/technology/consumer-issues/twofactor-authentication-to-be-made-mandatory-for-mobile-phone-number-transfers/news-story/845224336b099726f6a7410461ff8143), Australia’s Minister for Communications, Cyber Safety and the Arts, scammers steal the identities of thousands of Australians yearly through fraudulent porting, costing an average of AUS$10,000 per victim.

<include src="TweetQuote" quoteText="Find out why @acmadotgov’s 2FA requirement for all telcos to implement two-factor authentication (2FA) when customers transfer their phone numbers between providers is a global forerunner."/>

These attacks are often very targeted (unlike ransomware) in order to steal money by gaining access to financial accounts or bitcoin wallets. They are also used to target high-value people at companies (think admins) to access highly valuable resources. In 2018, [Reddit was breached](https://www.wired.com/story/reddit-hacked-thanks-to-woefully-insecure-two-factor-setup/) in one of these “SIM swapping” attacks, which prompted them to stop using SMS authentication in favor of token-based 2FA. 

The biggest players in Australia's telecommunications industry (Telstra, Optus, and Vodafone) already require pre-port authentication, but the government believes smaller service providers also need to implement the requirement or risk attracting scammers to their networks. Those network providers will have until April 2020 to achieve compliance with the regulation.

## Why Australia Is Getting Aggressive on Cybersecurity
Passing mandatory 2FA for telco is just one part of the Australian government’s broader effort to tighten cybersecurity. Last year, the government instituted the [Notifiable Data Breach](https://www.wired.com/story/reddit-hacked-thanks-to-woefully-insecure-two-factor-setup/) (NBD) program, requiring companies to notify individuals when their data has been compromised. Australia’s government is in the midst of overhauling its 2016 cybersecurity strategy, and MFA authentication was one of the “[Essential Eight](https://www.bit.com.au/guide/your-guide-to-the-essential-eight-security-strategies-451152)” security steps recommended by the Australian Signals Directorate in 2017.

While the telco 2FA regulation is highly targeted at phone porting, it’s still an indicator that Australia's federal government is willing to legislate 2FA in the name of consumer protection. This initial rule could be part of a regulatory framework that may spread to other industries. According to [ZDNet](https://www.zdnet.com/article/australian-government-introduces-new-telco-regulations-to-fight-phone-scams/), “the government believes there are still one million services that are yet to have these consumer safeguards implemented,” and these service providers may be under the microscope next.

However, the Australian government is clearly still weighing how forcefully to regulate businesses. The 2FA requirement is the first piece of policy to come out of Australia's [Scam Technology Project](https://www.acma.gov.au/theACMA/scam-technology-project), a partnership between industry and the government.

In September 2019, the government circulated a public survey soliciting input on the appropriate balance between industry self-regulation versus governmental intervention on matters of cybersecurity. The [survey](https://www.homeaffairs.gov.au/reports-and-pubs/files/cyber-security-strategy-2020-discussion-paper.pdf) asks, among other things: “Do you agree with our understanding of who is responsible for managing cyber risks in the economy?” and “Do you think the way these responsibilities are currently allocated is right? What changes should we consider?”

<include src="TweetQuote" quoteText="@acmadotgov’s 2FA requirement will provide better protection for people switching telco providers. Discover why it could pave the way for additional global MFA adoption."/>

### MFA Is Becoming a Global Standard
While Australia’s law is a pioneer in specifically mandating 2FA for phone porting, MFA is increasingly required to do business with private corporations and certain government agencies and in order to be compliant with broader data privacy laws.

In June 2019, [Microsoft announced](https://krebsonsecurity.com/2019/06/microsoft-to-require-multi-factor-authentication-for-cloud-solution-providers/) that all of its Cloud Solution Providers (CSPs) had to use MFA. In the United States, [the IRS requires](https://www.irs.gov/privacy-disclosure/multi-factor-authentication-implementation) that any federal, state or local employee accessing IRS data remotely must use MFA.

While the EU’s [General Data Privacy Regulation (GDPR)](https://auth0.com/docs/compliance/gdpr/features-aiding-compliance/protect-user-data) doesn’t specifically stipulate that businesses must implement MFA, it does require “appropriate security measures” to protect personal data, and it holds businesses liable for any breach. Because MFA is among the strongest safeguards available to protect data, GDPR compliance practically makes it a necessity. The European Union Agency for Cybersecurity (ENISA) published a [list of guidelines](https://www.enclave.ie/blog/multi-factor-authentication-is-recommended-by-the-european-union-agency-for-network-information-security-for-gdpr.508.html) when GDPR became law. In it, they specifically advised that any system handling personal data use 2FA.

In addition, the EU mandates [Strong Customer Authentication (SCA)](https://ec.europa.eu/info/publications/190913-safer-payment-services_en) for payment service providers, requiring that electronic payments user MFA.

The private sector is quickly recognizing that instituting MFA is critical to protecting data against breaches and staying compliant with data privacy laws. According to [Global Industry Analysts'](https://www.reportlinker.com/p03329771/Global-Multi-Factor-Authentication-MFA-Industry.html?utm_source=GNW) October 2019 report, the 2FA market worldwide is predicted to grow to US$12.1 billion by 2025, with potential growth of 14.3%.

Historically, many businesses have shied away from implementing MFA. For example, a [2018 Experian report](https://www.experian.com/assets/decision-analytics/reports/global-fraud-report-2018.pdf) found that only 44% of eCommerce businesses implemented MFA, out of concern that any demand for credentials would be a source of friction that might alienate customers and hurt profits.

However, with each new regulation that requires (and therefore normalizes) MFA, the perceived level of friction decreases. In other words, customers are becoming more accustomed to encountering MFA whenever they conduct sensitive transactions, so no individual business that implements it needs to worry about presenting an undue burden on the end-user.

That isn’t to say that businesses (in Australia or otherwise) shouldn’t be thinking about implementing MFA in order to ensure a seamless customer experience. Not every login attempt should require users to get a one-time code; [step-up authentication and adaptive authentication](https://auth0.com/blog/what-is-step-up-authentication-when-to-use-it/) tailor MFA requests based on risk.

Furthermore, a good MFA solution is designed to prioritize UX by completing authentication requests in as few steps as possible. Auth0’s [Guardian MFA](https://auth0.com/multifactor-authentication), for instance, lets users authenticate through a simple push notification on their phones.

![Multifactor Authentication Dashboard](https://images.ctfassets.net/23aumh6u8s0i/76dOMSouGVa1RG4sZHWMIl/fb3c361a75713719bef1665bc9ba185d/mfa-dashboard-1)

## Auth0 Can Ease the Journey to MFA
The legal requirements, customer expectations, and technological capabilities around MFA are evolving rapidly. Australia’s 2FA requirement for phone porting is just one sign that the prevailing winds are pushing industries toward more secure authentication solutions. In light of this, businesses who have avoided implementing MFA should take this opportunity to reconsider their stance.

Aside from any regulatory mandate, MFA is no longer an inherent source of friction for customers. When you outsource this capability to an authentication partner like Auth0, you can reap the benefits of MFA solutions that are secure and compliant and are as easy on your customers as possible.

For a deeper dive into MFA and the potential implications for your business, please check out our whitepaper [When is MFA the right choice](https://info.auth0.com/contact.html?utm_source=blog&utm_campaign=2020-03-aus-mandates-2fa)? 


Australia Mandates Two-Factor Authentication for Telcos

eugenio-pace-new-avatar

Pace co-founded Auth0 in early 2013 with CTO and “brother-in-arms” Matias Woloski while living 7,000 miles apart from each other. Since then, Pace has played an instrumental role in growing Auth0 into a leading identity management company that is loved by developers and trusted by global enterprises. He loves traveling and has visited more than 35 countries for business and pleasure. He currently lives in Redmond, Washington with his wife, two sons, and their labrador retriever. In his spare time, he enjoys the outdoors, rowing, riding bikes, spending time with his family, restoring his 1970 Karmann Ghia, writing his blog, and reading history and philosophy.

CEO and Co-Founder

Eugenio Pace

Deploy SSO and MFA to tackle the challenges being faced by millions of remote employees


  <div class="alert alert-info alert-icon">
  <i class="icon-budicon-500"></i>
  <strong>Make remote work safer and easier today — <a href="https://auth0.com/pricing/">click here</a> to get started.</strong></div>


As many organizations are discovering, remote working does not just mean providing employees with a laptop and expecting business to continue as usual. Instead, organizations are being confronted with new challenges - everything from Zoom etiquette (yes, your colleagues can tell you are reading Twitter) to their employees doubling as stand-in math teachers.  

An important challenge facing organizations now is authentication and authorization. Auth0 knows what it’s like to support a handful, all the way to hundreds, of remote workers. Having the capability and tools to verify that only the right employees are logging on is essential for improving everything from productivity to security. 

