37590801?s=460&v=4

A software engineer who dreams about non-electric sheep and autonomous vehicles and likes to champion security.

Software Engineer

Dan Arias

AAA (Authentication, Authorization, Accounting) helps developers secure web apps by verifying users, controlling access, and tracking actions.

Historically, the AAA framework (Authentication, authorization, and accounting) has been deeply tied to network security, particularly in the context of remote access, VPNs, and network devices. However, AAA is a conceptual framework and not a protocol itself, allowing us to apply it anywhere identity and access matter. Instead of a VPN gateway, you’re securing a web application. Instead of a network admin, it’s a customer buying shoes online. The scale gets bigger, the users are external, and the focus shifts toward balancing security and usability, but the AAA principles still fit to help us build robust, secure, and maintainable user-facing applications.

For developers, considering AAA in your design decisions means not only verifying who your users are (Authentication) but also controlling what they can do (Authorization) and tracking their actions for auditing and analytics (Accounting). This holistic approach minimizes security risks, enhances user experience, and simplifies compliance.

## A Framework to Measure Identity Platforms

A good identity platform gives you features out of the box that tackle each component of the AAA triad, transforming a simple login system into a comprehensive identity management system that meets your security and compliance requirements. User data is one of the most precious and valuable assets we handle as developers. As such, when we make the decision to delegate creating and handling the identity of our users to a third-party vendor, we need to ensure that we are getting better security, scalability, and user-centric experience than what we could build ourselves. The AAA framework is a helpful tool to assess whether an Identity-as-a-Service (IDaaS) vendor can help you build application systems that are resilient against threats, aligned with business requirements, and equipped for future growth.

In today’s competitive digital landscape, including identity and security as part of your MVP or existing product is a competitive advantage. A holistic approach to security is not just an option—it’s a necessity. However, not every player in the field can deliver the security the current security and threat landscape requires. Let’s dive into why Auth0 is a robust identity platform that meets the requirements of the AAA framework and why you should consider it as your identity solution of choice.

## Authentication

Authentication is the process of verifying a user's identity before granting access to your application. It answers the question: **"Who are you?"**

* [Seamless User Sign-Up and Login](https://auth0.com/docs/authenticate/login)
    * Auth0 offers multiple authentication methods, such as social logins, passwordless options, and multi-factor authentication (MFA). These features enable quick and secure identity verification.
* [Personable User Experience](https://auth0.com/docs/customize)
    * With customizable interfaces, Auth0 reduces barriers during sign-up and login, ensuring that the verification process is both secure and user-friendly.
* [Relevant User Journeys](https://auth0.com/docs/customize/forms)
    * Auth0 offers customization of the metadata you collect from users or creates a unique authentication journey that serves your business needs while still being secure.
* [Uncompromised Internationalization and Localization](https://auth0.com/docs/customize/internationalization-and-localization)
    * Auth0 can handle different languages across the authentication experience, allowing you to connect authentically and accurately with millions of potential customers across the globe. Auth0 adapts to your users instead of forcing users to adapt to inflexible platforms.

## Authorization

Authorization defines what actions or resources a user is allowed to access once they are authenticated. It answers the question: **"What can you do?"**

Auth0 allows developers to implement flexible yet comprehensive authorization models that fit different threat models.

* [Role-Based Access Control (RBAC)](https://auth0.com/blog/an-overview-of-commonly-used-access-control-paradigms/#Role-Based-Access-Control--RBAC-):
    * Auth0 allows you to set granular permissions by assigning roles to users. This ensures that users only access the features and data relevant to their privileges.
* [Auth0 Actions](https://auth0.com/docs/manage-users/access-control/sample-use-cases-actions-with-authorization)
    * Actions are secure  Node.js functions that allow you to modify or complement the outcome of the decision made by pre-configured authorization policies. Developers can use Auth0 Actions to[ handle more complicated cases](https://auth0.com/docs/manage-users/access-control/sample-use-cases-actions-with-authorization) than is possible with role-based access control (RBAC).
* [Fine Grained Authorization](https://auth0.com/fine-grained-authorization)
    * Auth0 FGA delivers relationship-based access control ([ReBAC](https://auth0.com/blog/an-overview-of-commonly-used-access-control-paradigms/#Relationship-Based-Access-Control--ReBAC-)) designed for complex authorization needs, such as restricting resource edits to team leads. As a managed service, it scales to handle millions of permission checks per second with minimal latency, eliminating the need to build and maintain custom solutions.