![Auth0 offers free workforce authentication](https://images.ctfassets.net/23aumh6u8s0i/1XCJWYdlEpVtx6HwzMCVtb/0374d37fe78ead6932a9d418aad0d3fa/value-transparency)

In addition to the recently announced [free tools for startups battling COVID-19](https://auth0.com/blog/auth0-startup-relief-helping-innovators-battle-covid-19/), Auth0 is doing more to help organizations reduce the stress of authentication and authorization of remote workers by offering internal employee authentication **free until August 31st** (up to 500 users).

As long as your admin email domain is the same as your employee domain, you can set up secure, remote logins for your employees and organization. We’ve got a simple and extensible ID Platform that can be adopted easily [in hours, not weeks](https://auth0.com/docs/protocols/saml/saml-configuration/auth0-as-identity-provider), making it suitable for _your_ workforce and _its_ requirements. As part of this free offer, businesses can take advantage of the following features:

* [Single Sign-On](https://auth0.com/single-sign-on) for ease and productivity
* [Multi-factor authentication](https://auth0.com/multifactor-authentication) for peace of mind
* [Connection to most identity providers](https://auth0.com/docs/connections/identity-providers-enterprise) for flexibility
<br>
<br>
<span style="color:#EB5424;"><a href="https://auth0.com/pricing/">Find out more here about how to get started today</a></span>

<include src="asides/AboutAuth0" />


Auth0 Makes Workforce Authentication Free Through August 2020

MFA adoption urged to fight e-commerce fraud


Fraudulent purchases and data breaches are an incredibly costly problem for online retailers, and they are on the rise. A [ThreatMetrix report](https://www.signifyd.com/blog/2018/06/26/ecommerce-fraud-grow-threatmetrix/) found that in the first quarter of 2018, the growth of e-commerce fraud attempts outpaced the growth of overall e-commerce transactions by 83%.

According to the latest data from [IBM](https://digitalguardian.com/blog/whats-cost-data-breach-2019), the average cost of a data breach is currently $150 per compromised record, and the costs of data breaches will only increase with the passage of new privacy legislation.

For business leaders concerned about protecting profits and customer data from attacks the National Institute of Standards and Technology’s (NIST) [recent guidance for e-commerce businesses](https://www.nccoe.nist.gov/projects/use-cases/multifactor-authentication-ecommerce) to implement multi-factor authentication (MFA) can offer some relief.

<include src="TweetQuote" quoteText="According to the latest data from IBM, the average cost of a data breach is currently $150 per compromised record"/>

When deployed properly, MFA is one of the strongest defenses against fraudulent purchases and administrative data breaches, yet e-commerce has been [slow to adopt it](https://www.experian.com/assets/decision-analytics/reports/global-fraud-report-2018.pdf). [Experian’s research](https://www.experian.com/assets/decision-analytics/reports/global-fraud-report-2018.pdf) found that only 44% of businesses currently employ MFA, which they attribute to concerns about it negatively impacting customer experience.

Yet modern MFA solutions allow businesses to balance [security and convenience](https://auth0.com/blog/security-vs-convenience/). The NIST’s guidelines offer actionable advice for e-commerce to catch up to current security standards and what to look for when embracing MFA.

In this piece, we’ll go over what MFA is, how the NIST defines sound MFA solutions, and how e-commerce businesses can effectively implement MFA while balancing their other business needs.

## MFA in a Nutshell

In the simplest terms, [MFA](https://auth0.com/learn/get-started-with-mfa/) is a protocol for determining if individuals using your system are who they claim to be. MFA demands more than one (usually two) types of credentials:

* Something someone knows (like a password or their mother’s maiden name)
* Something they have (such as a phone on which they can receive a one-time SMS code)
* Something they are (biometric ID such as a fingerprint or facial scan)

![Multi-Factor Authentication Auth0](https://images.ctfassets.net/23aumh6u8s0i/4VTHSpJTsDhLuAyznJK2BE/27185cb5d398e5f1dc609141c781d57b/mfa-auth0)

A business using MFA can request additional verification at any point in a user’s session: login, purchase, or when navigating within a site or app.

Developers generally consider MFA to be the safest form of authentication, but there are a wide variety of MFA solutions available, and [they are not all created equally](https://auth0.com/blog/is-multifactor-authentication-the-best-way-to-secure-your-accounts-myths-and-reality/).

Finally, while most of us are familiar with MFA from our own online shopping experiences, it isn’t just for end users. The NIST emphasizes that requiring MFA for e-commerce admins is crucial for preventing data breaches rising from admin phishing attacks.

## Why E-Commerce Needs MFA

The continually-evolving digital threat landscape makes e-commerce businesses particularly vulnerable. As the NIST’s guide explains, 2015 saw the introduction of security improvements to credit cards and in-store terminals. These improvements reduced traditional credit card fraud but had the unintended effect of pushing more theft online.

E-commerce businesses are vulnerable to several types of attack, including [brute force attacks](https://www.scmagazineuk.com/brute-force-dictionary-attacks-400-percent-2017/article/1473168), [phishing](https://www.vadesecure.com/en/ecommerce-security-issues/), and [credential stuffing](https://auth0.com/blog/credential-stuffing-is-a-persistent-threat-to-your-users/), which the NIST gives particular focus to in its guidelines.

In credential stuffing, user IDs and passwords stolen from one site are used to log in to another, preying on the tendency of users to recycle the same few passwords. Credential stuffing is arguably the [most dangerous and prevalent](https://blog.barracuda.com/2019/04/02/is-2019-the-year-credential-stuffing-dominates-the-threat-landscape/) security threat of 2019. An [Akamai report](https://www.akamai.com/us/en/multimedia/documents/state-of-the-internet/state-of-the-internet-security-retail-attacks-and-api-traffic-report-2019.pdf) found that retail was the single most vulnerable vertical for this attack, with over 10 billion credential abuse attempts in 2018.

<include src="TweetQuote" quoteText="Developers generally consider MFA to be the safest form of authentication"/>

Credential stuffing is difficult to combat, and will likely worsen as hackers develop more sophisticated bots that can combine data from multiple breaches in their attacks. Successful credential stuffing can lead to account takeover. For customers, account takeovers can result in fraudulent purchases being shipped to strangers.

For admins, they can lead to even [more serious data breaches](https://www.zdnet.com/article/anatomy-of-the-target-data-breach-missed-opportunities-and-lessons-learned/).

So how do you know if your current authentication system is at risk for these types of breaches? NIST lists the following common traits of vulnerable systems:

* Allow multiple incorrect logins without account lockouts
* Purchasers have reused the same password on multiple systems
* Accept weak passwords

If any of those describe your company’s authentication system, implementing MFA can quickly patch those leaks to project you and your customers while you strengthen your identity solution.

## What Makes a Good E-Commerce MFA Solution

MFA is open-source technology, but there’s a great deal of variance between implementation methods. NIST specifies a few “must-haves” for MFA solutions to protect your business effectively.

* **Customization**: Not every transaction should require additional authentication, so a good MFA solution allows you to tailor your system to your needs. NIST lists the most common parameters to trigger verification as cost threshold (a purchase above a certain dollar amount) and risk threshold. You can customize your definition of risk any number of ways, such as a customer using a new shipping address, paying with a new card, buying an item commonly associated with fraud, or making a purchase at an unusual time of day.
* **Require MFA for admin tasks**: A criminal with fraudulent admin credentials can do incalculable damage to your business, so NIST recommends that any administration activity requires verification.
* **Dashboards for suspicious activity**: The NIST report specifically mentions that e-commerce businesses should “enable system-activity situational awareness by providing dashboards that display account lockout and authentication activity.” Auth0’s dashboard does just this: giving you a high-level look at your users, allowing your admins to spot patterns and being aware of new threats as they evolve.

![Auth0 Dashboard](https://images.ctfassets.net/23aumh6u8s0i/7sbXQ9SWpmPS7HuKh9pGhE/427d1c43629461957d5c506e8e9e535d/auth0-dashboard)

Auth0 also offers [breached password protection](https://auth0.com/docs/anomaly-detection), which tracks security breaches at third-party sites and flags potentially stolen credentials. Taken together, these features are a proactive way for e-commerce teams to detect and prevent fraudulent transactions.

## How an IDaaS Partner Manages Your MFA Needs

Many e-commerce executives have been slow to push for MFA because they feared alienating customers with irritating demands for credentials. However, online shoppers are increasingly reassured rather than irritated by such measures.

In [Experian’s 2018 Global Fraud and Identity Report](https://www.experian.com/assets/decision-analytics/reports/global-fraud-report-2018.pdf), 66% of surveyed customers reported that they “like all the security protocols when I interact online because it makes me feel protected." Yet customer tolerance isn’t infinite, and in the same survey, a third of customers reported that security demands caused them to make fewer online purchases.

E-commerce businesses have to find an MFA solution that provides both effective fraud prevention and positive user experiences. By partnering with an identity management platform like Auth0, you can reap the benefits of increased security without taxing your developers or frustrating your customers.

* **Balance of ease and customizability**: Auth0’s MFA solutions can be turned on by flipping a single toggle, so you don’t have to wait weeks or months for your developers to secure your system. However, Auth0 also gives your team the freedom to write customized rules for MFA around any of the parameters discussed above.
* **Reduced friction for users**: Auth0’s MFA lets developers choose which factors for authentication suit their needs, whether that’s SMS, a token generator app, or Guardian, which lets users authenticate via a push notification.This allows users to utilize the MFA method they want while maintaining proper security practices.

![Multi-Factor Authentication Auth0](https://images.ctfassets.net/23aumh6u8s0i/4VTHSpJTsDhLuAyznJK2BE/27185cb5d398e5f1dc609141c781d57b/mfa-auth0)

Guardian doesn’t require your customers to install an app or even have a smartphone, so it’s a truly universal solution that meets both security and UX needs.

* **Evolves with and for you**: Keeping on top of current security standards can be a full-time job. But it’s not your full-time job, so outsourcing MFA to a highly respected and [accredited IDaaS partner](https://auth0.com/blog/the-real-roi-of-auth0-part-3-security/) like Auth0 can provide peace of mind to your customers and yourself.

## NIST Guidance Can Offer Immediate Protection

Though NIST’s guidelines are voluntary suggestions, their very existence points to the urgent need for MFA adoption to protect online shopping as a whole. As the guide says: “fraud impacts the e-commerce ecosystem by decreasing purchaser confidence...and by increasing costs to offset the e-commerce fraud.”

Business leaders are under pressure to protect their customers from identity-based attacks without sacrificing revenue through excessive security measures. Finding this balance requires expert help, so reach out to an [Auth0 resource](mailto: sales@auth0.com) to talk about how you can put NIST advice into practice.

<include src="asides/AboutAuth0" />

---


Why NIST Recommends MFA to Fight E-Commerce Fraud

andrew-akers

I'm a product marketing manager who loves learning about technology, information security, and identity. My goal is to turn that knowledge into positive outcomes for our customers. Before Auth0, I was a product marketing manager at Cisco in the network security division. In my spare time, you can find me spending time with my family, reading, writing, and working on endless home improvement projects.

Product Marketing Manager

Andrew Akers

Email MFA powered by Universal Login is here to help you improve your user's experience.


Ever try to log into an application with multi-factor authentication, only to realize that your phone was dead? It is incredibly frustrating to realize you either need to find a phone charger or dig up your MFA recovery code just to check your email.

The problem is even worse for the app owner. When a user can't log in, they can't interact with your app. This can result in lower adoption, engagement, and money, especially for consumer-facing applications.

[With the latest release of Universal Login](https://auth0.com/blog/introducing-the-new-auth0-universal-login-experience/), Auth0 can solve this problem with email as a backup MFA factor.

<script src="https://fast.wistia.com/embed/medias/kfdckzkaiu.jsonp" async></script><script src="https://fast.wistia.com/assets/external/E-v1.js" async></script><div class="wistia_responsive_padding" style="padding:92.5% 0 0 0;position:relative;"><div class="wistia_responsive_wrapper" style="height:100%;left:0;position:absolute;top:0;width:100%;"><div class="wistia_embed wistia_async_kfdckzkaiu videoFoam=true" style="height:100%;position:relative;width:100%">&nbsp;</div></div></div>
<br>
## How Does it Work?

When a user tries to authenticate and is prompted for MFA, they can click try another method and select Email. Auth0 will then send an email to the user's verified email address with a one-time password, which they can use to authenticate.

There are a few prerequisites for email MFA:

-   The app must be using Auth0's [New Universal Login experience](https://auth0.com/docs/universal-login/new)

-   Email must be enabled in the Auth0 [management dashboard or via the management API](https://auth0.com/docs/multifactor-authentication/api/email)

-   The user's email address must be verified

-   The user must have some other method of MFA enabled

![Auth0 Management Dashboard showing Email MFA enabled](https://images.ctfassets.net/23aumh6u8s0i/5JBvrPGUYW7qfri402dz7p/dfcbc655b59756dfb2f6dbf54f041cca/jgwxzr97i321lfas4aav)

## What about Email as the Only MFA Factor?

Currently, email MFA is only available as an optional backup multi-factor method. The user must have another method as the primary form of multi-factor authentication. Enabling email MFA as a standalone multi-factor method is on the Auth0 roadmap.

## How Do I Get Started?

To try email MFA with the New Universal Login experience out, sign up for Auth0 for free and click on Multifactor Auth in the management dashboard. [Follow these instructions for enabling Email MFA.](https://auth0.com/docs/multifactor-authentication/api/email)

<include src="asides/AboutAuth0" />


No Phone? No Problem! Email MFA Is Here

Despite its flaws, SMS multi-factor is an easy way to improve security for a large user base.


Journalists and InfoSec practitioners have [cautioned for years against using short message service (SMS) text messaging for multi-factor authentication (MFA)](https://www.wired.com/2016/06/hey-stop-using-texts-two-factor-authentication/). They're not without reason -- SMS authentication has [well-documented shortcomings](https://krebsonsecurity.com/2018/08/reddit-breach-highlights-limits-of-sms-based-authentication/) -- but it is important to note that for many organizations, it is the only practical way to encourage MFA use among a large user base. And SMS MFA is certainly far better than no MFA at all.

<include src="TweetQuote" quoteText="SMS multi-factor gets a lot of criticism, but it is still an important security tool for large user bases. Learn why."/>

For context, MFA adoption is notoriously low. For example,[less than 10 percent of Gmail users enable two-factor authentication.](https://www.theregister.co.uk/2018/01/17/no_one_uses_two_factor_authentication/) Most organizations understand that they should implement MFA wherever possible, but it can become a logistical nightmare. If you force MFA on your customer base, it makes registration difficult and can reduce adoption. You could also force MFA on your employees, but that can also lead to difficulties because it requires the user to set it up on their phone or email, and some won't be able to do so without IT assistance.

MFA is by design more complex than a simple username-password login. However, SMS-based MFA can help reduce complexity since most people are familiar with text messaging and it doesn't require the user to download and set up an additional app. But it does come with some security tradeoffs. This blog post will outline the various pros and cons of SMS-based MFA.

![SMS Multi-factor Authentication](https://images.ctfassets.net/23aumh6u8s0i/12yhYWiO51ZE215JLY7AgY/44c2580ecd744253e176ca19ebd336d9/tfa-sms)

## The problem with SMS authentication

A great example of the problems with SMS-based authentication is the[  August 2018 breach at Reddit.](https://www.reddit.com/r/announcements/comments/93qnm5/we_had_a_security_incident_heres_what_you_need_to/) An attacker managed to compromise a few Reddit employee accounts with the company's cloud and source code hosting services even though those employees had SMS MFA setup. While Reddit didn't disclose the exact nature of the attack --- it did say the employees' phones were not compromised --- there are a few well-known methods to attack SMS.

The first is a[ subscriber identity module (SIM) swap scam](https://en.wikipedia.org/wiki/SIM_swap_scam). Telephone carriers can swap a phone's service to a new SIM card if a customer loses or damages their phone. In this attack, the perpetrator uses social engineering to convince the target's telephone carrier to switch service to a new SIM card that the attacker controls. Once this happens, all phone calls and text messaging --- including SMS MFA codes --- will be sent to the attacker's SIM card.

Another similar attack involves an attacker [impersonating the customer and requesting service be transferred to another carrier.](https://krebsonsecurity.com/2018/02/how-to-fight-mobile-number-port-out-scams/) The attacker then sets up service with the new carrier. The end goal is the same as the SIM swap scam --- mobile phone service is transferred to the attacker-controlled phone, which can then receive SMS MFA codes.

There are several other types of SMS intercept attacks, [such as targeting the global telephony protocol Signaling System 7](https://www.wired.com/2017/05/fix-ss7-two-factor-authentication-bank-accounts/), and they may vary somewhat based on geography and what cell phone carriers are being targeted. However, the majority of these attacks require the perpetrator to devote a significant amount of time or resources, which means it is only cost-effective for high-value targets. In other words, it might be worth it for a criminal to target an administrator, who has access to highly valuable materials, but it probably isn't worth it to target a regular user with limited access to valuable data.

## Why SMS MFA is still good

It's easy.

Place yourself in the shoes of someone who isn't tech savvy but still wants to use your application or work for your company. With app-based MFA, users have to download an app and scan a barcode or enter a code. That may sound easy, but users sometime do wonky things like not allowing the app access to the phone's camera, preventing them from scanning the barcode. This can lead to customer churn or an increase in support tickets.

However, nearly all users understand how to use text messaging, making setting up SMS-based MFA far simpler. While it isn't as secure as app- or token-based MFA, it is much more secure than a single-factor username-password login. It is a great tool for encouraging MFA adoption.