## Accounting

Accounting, also known as auditing, involves tracking and logging user activities within your application. It answers the question: **"What did you do?"**

* [Detailed Logging](https://auth0.com/docs/deploy-monitor/logs)
    * Auth0 maintains a comprehensive audit trail of authentication and authorization events. This detailed logging is essential for monitoring user behavior and identifying potential security incidents.
* [Usage Analytics](https://auth0.com/docs/get-started/auth0-overview/dashboard/activity)
    * The collected data helps analyze user interactions, optimize authentication flows, and ensure compliance with industry regulations. Accounting provides valuable insights into how your application is used.
* [Log Streaming](https://auth0.com/docs/customize/log-streams)
    * Auth0's log streaming service allows you to export tenant log events to a log event analysis service URL, leveraging robust data services, such as DataDog, Splunk, and Amazon EventBridge, and allowing you to react to events like password changes or new registrations with your own business logic.

## Bringing It All Together

Overlaying the AAA framework on your Auth0-powered B2C or B2B solutions ensures:

* **Enhanced Security:**
    * A multi-layered approach that not only verifies identities (Authentication) but also enforces precise access controls (Authorization) and continuously monitors user activities (Accounting).
* **Improved User Experience:**
    * While users benefit from a smooth and secure sign-up process, the detailed authorization rules and accounting measures ensure that they access the right features with confidence.
* **Operational Excellence:**
    * With robust logging and analytics, you can swiftly detect anomalies, refine your application, and maintain compliance with regulatory standards.

If you haven’t tried it already, [get started with Auth0 today](https://a0.to/get-started)!


Authentication, Authorization, and Accounting For Developers

paulo-nascimento

Paulo Nascimento is a Machine Learning Engineer at Okta, spearheading AI development for the Customer Identity Cloud (CIC). He brings expertise from AI startups to create innovative solutions powering the CIC organization. Paulo's work focuses on integrating AI technologies to strengthen enterprise security, enhance user experience, and drive intelligent automation across Okta's identity platform.

Machine Learning Engineer

Paulo Nascimento

Waleed Manzoul

Staff Product Designer

Automate user lifecycle, enhance security and boost IT efficiency across your enterprise

## Introduction

Consider a Fortune 500 company, like a bank with 40,000 employees. A financial analyst at this company will use many SaaS tools to do their job, like Slack, Google Suite for Work, Zoom, Tableau, Workday, and more. In fact, enterprise organizations rely on [an average of 211 apps each](https://www.okta.com/businesses-at-work/) to run their businesses.

So, the bank’s central IT team might be responsible for managing 200+ SaaS apps, and our financial analyst may need access to a quarter of them. Naturally, for an employee to use all of those apps, accounts for each one would need to be provisioned first.

Fortunately, our bank’s IT team is smart. They utilize [Okta Workforce Identity Cloud](https://www.okta.com/workforce-identity/) to maintain [a directory of all their employees](https://www.okta.com/products/universal-directory/) and enable easy account creation and access to those SaaS apps using [Single Sign-On](https://auth0.com/docs/authenticate/single-sign-on). That means they don’t have to manually provision SaaS apps every time a new employee joins the company or an existing employee needs access.

But what about other events in an employee’s time with the company, such as when they change their role, change their name or pronouns, or eventually leave the company? How many times might those events happen over 40,000 employees? And how might each of those changes be reflected in the SaaS apps that they use?

## User Lifecycle Management Using SCIM

Fortunately, if a SaaS app used at the company relies on a workforce provisioning engine that utilizes SCIM ([System for Cross Identity Management](https://scim.cloud/), a standard for automating the exchange of user identity information between identity domains), that app can synchronize its user list to the central employee directory and react to changes that happen in the directory.

For the bank’s central IT team, this means they can make updates to users once in their central employee directory and have those changes reflected in all of the SaaS apps an employee uses, **reducing administrative overhead and toil**.

The power of this “live” connection that SCIM provides becomes critical when an employee leaves the company. Once central IT deletes this employee from their central directory, any user accounts they had with those SCIM-powered SaaS apps will be deactivated within seconds, **eliminating the chance of unauthorized access** through “[zombie accounts](https://www.wsj.com/tech/cybersecurity/unused-online-accounts-data-safety-38fa675e)” and **maintaining compliance with data privacy regulations**, like [GDPR](https://gdpr-info.eu/art-5-gdpr/).

Timely deprovisioning of former employees can have **cost savings** as well. When an employee leaves, the central IT team can quickly release the employee’s SaaS licenses and accurately reflect the reduced spend to the respective vendors.

So, you can imagine that the bank’s central IT team would want any new SaaS app it evaluates to leverage SCIM due to its many benefits:

* Saves a lot of manual labor
* Improves their security posture
* Saves their company money

## How Does SCIM Provisioning Work?

SCIM works by providing a defined schema of identity data that represents users and groups, along with a REST API that supports JSON and XML for CRUD operations on those user and group resources. 