That said, a strong security strategy should take into account your high-value users and assets and enforce more stringent access control policies on them. In other words, it is fine for a normal user account with limited access to use SMS MFA, but maybe your administrators and other high-value employees should use a stronger factor, such as a hardware-based MFA device like [Yubikey.](https://www.yubico.com/)

![Hardware Authentication Security Keys (Yubico Yubikey 4 and Feitian MultiPass FIDO)](https://images.ctfassets.net/23aumh6u8s0i/2NZYvu4WCQehcbPHPAg5HY/08d5545cfda9f95a4639c386a1fc918b/mfa-device-yubikey.png)

## In short

[Well-known cybersecurity expert and practitioner Kevin Beaumont, said it best](https://doublepulsar.com/infosecs-fantastic-fear-of-everything-why-the-reddit-incident-shouldn-t-cause-infosec-to-throw-4bb3b7ea634f):

Compared to just requiring a username and password, [SMS MFA] is a significant leap in security posture.

It isn't perfect.

It shouldn't protect all the world's IT systems and every user.

It might well help protect your organization.

SMS MFA has its flaws, but it is still a great tool for organizations that want to offer a quick and easy way to set up MFA. However, a strong security strategy should identify high-value users who have a lot of access and required them to use more stringent authentication, such as app-based or hardware-based MFA.

<include src="TweetQuote" quoteText="SMS multi-factor has its flaws, but it is still a great tool for organizations that want to offer a quick and easy way to set up MFA. Learn more about the pros and cons of SMS MFA."/>

Auth0 can enable a variety of types of multifactor authentication, including SMS- and app-based authentication. Learn more [here.](https://auth0.com/multifactor-authentication)


SMS Intercept Attacks and Why SMS Multi-Factor Still Matters

Implement MFA, store minimal information, and take employee cybersecurity training seriously to minimize data breach risk.


The holiday season is the biggest shopping time of the year, and for that reason, it's also the most popular time of year for cybercriminals. 

If you’re a [retailer](https://auth0.com/retail), it's on you to ensure that your customers' data is safe. [Data breaches](https://auth0.com/blog/what-is-a-data-breach/) hurt your customers and they hurt your reputation. 

With this post, we show retail teams how Auth0 can help them keep customers safe with three actionable tactics. 

While these strategies are critical during the holidays, they're also highly applicable throughout the year. Teams that take security seriously are those that will safely scale and thrive in 2019 and beyond.

## 1. Implement Multi-Factor Authentication

With data breaches of retailers on the upswing in 2018 — including ones at [Macy's](http://fortune.com/2018/07/11/macys-data-breach/)  and [Adidas](https://www.newsweek.com/adidas-breach-hack-us-website-customers-warned-their-data-has-been-hacked-1000974) — teams clearly need extra support. [Multi-factor authentication (MFA)](https://auth0.com/docs/multifactor-authentication) delivers this. Implementing it correctly can make a huge difference in how secure your customers’ accounts are. 

MFA ensures that even if a data breach does occur and passwords are leaked, hackers still can't get into customer accounts. To do so, they need a second piece of sensitive information, like a customer's thumbprint, facial features, or mobile device.

With [Auth0 Guardian](https://auth0.com/multifactor-authentication), you can add MFA to your site simply and securely.

![Multifactor Authentication (MFA) with Auth0 Guardian](https://images.ctfassets.net/23aumh6u8s0i/4x4BhKDZLXWTlScCGVZ5B6/a53550e45f8a7d895b8ac2ae251c5a6d/multifactor-authentication-with-auth0-guardian.png))

After [installation](https://auth0.com/docs/multifactor-authentication/factors/push), retailers can easily switch on MFA push notifications. For your employees, it is a quick double-check that they are who they say they are (and that they can access sensitive customer data for work purposes). For your customers with the Guardian app, they receive a QR code on their device that they can scan before accessing their account. It's one more protective barrier to be sure they're not a hacker with the customer's credentials.  

With more than 80% of passwords having [inherent vulnerabilities](https://www.troyhunt.com/86-of-passwords-are-terrible-and-other-statistics/), MFA is a critical investment to seal your customer data from unwanted eyes during times of high activity.

## 2. Only store the data and information you need

Storing only essential customer data means that if someone does get into your system, there’s less to exploit. This is a key component of complying with the EU's [General Data Protection Regulation (GDPR)](https://auth0.com/gdpr). Some teams think that adhering to GDPR's strict standards is primarily to avoid hefty fines (the greater of €20 million or 4% of the global annual revenue); however, the standards are a must for protecting end users’ data and the integrity of your company.

If a cybercriminal does gain access to a company's confidential customer information, they can make off with:

* names
* email addresses
* mailing addresses
* phone numbers
* customer device information
* financial data
* personal details like age, race, and religion

[When hackers got into Under Armour's system](https://www.cnbc.com/2018/03/29/under-armour-stock-falls-after-company-admits-data-breach.html) this year, they were able to access many customers' hashed passwords. Since studies show that people tend to [recycle their passwords](https://securityboulevard.com/2018/05/59-of-people-use-the-same-password-everywhere-poll-finds/), hackers have the ability to take these and access even more personal data in other accounts. The damage can quickly spiral out of control.

Storing less data can make you less of a target. You can also separate data, depending on how confidential it is. With [Auth0's user management solutions](https://auth0.com/user-management), you can restrict access to specific data sets for only the most privileged employees.

## 3. Train employees in the importance of cybersecurity

Training employees in the importance of data security is an often overlooked—but essential—pillar of protecting your customers’ data. Taking the time to bring them up to speed on the latest cybersecurity concerns early in their [onboarding process](https://www.intercom.com/blog/onboarding-focus-culture/) can help ensure that when the holidays roll around, they're on high alert.

When employees are aware of common hacks such as malware infiltration and phishing, they'll be able to recognize threats as they arise. And when they understand the reasons behind provisions such as automatic updates and multi-factor authentication, it’s easier to get their buy-in. 

Our blog has many pieces you can use to help communicate security issues to your employees. Here are a few to get you started:

* [Four Cybersecurity Attacks Your Employees Need to Know](https://auth0.com/blog/four-cybersecurity-attacks-you-need-to-know/)
* [What is a Data Breach?](https://auth0.com/blog/what-is-a-data-breach/)
* [What is Data Security?](https://auth0.com/blog/what-is-data-security/)

You also might want to bring in experts for cybersecurity training sessions. While Auth0 doesn't offer these specifically, here are a few we recommend:

* *InfoSec Institute's [Security Awareness & Anti-Phishing Training](https://www.infosecinstitute.com/securityiq/).* The program includes more than 1,000 phishing simulations, along with tailored learner assessments, to bring employees up to speed.
* *[The SANS Institute](https://www.sans.org/about/)*. This non-profit was established in 1989 and now collaborates with 165,000 security professionals worldwide. Offers many private trainings to upskill existing IT team members.
* *Inspired eLearning. *These efficient modules even include [security awareness training programs for executives](https://inspiredelearning.com/security-awareness/awareness-c-suite/). 

Sometimes education isn't enough. If you do suffer a system breach, Auth0 can quickly step in to protect your customers with tools like [anomaly detection](https://auth0.com/docs/anomaly-detection) and [breached password detection](https://auth0.com/docs/anomaly-detection/breached-passwords). In the first instance, in the Auth0 dashboard, an admin will receive a notification of a strange behavior like multiple failed login attempts and can quickly block the user while researching the issue further. 

In the second case, Auth0's security team will work to keep a retailer informed if any of its customers' passwords match with those in our database of leaked passwords (which we update daily). If we see a match, we can work with a retailer's IT team to block the potential impersonator from getting further into the system.

### Take advantage of what the season has to offer.

Holidays are the most important time of the year for retailers. It's when most retail teams make the majority of their sales, and missing out due to a security breach can set you back several quarters or years from hitting your targets. It’s more important than ever to keep your customer data safe so they continue to trust and work with you.

It’s never too late – or too early – to start thinking about the best ways to do so. Auth0 would love to help. [Reach out](https://auth0.com/) at any time, and we'll be glad to set you up.

<include src="asides/AboutAuth0" />


3 Ways Auth0 Can Help Retailers Protect Customer Data During the Holidays

duncan-godfrey

Duncan is a security, engineering, and business leader. His background is in security engineering and, in particular, cloud security.

Sr. Director of Security and Compliance

Duncan Godfrey

How Breached Password Detection and MFA Can Help Ward Off the Millions of Attempts Botnets Make Each Month



**TL;DR:** Credential stuffing can threaten user accounts and service availability. Security expert Duncan Godfrey shows how Auth0 defends customers with breached password protection.

Anyone operating a web application which authenticates users will know credential stuffing attacks all too well. It’s a constant hum of bots knocking on your infrastructure trying to take over user accounts. [_OWASP_](https://www.owasp.org/index.php/Credential_stuffing) defines it as _"the automated injection of breached username/password pairs in order to fraudulently gain access to user accounts."_

Credential stuffing is an efficient type of brute force attack which uses the vast amount of available breached user credentials to exploit the still all too often story of users reusing their passwords across different services.