Behind the scenes, SCIM is broken down into a few core components:

* SCIM Service Provider
    * This service hosts the identity data and responds to SCIM API requests. It’s also commonly called a SCIM server.
    * _Examples: Cloud applications, identity providers (e.g., Okta)_
* SCIM Client
    * The SCIM Client **initiates SCIM requests to interact with a SCIM server to perform operations that manage identities.**
    * _Examples: Identity management systems, HR systems_
* SCIM Schema
    * The SCIM schema defines the structure of identity data.
    * Core schemas: User, Group, EnterpriseUser (defined in [RFC7643](https://datatracker.ietf.org/doc/html/rfc7643))

The SCIM core components then use an HTTP-based REST API that supports JSON and XML data formats, although JSON is more common. The REST API uses standard HTTP methods like GET, POST, PUT, PATCH, and DELETE to support CRUD operations.

SCIM supports a number of key operations, such as:

* User Provisioning
    * The ”SCIM Client” sends a POST request to create a new user, and the ”SCIM Provider” creates the user and returns a unique identifier (ID).
* User Retrieval
    * The ”SCIM Client” sends a GET request with the user ID or search criteria, and the ”SCIM Provider” returns user data that matches the request, provided the user exists.
* User Update
    * The ”SCIM Client” sends a PUT or PATCH request with the updated user data, and the ”SCIM Provider” applies changes and confirms the update.
* User Deprovisioning
    * The ”SCIM Client” sends a DELETE request, and the ”SCIM Provider” removes or deactivates the user account.

On top of this core functionality, SCIM also provides useful features such as: 

* Bulk Operations
    * Where batch processing can be applied for multiple SCIM operations in a single request
* Filtering and Searching
    * Allows complex queries to find specific users or groups by using a standardized filter syntax

For each request, the SCIM REST API will return with the appropriate HTTP status to indicate success or failure along with detailed error messages for troubleshooting. SCIM typically uses OAuth 2.0 for authorization and supports HTTPS for secure data transmission.

SCIM is also extensible, which means that organizations can extend the standard SCIM schemas to accommodate their specific needs. For example, if an organization wants to include additional information about employees not covered by the standard SCIM schemas, then they can store additional information such as ”department” or ”manager” in their user profiles.

## SCIM vs SAML

Security Assertion Markup Language (SAML) is an XML-based framework for exchanging authentication and authorization data between an identity provider (IdP) and a service provider (SP). It’s most commonly used to enable Single Sign-On (SSO) across different web applications and services.

SCIM and SAML are both protocols for identity and access management (IAM). However, they serve different purposes. 

SCIM is used for user provisioning and management across different systems and applications, ensuring that identity data is consistent across. SAML, on the other hand, is used to access multiple applications with a single set of credentials.

> In summary, SCIM is for user management, while SAML is for user authentication.

## SCIM vs. SSO

Single Sign-On (SSO) is an authentication method that allows users to sign in to multiple applications with a single set of credentials.

Although SCIM and SSO are related, SCIM is a protocol used for provisioning appropriate roles and groups to users, whereas SSO authenticates those users into multiple accounts with a single set of login credentials.

## Inbound SCIM with Auth0

If you’ve been reading about SCIM online, you’ve probably found identity providers like Okta Workforce Identity Cloud and Microsoft Entra ID support SCIM in different ways, and that building for each of them can become a substantive effort. We’d advise that you learn about the identity providers your customers use and tailor your SCIM solution to meet the majority of your customers. However, If you think you will need to integrate your development with more than one identity provider, don't despair: there are solutions that allow you to easily connect to multiple identity providers at once. 

In fact, that's one of the things we do at Auth0. Our [Inbound SCIM solution](https://auth0.com/docs/authenticate/protocols/scim) allows you to integrate with Okta Workforce Identity Cloud, Microsoft Entra ID, and other identity providers via both SAML and OpenID Connect, manage attribute mappings on a per connection basis, and more. 

## Conclusion

SCIM is a powerful way to automate user lifecycles and maintain user accounts across platforms that can save companies time, money, and increase their security. Learn more about SCIM by exploring the [Auth0 docs](https://auth0.com/docs/authenticate/protocols/scim). 


Streamline Account Provisioning and Management with SCIM

joey devilla headshot 900px

I’m a Senior Developer Advocate at Auth0, and I like to work on various technologies. I’ve developed software for all sorts of platforms, from CD-ROM and the PalmPilot to my current area of focus, mobile phones, IoT devices, and AI. When I’m not looking for strange new platforms to write software for, I’m playing a strange old instrument — the accordion!

Senior Developer Advocate

Joey deVilla

Detect hackers with Auth0 Actions and special accounts designed to catch them in the act.