The most recent [_Akamai State of the Internet Report_](https://www.akamai.com/us/en/about/our-thinking/state-of-the-internet-report/global-state-of-the-internet-security-ddos-attack-reports.jsp) focuses on credential stuffing and gives some insight into the scale of the problem — between May to June 2018 they recorded 8.35 million credential stuffing attempts. It brings into focus the dire state of using passwords as a single authentication factor in 2018. As Auth0 handles authentication for our customers, we find ourselves at the epicenter of these kinds of attacks.

<include src="TweetQuote" quoteText="@akamai_soti reported 8.35M credential stuffing reports in a single month. Security expert @duncangodfrey shares how to protect your customers with the help of @auth0."/>

On particularly busy days at Auth0, we will detect up to 600K logins being made with known breached passwords. The attacks are not always random and are often targeted against companies whose customers resources can be drained or where access to the account itself can be sold (i.e. it gives access to premium content).

## Defending Credential Stuffing with Breached Password Detection

In response to the growth of credential stuffing attacks, we developed the [_breached password detection_](https://auth0.com/breached-passwords) service to help our customers defend their users. Once enabled, the service will monitor for logins using known compromised credentials and can be set to lock out that user until they have reset their password.

<AmpContent>
<amp-video controls
  layout="responsive"
  width="480" height="270">
  <source src="https://embed-ssl.wistia.com/deliveries/2c40154d519f5fb3713c1f64f80f20625c89ba3e/breached-video.mp4"
    type="video/webm" />
</amp-video>

</AmpContent>

<NonAmpContent>

<video controls="controls">
  <source src="https://embed-ssl.wistia.com/deliveries/2c40154d519f5fb3713c1f64f80f20625c89ba3e/breached-video.mp4">
   Your browser doesn't support HTML5 video. Here is a <a href="https://embed-ssl.wistia.com/deliveries/2c40154d519f5fb3713c1f64f80f20625c89ba3e/breached-video.mp4"> breached password detection</a> instead.
</video>

</NonAmpContent>

The botnets that carry out these attacks not only threaten our customers’ accounts but they are a threat to the availability of our service. An attacker can slowly try the credentials aiming to avoid detection or they can burst attempts using all their capacity to test credentials as quickly as possible. When that happens it is effectively a DDoS attack — so we have to proactively manage our capacity, scaling, and rate limiting to protect our customers and our infrastructure.

![Auth0 Anomaly Detection](https://images.ctfassets.net/23aumh6u8s0i/BScpkuG04n0rMk2kj9s1s/5d8901f8d17cddabd600fcfb50e247d7/Auth0-Anomaly-Detection)

> Auth0 maintains a continuously-updated collection of breached credentials, with hundreds of millions of entries. All password-based login attempts are checked against this database, and any matches are blocked in real-time. [Auth0 offers a **free tier**](https://auth0.com/pricing) to get started with modern authentication. Check it out, or <a href="https://auth0.com/signup" data-amp-replace="CLIENT_ID" data-amp-addparams="anonId=CLIENT_ID(cid-scope-cookie-fallback-name)">sign up for a free Auth0 account here</a>!

## FTC: "Innocent Corporate Victim" No Defense

Credential stuffing is also a developing legal threat to companies who hold sensitive data for their customers. The Federal Trade Commission (FTC) [_recently took action against online tax preparer TaxSlayer_](https://www.ftc.gov/news-events/press-releases/2017/08/operator-online-tax-preparation-service-agrees-settle-ftc-charges) because they were leaving customer data open to credential stuffing, going so far as to state that being an “innocent corporate victim” was no defense in an enforcement case. Rather, in the FTC’s view companies holding sensitive customer information should be taking proactive action to reduce the risk of credential stuffing.

There are things which can be done now to reduce the risk of automated attacks. Firstly, they are not effective against logins protected with [_MFA_](https://auth0.com/docs/multifactor-authentication). Authenticating with two factors should be considered a minimum good practice for protecting your users. The TaxSlayer attack was halted when the company implemented MFA.

Educating your users against reusing their passwords and helping them to improve their password hygiene can help protect your users and your business. Password management apps like [_1Password_](https://1password.com/) or [_lastpass_](https://www.lastpass.com/business-password-manager) make maintaining a unique password for all your accounts more manageable.

<include src="TweetQuote" quoteText="Automated cyber attacks can be overwhelming. Protect your customers with tips from @auth0 security expert @duncangodfrey."/>

The reality is that right now it’s just too simple for attackers. This is an Internet-scale security problem and one which we are working actively with our customers to solve. Auth0 was created to help make managing authentication simple for everyone, and, underpinning that is the desire to make it secure for everyone too.

<include src="asides/AboutAuth0" />


Credential Stuffing is a Persistent Threat to Your Users

71313b369e8f23b7ec7b4614acdf3031?s=200 avatar

71313b369e8f23b7ec7b4614acdf3031?s=200

Staff Security Engineer

Radek Karpowicz

Automation which helps you monitor the multi-factor authentication status of various services.



Imagine a situation where your company hires more and more people and uses a lot of external services. The number of available assets you need to track is always growing. It's hard to keep up with all the services that employees at your company use on a day-to-day basis. Are you sure that you have appropriate security checks in place?

## Proactive protection

Monitoring your assets can be a manual or an automated job. If you implement the right solution, it could give you almost an instant notification when there's a problem. It's often a missing feature on the service provider side to notify you when someone disables MFA protection for one of your organization's accounts.

If you go the manual route, that just creates more routine work. More routine at work (and sometimes in life) doesn't lead to good things. Also, with shifting priorities everyday, it's easy to skip a manual process or even forget about them. Automation is a better solution.

By being more proactive and productive, we mean automation and an appropriate solution to the problem. At Auth0, we want to automate as many things as we can and decrease the number of alerts we receive to get only the real threats and not noise. It gives us the best overview of our infrastructure's security status.

## The MFA Monitoring tool

The [MFA monitor](https://github.com/radekk/webtask-mfa-monitor) uses an API to fetch information about the MFA status for every user under your organization, checks the previous state of MFA, and alerts you when that status changed (enabled or disabled state).

![Slack MFA alert](https://images.ctfassets.net/23aumh6u8s0i/5OJnSCaBGuhks7eZ8ue5RV/3e2fa24f916f501cdce48819cd42b7ff/slack)

Possibilities for implementing additional monitors or notifiers which will receive your alerts are endless as long as there's an API on the provider side. For now, we have implemented checks for GitHub and Amazon Web Services (AWS), we added Slack as a notification provider. If you use Hipchat or Twitter for notifications, you can quickly add them as an additional module. Feel free to send pull requests!

### Implementation

The MFA Monitor was implemented in JavaScript with Node.JS as a target platform. The toolkit consists of two main parts - notification and monitor modules.

#### Monitors

The monitor module was implemented to provide the possibility to inspect the status of MFA settings of different services. You can quickly add new controls as far as the service you want to monitor allows you to fetch MFA status over an API or another channel. What monitor module requires is to receive the status of protection from the external service.

As an example, the GitHub monitor was implemented using publicly available API to fetch information about users assigned to your organization. Requirements could be different for every service as GitHub requires an API token with access to the list of members of your organization. Always remember to choose privileges for access tokens wisely.

The important part of the monitor module is the callback that returns information about all user logins with MFA disabled:

```javascript
  client.orgs.getMembers({
    org: ctx.secrets.ORGANIZATION,
    per_page: 100,
    filter: '2fa_disabled'
  }, (err, res) => {
    if (err) return cb(err);
    if (!res) return cb(new Error('Empty response received from Github API!'));

    cb(null, res.map(data => data.login));
  });
```

#### Notifier

Notifiers are modules that were created to notify users about the security event that occurred on the 3rd party service - it could be information about enabled or disabled MFA on the particular account.

The first module we implemented was Slack, but it doesn't mean you can only use chat applications. It's able to send notifications directly to a URL, Twitter, or even TCP socket; it depends on what you need and want to implement.

To implement notifier modules and secure required tokens you can use secrets that could be stored by the [Webtask](https://webtask.io) platform. After that you can call them using ``ctx.secrets`` prefix.

```javascript
  const slack = require('slack-notify')(ctx.secrets.SLACK_WEBHOOK_URL);
  const mfaStatus = !!ctx.body.mfaStatus;
  slack.onError = (err) => cb(err);

  ctx.body.data.forEach(service => {
    let accounts = service.accounts.map(account => `*${account}*`).join(', ');
    let message  = getMessage(service.name, accounts, mfaStatus);

    slack.send({
      channel: ctx.secrets.SLACK_CHANNEL_NAME,
      username: 'MFA Agent',
      text: message
    });
  });
```

#### Storage

An early version of this tool was using MongoDB as a storage. It generated many additional steps to setup this database. As for the latest release, it's using built-in storage into the Webtask service. In short it means that you don't need to use any external database and worry about the security of your data, now it's safe, encrypted, and stored locally.

```javascript
db.init(ctx.storage);
```

Using the [Webtask storage](https://webtask.io/docs/storage) is easy, to write or read data you need to call methods on the ``ctx.storage`` object. Below is the implementation of the storage wrapper which helps to handle storing and receiving data using Promises.

```javascript
'use strict';

const Promise = require('bluebird').Promise;
let db;

module.exports = {
  init: (storage) =>
    db = storage,

  getStoredData: () =>
    new Promise((resolve, reject) =>
      db.get((err, data) => {
        if (err) return reject(err);
        resolve(data || []);
      })
  ),

  storeData: (data) =>
    new Promise((resolve, reject) =>
      db.set(data, {force: 1}, err => {
        if (err) return reject(err);
        resolve();
      })
  )
};
```

You can easily implement additional storage modules if needed. We wanted to keep it as simple as possible, that's why we decided to use built-in storage which is also the best way to work with the Webtask platform.

### Installation

Setting up the MFA monitoring in place requires creating the Webtask account for free ([https://webtask.io](https://webtask.io)). It's a server-less environment, and it means that you don't need any additional infrastructure to monitor your assets. Fewer assets means less work for you.

![MFA monitor configuration process](https://images.ctfassets.net/23aumh6u8s0i/5a6kFSy2amtxyZ94pFc4cR/7067346475056cac6d9cb16c5eea2aad/mfa)

After creating the Webtask account you need to clone the MFA monitor repository from GitHub, install required npm packages (``npm install``) and you're ready to go. The configuration process is rather straightforward, and it asks you for all necessary data like GitHub token, Slack token, etc.

By default, it installs GitHub monitoring and sends alerts to Slack. In case if you want to modify it, you need to write additional monitors or notifiers. You can find more details on the official repository [README](https://github.com/radekk/webtask-mfa-monitor/blob/master/README.md) file.

### Usage

Once installed MFA monitor shouldn't require any maintenance steps. It's working as a Webtask cron job which means that it runs periodically to pull out the data from your services and checks the status of MFA setting.

You can periodically check the log stream to verify that MFA monitor is working or verify if the status is monitored.

## Awareness

Keep in mind that monitoring the MFA status will not protect you against other malicious activities that could occur. The purpose of this particular tool is to alert you every time your users forget to enable MFA.

<include src="TweetQuote" quoteText="The MFA monitoring tool will alert you every time your users forget to enable MFA."/>


This tool works well for us; it fits into our methodology of being a proactive team. Setup your monitors and start protecting your accounts now.


The MFA monitoring tool

How to improve your app's security with features like MFA, encryption and more with just a few lines of Javascript.



From Ashley Madison to Home Depot to Sony, it feels like every week, there’s a new high-profile security breach where millions of user records with sensitive information gets leaked to hackers.

Fundamentally, this happens because security is hard. Hackers are experts in security, but you probably aren’t, even as an experienced developer. This stacks the deck against you—as you build out your authentication and identity system while you scale, you may not recognize where you’re creating opportunities for the bad guy.

Moreover, security gets de-prioritized on your roadmap because it’s hard to build and isn't immediately urgent.  When you get around to worrying about security, it’s too late—you’ve had a breach and you need to go into damage control mode.

When you finally come out the other side, you need to do a massive overhaul of your systems and company culture to pay off your accumulated “security debt” from years of neglect . . . if you’re lucky and your company still exists.

But the security landscape is changing. With identity-as-a-service providers like Auth0, you’re able to outsource security to experts whose 100% focus day and night is to make sure that your user data is secure. Your IaaS becomes a platform on top of which you can easily layer on additional security services that protects your user data as you grow and scale.

## An App Store for Adding Security to Your App

When you add a new security measure to your homegrown identity system, like multifactor authentication (MFA), you need to wire it up to your code by hand. This can be very time consuming, add considerable code complexity, and leave room for inconsistencies and errors.

With Rules in Auth0, you’re able to add your new security feature—like MFA, encryption and more—with just a few lines of Javascript. The code lives on Auth0, executes in a sandboxed environment there, and runs every time a user logs in. You get a familiar, consistent interface to your user model and that makes it easy to use and creates system-wide reliability.

Adding security services to your app becomes as easy as adding an app to your phone in Apple’s App Store or Google Play.

### How Rules work

Rules in Auth0 are code snippets written in JavaScript that are executed as part of the authentication process. They essentially allow you to extend the Auth0 API with your own customizations, and without having to write any additional code on your end.
![Auth0 Rules](https://images.ctfassets.net/23aumh6u8s0i/6dxCXCkAbtyPK6v3NpPvP5/2bc837b97b27ba3ff4dff7273f1c4bef/auth0-rules)
When a user signs up, logs in, or authenticates in general, an authentication request is made to Auth0 (Step 1). After the user authenticates in step 3, the rules are run on step 4 and the result is passed back to the App.

It’s after the user authenticates, but before we’ve logged in the user that we can add more constraints around login to increase the app’s security. MFA is just one example of this.

 We’re able to take all kinds of contextual data about the user to evaluate whether an additional security measures should be triggered—which goes a long way towards protecting sensitive user data and app integrity.

Here are 5 simple Rules that you can use today to improve your app’s security—and each one shouldn’t take more than 20 minutes to set up.


## 5 Security Rules

### 1. Multifactor Authentication

```
function (user, context, callback) {
  /*
  You can trigger MFA conditionally by checking:
  1. Client ID:
  context.clientID === 'REPLACE_WITH_YOUR_CLIENT_ID'
  2. User metadata:
  user.user_metadata.use_mfa
  */

  // if (<condition>) {
    context.multifactor = {
      provider: 'any',

      // optional, defaults to true. Set to false to force authentication every time.
      // See https://auth0.com/docs/multifactor-authentication/custom#change-the-frequency-of-authentication-requests for details
      allowRememberBrowser: false
    };
  //}

  callback(null, user, context);
}
```

(Auth0 Rule for [Duo Multifactor](https://github.com/auth0/rules/blob/master/src/rules/duo-multifactor.js))

Multifactor authentication has gone from a luxury that only the biggest enterprise companies offer to their employees to an expected security feature even in consumer apps like [Twitter](https://blog.twitter.com/2013/getting-started-with-login-verification).

After a user logs in with their username and password, MFA requires that the user also prove that they are in possession of the phone (or another device or separate account) that’s associated with the user account. This additional layer of security protects the user even when their username and password has been compromised.
![Multifactor Authentication Flow](https://images.ctfassets.net/23aumh6u8s0i/1HxaXtyJhuP6JdCTu7J2ej/5a1b2db8d870481dc84448e08c8bc8fc/multi-factor-authentication-flow-video)
You can set up the Rule in fewer than 10 minutes and it will trigger multifactor authentication via [Duo Security](http://duosecurity.com/) or Google Authenticator to happen upon login. Here’s how it works:

1. The user logs in.
2. The MFA service kicks in and prompts the user to authenticate with their second device. If it’s the user’s first login, they’re prompted enroll their device with the MFA provider and that gets associated with their user account.
3. The user is granted access to the app.

Setting up the Rule is as easy as flipping a switch, selecting your MFA provider, and then configuring the associated Rule.
![Choosing MFA provider](https://images.ctfassets.net/23aumh6u8s0i/XZ3EQivmHdeaHkVApAi92/7b9ee17081f0bbccf40c417a9b265e01/choosing-mfa-provider)
What’s especially powerful about the Rule is that you can easily configure MFA to get triggered on different conditions, like, the type of network used.

And to do that, all you need to do is write a bit of extra conditional logic in JavaScript for your Rule. This helps you tailor how onerous the MFA burden is. You can have MFA triggered every time the user logs in, or only under abnormal conditions.

In the following example, we only trigger MFA when the user is logging in from a non-whitelisted IP:

```javascript
function (user, context, callback) {
  const whitelist = ['1.2.3.4', '2.3.4.5']; // authorized IPs
  const userHasAccess = whitelist.some(function (ip) {
    return context.request.ip === ip;
  });

  if (!userHasAccess) {
    return callback(new Error('Access denied from this IP address.'));
  }

  return callback(null, user, context);
}
```

### 2. MFA when there’s a log in from a different IP

```
function (user, context, callback) {
  const ipaddr = require('ipaddr.js');
  const corp_network = "192.168.1.134/26";
  const current_ip = ipaddr.parse(context.request.ip);

  if (!current_ip.match(ipaddr.parseCIDR(corp_network))) {
    context.multifactor = {
      provider: 'guardian',

      // optional, defaults to true. Set to false to force Guardian authentication every time.
      // See https://auth0.com/docs/multifactor-authentication/custom#change-the-frequency-of-authentication-requests for details
      allowRememberBrowser: false
    };
  }

  callback(null, user, context);
}
```

(Auth0 Rule for [multifactor on log in from different IP ](https://github.com/auth0/rules/blob/master/src/rules/guardian-multifactor-ip-range.js))

Alterting users to suspicious activity can empower users to protect themselves from hackers by giving them advance notice to change their passwords or set up MFA.

This rule sends a text message to the user’s phone whenever someone logs in to their account via a different device or location from the previous login.

Here is a similar notification that [Facebook sends](http://piersdillonscott.com/tag/geolocation/) in email form:
![Facebook Security Email Form](https://images.ctfassets.net/23aumh6u8s0i/2lpnxgIWb2ZtwKXrBuhXHN/1cdb823fdf72b32c0e0d395d81e8fd3e/facebook-security-email)
Note that they don’t just notify you that a new device has logged in, they also issue you a call to action to protect your account information if it wasn’t you that logged in.

And even when it’s the user herself who has logged in from a different location or device, the text message won’t be a nuisance. That you’re looking out for their security will impress them. In addition, you could issue an alternative call to action to set up MFA to further strengthen the security on their account.

### 3. User fraud score

```
function (user, context, callback) {
  // score fraudscore once (if it's already set, skip this)
  user.app_metadata = user.app_metadata || {};
  if (user.app_metadata.socure_fraudscore) return callback(null, user, context);

  if(!user.email) {
    // the profile doesn't have email so we can't query their api.
    return callback(null, user, context);
  }

  const request = require('request');

  // socurekey=A678hF8E323172B78E9&email=jdoe@acmeinc.com&ipaddress=1.2.3.4&mobilephone=%2B12015550157
  request({
    url: 'https://service.socure.com/api/1/EmailAuthScore',
    qs: {
      email:  user.email,
      socurekey: configuration.SOCURE_KEY,
      ipaddress: context.request.ip
    }
  }, function (err, resp, body) {
    if (err) return callback(null, user, context);
    if (resp.statusCode !== 200) return callback(null, user, context);
    const socure_response = JSON.parse(body);
    if (socure_response.status !== 'Ok') return callback(null, user, context);

    user.app_metadata = user.app_metadata || {};
    user.app_metadata.socure_fraudscore = socure_response.data.fraudscore;
    user.app_metadata.socure_confidence = socure_response.data.confidence;
    // "details":[
    //     "blacklisted":{
    //        "industry":"Banking and Finance",
    //        "reporteddate":"2014-07-02",
    //        "reason":"ChargeBack Fraud"
    //     }
    // ]
    user.app_metadata.socure_details = socure_response.data.details;

    auth0.users.updateAppMetadata(user.user_id, user.app_metadata)
      .then(function(){
        context.idToken['https://example.com/socure_fraudscore'] = user.app_metadata.socure_fraudscore;
        context.idToken['https://example.com/socure_confidence'] = user.app_metadata.socure_confidence;
        context.idToken['https://example.com/socure_details'] = user.app_metadata.socure_details;
        callback(null, user, context);
      })
      .catch(function(err){
        callback(null, user, context);
      });
  });
}
```

(Auth0 Rule for [Socure](https://github.com/auth0/rules/blob/master/src/rules/socure-fraudscore.js))

If you’ve created an online marketplace like AirBnB or eBay, protecting your buyers and sellers from fraud is one of the most important things you can do to increase the trustworthiness of the marketplace and ensure that more transactions happen there.

The Rule above calculates a fraud score for every user based on their email address and IP address. It uses the cloud service [Socure](http://socure.com/), which aggregates data from social media, offline identity verification services, and publicly available data on the web to determine whether a user is real or fake.

You can use that data to protect your app and your users by putting users with high fraud scores on a watchlist, or require additional verification before they can transact with other users.

And the Rule will get you the information you need at the time of registration, not after the user has a history of fraudulent transactions on the site—by which point, it could be too late.

### 4. Force email verification

```
function (user, context, callback) {
  if (!user.email_verified) {
    return callback(new UnauthorizedError('Please verify your email before logging in.'));
  } else {
    return callback(null, user, context);
  }
}
```

(Auth0 Rule for [forcing email verification](https://github.com/auth0/rules/blob/master/src/rules/email-verified.js))

Facebook showed the power of using the user’s email address to make your app ridiculously viral. The user's [name@college.edu](mailto:name@college.edu) email address shows the app developer that the user attends College. That means that the app developer can add the user to network College instead of dropping them into an empty app where they have to build their own experience from scratch.

Yammer did the same with [name@company.com](mailto:name@company.com) email addresses, and it became the fastest growing enterprise app ever as a result. Today, this tactic is a tool in the toolbox of ludicrously fast-growing SaaS companies like Slack to leverage the company network to add as many users as quickly as possible.

To make this work from a security standpoint, the user must prove that they actually own the email address and belong to the network signified by their email address. This is where the email verification process comes into play: have your app email the user with a unique, obscure, automatically-generated link to a page. That will force them to prove that they have access to the email account by logging in and clicking on the link to verify.

If you don’t have this email verification step, you’ll show an imposter or hacker sensitive information internal to the company, and that would be disastrous.

This Rule denies any user who hasn’t verified their email address from logging in. What’s great about implementing email verification this way is that it doesn’t complicate your existing authentication code. Rules can be chained together and turned on and off individually, which keeps things simple and nicely modular.

### 5. Encrypt sensitive data

```
function (user, context, callback) {
  user.app_metadata = user.app_metadata || { };
  user.app_metadata.private_data = encrypt({
    license_key: '1234567',
    social_security_number: '56789'
  });

  callback(null, user, context);

  function encrypt(data) {
    var iv = new Buffer(configuration.ENCRYPT_IV);
    var decodeKey = crypto.createHash('sha256')
      .update(configuration.ENCRYPT_PASSWORD, 'utf-8').digest();
    var cipher = crypto.createCipheriv('aes-256-cbc', decodeKey, iv);
    return cipher.update(JSON.stringify(data || {}), 'utf8', 'base64') + cipher.final('base64');
  }
}
```

(Auth0 Rule for [encrypting sensitive data](https://github.com/auth0/rules/blob/master/src/rules/encrypt-sensitive-data.md))

Encrypting sensitive user data minimizes the damage that occurs if hackers compromise a user’s account or find a way to leak user data.

<include src="TweetQuote" quoteText="Encrypting sensitive user data minimizes the damage that occurs if hackers compromise a user’s account."/>

Recently, crowdfunding site Patreon announced that it had been [hacked](http://motherboard.vice.com/read/the-whole-works-is-in-there-hackers-dump-data-from-patreon-crowdfunding-site). Attackers got away with 2.3 million email addresses, user names, and shipping addresses—plus, it included private messages sent via the site’s internal messaging platform of a highly personal nature.

But it could’ve been worse.

As a crowdfunding platform, Patreon stored user tax information as well, and if that got leaked, it would  have been disastrous for the site’s members. However, Patreon encrypted all of the tax information with a 2048-bit RSA, and stored the encryption keys on a separate server that wasn’t compromised. That meant that sensitive and personally-identifying tax information that could have been used for rampant identity theft remained secure.

Use this Rule to provide that protection to your user. This Rule takes sensitive data, like a user’s social security number or his license key, encrypts it, and stores it as [metadata](https://auth0.com/docs/rules/metadata-in-rules) associated with the user account.

## Do Good and Do Well
![Trello Pricing](https://images.ctfassets.net/23aumh6u8s0i/5l66tH6pNFIEPHiFIe5lSP/3d101d3bb94cd7fce219e116d7b88639/trello-pricing)
These Rules quickly and easily add extra security to your app to protect your users—and if you bundle them together, you have something you can charge more for.

Use them to assemble an [enterprise tier](https://auth0.com/blog/2015/08/18/how-to-go-upmarket-and-grow-your-revenue-by-20x/), charge 5x your basic tier, and use that to grow your revenue by 20x.

Not only will that help you make more money, it will give you a profit incentive to keep improving the security on your app, aligning you and your customers’ interests for the long term.


5 Ways to Make Your App More Secure in Less than 20 Minutes

Learn how to grow your revenue for your SaaS by offering enterprise features like SSO, MFA and Premium Support


For most developers, building for individuals and small to medium-sized businesses (SMBs) fall within their comfort zones, while [selling to the enterprise](https://resources.auth0.com/unlock-b2b-saas-growth-iam/) is something totally foreign that they can’t ever imagine doing.

The problem that you’ll encounter, though, is that churn (the percent of customers who cancel your service) for individuals and SMBs will fall within 3-5% monthly, and that’s if you’re lucky.  Otherwise, you could have churn of 10% monthly or worse, and that means losing X% of your customers every year.  

Just to stand still you’ll need to bring in new customers equal to that number lost.  That’s not easy, and this is the churn problem that ruins companies that target startups, small businesses and individuals.

If you’re experiencing this problem, you’re not alone. There’s actually a very simple solution that could totally change the trajectory of your business—tilt, ever so slightly, upmarket.  Build an “enterprise” version of your product, and you’ll see churn rates drop to 1-2% trending towards the magical “negative churn.”

While it might sound daunting to pull off, it’s actually very simple.  You don’t need to build a sales team.  You don’t need to totally change your product.  All you really need is to do 30 minutes’ work, raise your prices by 2x-5x, and sit back and watch as your revenue grow by 20x.

## Why Tilting Upmarket Will Increase Your Revenue by 20x

Imagine that you have an 100% individual-focused product, and you add the bare minimum features to sell the product for teams at work.  According to Echosign founder and investor [Jason Lemkin](http://saastr.com/), with that single move, you’ll [20x-30x your customer lifetime value](http://www.saastr.com/why-tilting-just-a-smidge-from-self-service-can-grow-your-revenue-30x/).
![](https://images.ctfassets.net/23aumh6u8s0i/2r6hmSbBbwBU8K3s63pYYA/1deb09bd92c3e75d44869220acd4fb49/seats)

You’re increasing the number of seats, but what creates an even bigger multiple for your customer lifetime value is the drop in churn when you go from a customer segment that naturally churns at 3-5% monthly to 1-2%.

What’s more is that your individual or SMB customer won’t add many more seats during its lifetime, because it will start at its natural ceiling, which is the number of people in the company. Enterprise-y customers, however, will add many more seats over time as a result of its massive company size, and that will take your churn from 1-2% down into the realm of negative churn.

What makes this move so profitable is that the bare minimum features to tilt upmarket is probably fewer than you think. That’s because if you see any usage of your individual product at work or you have a product that solves a problem for SMBs, you’ve likely solved a [universal problem](http://www.saastr.com/why-there-is-a-5050-chance-youll-tilt-upmarket-in-saas/) that everyone has at work. The upshot is that you won’t need to add new core functionality.

Plus, if individuals and SMBs are already finding you, enterprise customers will find you soon, too. It’ll start with a small team at a big company finding your first—behaving not unlike an SMB—and then your product will grow into the company from there. Off the bat, you won’t need to build a sales team to sell into the enterprise—they’ll find you.

## How to Go Upmarket By Barely Building Anything

For the enterprise, you’ll of course need to offer more seats and/or more volume based on how the other pricing plans are structured. However, those plans typically scale somewhat linearly in terms of volume. To get that multiplicative bonus above and beyond what a linear scaling of volume would dictate, you’ll need to offer some enterprise-specific features.

These are the features that actually matter to enterprise-level consumers:

1. **Premium support**
2. **Security / Privacy**
3. **Single sign-on**

### Premium Support

Offering premium support is often a matter of assigning an individual on your team to be the account manager for the customer’s account. When you start out, this should be you, the company founder or CEO.  

This may sound like a big hairy problem—keeping an enterprise customer happy—but it turns out that the more a customer pays you, the more they respect you. If you haven’t noticed yet, it’s often the free users that are the most time consuming when it comes to support.

<include src="TweetQuote" quoteText="..the more a customer pays you, the more they respect you."/>

The main thing that premium support should offer is that when a customer does decide to reach out to you, though, you are incredibly responsive in replying and resolving the customer issue.

Premium support is a great way to offer something of value to your enterprise customers, and you don’t need to build a thing to offer it.

<include src="TweetQuote" quoteText="Premium support is a great way to offer something of value to your enterprise customers."/>

![](https://images.ctfassets.net/23aumh6u8s0i/5LxmjITK2J7RFUv00wHjWj/827f3069ba508915ec9e7885e8866b1c/statuspage_20pricing)

[StatusPage.io](http://statuspage.io/) is an example of how a (mostly) bootstrapped company segments its pricing, with its scrappy approach to enterprise plan segmentation.

The markups are significant. from Hobby to Startup is over 3x, from Startup to business is 4x. Adding capacity for more users, better support and some customization allows StatusPage.io to markup their price 13x from Hobby to Business with an unlisted multiple to their enterprise plan (definitely in the thousands if not the tens of thousands per month).

When it comes to support, the ramp up is from email to phone to account rep, and finally, to having the CEO’s phone number. They didn’t have to build a single thing to create that segmentation, but in doing so, they were able to offer just that additional extra enticement to go enterprise.

### Security / Privacy

For some financial companies, law firms or healthcare businesses, they simply can’t use your product unless it has been certified to meet specific security and privacy standards. Auth0 offers [compliance with SOC 2 and HIPAA BAA's](https://auth0.com/security) for these type of customers.

For the majority of companies, there’s a different dynamic happening. If a company wants to buy your product, that typically means that you have an internal champion in the company that wants to buy. The purpose, then, of offering security and privacy features is to help your champion convince the decision maker that you’re not a ragtag startup and that you take security and privacy seriously.

The thing is that you should already be offering much of what’s standard when it comes to security on the web—SSL, data backups, and everything else you get for free by running on Amazon AWS or the like. And that’s going to be available to all of your customers.


![](https://images.ctfassets.net/23aumh6u8s0i/4r3A3noRS7SPjpz9yV0S1b/37481928bb50cd548790babcb3fbcdee/Trello_20Pricing)

Not all individual and business customers want or need [two-factor authentication](https://auth0.com/docs/mfa). But to the security-conscious company, two-factor authentication is extremely valuable. For Trello’s enterprise plan, it’s one of their top 2 selling points.

Trello’s freemium model offers pretty much everything most people need for free. Beyond that, the service offers two more levels: business and enterprise. The main feature jump from free to Business (at $3.75 per user / month) is more control over your users and your boards, along with enhanced security. The Enterprise plan (price unlisted) is for 100+ users. It segments on SSO and 2FA primarily, along with enhanced support.

These days, it’s pretty straightforward to integrate your account management system with a two-factor authentication provider—like Google Authenticator or Duo—and that’s something that we make easy for developers at [Auth0](http://auth0.com/).

![](https://images.ctfassets.net/23aumh6u8s0i/12iEyYoCsrc2YnkDJxJzYG/eb7804222fc949aa20369ca524acac0c/mfa)
### Single Sign-on

Within big companies, managing identity is a huge hassle. Imagine how painful it would be to work at a big company, do your work in 10 different systems, and have to remember a different set of login credentials for each system.

Similarly, imagine that you’re in charge of IT at a big company and you have to provision accounts in 10 different systems each time you make a new hire, and you have to delete accounts in 10 different systems each time you fire someone.

To solve this problem, big companies have enterprise single sign-on, just like normal internet users use Facebook connect or Twitter to manage their logins to different systems. They just have one username and password, and it gets them into all of the systems that they use.

This is a huge selling out for big companies, but it’s nearly irrelevant to individuals, startups and small companies—and that makes it the perfect feature to segment your pricing on.

![](https://images.ctfassets.net/23aumh6u8s0i/6p9tXdnnNWVd6HawUDVQgK/03bbf6507b24477aa88aca874bcdaf7d/slack_20pricing)

Slack is a freemium product, so most users are on the free plan. This gives free marketing to Slack and makes it suitable for a bunch of non-business use cases like family & friends group chat and loosely affiliated professional development groups.

As you go up the price tiers, feature lists do expand which segment companies according to their ability to pay.  Beyond the Standard plan, you have features that only large teams are going to need or want. Single sign-on is the top feature for the Plus plan, which gives it a 2x markup.

In the past, this would’ve been a tough feature to add to your product because it would mean navigating complex protocols like SAML and LDAP, but now you can add SSO to your product in a few minutes with [Auth0](https://auth0.com/). With that one addition you could add an enterprise tier to your service and offer it at 3x, 4x, 5x your basic tier, and 20x your revenue.

![](https://images.ctfassets.net/23aumh6u8s0i/7GGCgjjPNLjiiXA56t5Uit/56b5a3ad22b60ec05705d2b4120e5f85/sso)

## It's not just a theory

We have real examples of our customers being able to increase their pricing thanks to using Auth0.

One of our customers is a big publisher of books and videos. With Auth0, they're now able to sell to enterprise companies and connect to their Active Directories, LDAPs and ADFS so that they can have SSO and charge them more.

Another of our customers is a SaaS for A/B testing. Using Auth0, they can now integrate MFA and SSO with enterprise providers and be able to charge more to their customers because of that.

## It’s Easier Than Ever to Build for the Enterprise

Making big money in the enterprise is easier than ever for developers and startups because of the SaaS infrastructure that’s grown around building for the enterprise.  Your jaw should drop seeing how easy it is to significantly add value to your company by offering upmarket features for enterprise customers.

These aren’t about changing significant parts of your product. They are about offering value to a certain subset of customers. In particular, these people value being able to take ownership of their service.

For 30 minutes’ work.

[Unlock B2B SaaS growth with modern identity management. Download free eBook here.](https://resources.auth0.com/unlock-b2b-saas-growth-iam/)


"MFA"