Use Honeytokens and Auth0 Actions to Catch Malicious User Logins

Use Auth0’s Management API and account metadata to collect user information a little bit at a time instead of all at once.

Add Progressive Profiling to Auth0 Authentication in Android Apps Built with Jetpack Compose

MichaelW

Michael has worked in the security space for over 10 years, developing integrations for different vulnerability scanning, SIEM, and SOAR tools. He is passionate about discovering the exponential value that can be had by combining together multiple security datasets rather than using them on their own. As the lead on partner integrations for Pangea, Michael is working on bringing together a group of best-in-market security services for developers to use via API.

Senior Manager - Partner Integrations Pangea

Michael Weinberger

Pangea offers integrations to enhance security for new account registrations and logins

Do developers who are not security experts want to spend their valuable time developing security features? But _should they_, given the considerable room for error? 

Pangea helps remove this margin for error. Pangea is a comprehensive set of API-based security services that can quickly and easily be added to any cloud application, embedded as functions directly into the application source code. Pangea emerged from the idea that key security features should not be repeatedly reinvented by companies every time they build new products. 

Instead, with Pangea, application developers can access a wide selection of out-of-the-box security services to embed security easily in all of their applications. Comparable to AWS for compute APIs, Twilio for communications APIs, and Stripe for billing APIs, Pangea has created a single platform for security — [Security Platform-as-a-Service](https://www.prnewswire.com/news-releases/pangea-cyber-closes-26m-series-b-from-gv-decibel-and-okta-ventures-for-developer-first-security-framework-to-deliver-secure-apps-faster-301689531.html) (SPaaS).

## Keeping Security Simple with Pangea Integrations

As we like to say, Pangea makes it “dead simple to integrate security with just a few lines of code”. With a clear developer focus, Pangea simplifies the varied aspects of security that are required for virtually every application. 

Without Pangea’s SPaaS for developer-first security services, the security puzzle is made up of scattered commercial and open-source pieces. Usually, these pieces are not even API-first, which makes integrations difficult. Pangea specializes in bringing these pieces together in an API-first form, with consistent documentation and guaranteed services compatibility — making it easy for developers to embed security in their applications.

## Pangea Integrations for Marketplace

Three Pangea Integrations have been released for the Auth0 Marketplace — [Pangea - Domain Check](https://marketplace.auth0.com/integrations/pangea-domain-check), [Pangea - Embargo Check](https://marketplace.auth0.com/integrations/pangea-embargo-check), and the [Pangea - Validate Registration](https://marketplace.auth0.com/integrations/pangea-validate-registration). The Pangea - Validate Registration integration uses Pangea security APIs to validate new user registrations. This includes embargo checks using Pangea’s Embargo Check and domain score checks using Pangea’s domain intel service, which contains intelligence on over 390 million domain addresses. The results are all logged to the Pangea secure audit log service.

Configuration can then be done on the Pangea console to view and manage audit logs (redaction and retention), manage embargo lists, and select providers for domain scoring — with no additional code changes. 

## How the Pangea Integration Works

To use the Pangea Marketplace integration, you will need an Auth0 account and tenant as well as a Pangea account.

Pangea setup requires some light integration configuration before adding the Auth0 Action. Note that once the Action is successfully deployed, all new user registrations for a tenant will be processed by this integration. Before activating the integration in production, install and verify the Action on a test tenant.

Once the Action is added, new user registrations will be defended by Pangea APIs. Each new user registration will be checked against Pangea Embargo and Pangea Domain Intel. The user will either be accepted or rejected, and the results will be written to Pangea Secure Audit Log.

## Shifting “Left-of-Left”: Pangea Benefits 

Implementing Pangea provides a number of benefits, including: 

* **Prioritizing security from the get-go of app development**, i.e., shifting responsibility “left-of-left”. Pangea's library of APIs security and compliance requirements are addressed from the beginning, giving developers the ability to drop security into their app runtime code prior to publishing. This can reduce developer cognitive load while covering security from the outset. 
* **Leveraging security intel from leading providers**, such as Crowdstrike, DomainTools, and ReversingLabs, among others, in Pangea APIs.
* **Securing registration decisions with cryptographically secure audit logs**. Pangea audit logs provide built-in redaction and can be used to help meet compliance and regulatory requirements under GDPR, SOC2, HIPAA, and more.

## Simplify Application Security with Pangea 

It’s never been easier for developers to add security to their applications right out of the box. Check out the [Pangea - Validate Registration](https://marketplace.auth0.com/integrations/pangea-validate-registration) integration in the Marketplace to get started.

Pangea — Security with Ease, Now on Marketplace

carla_urrea

I've been working as a software engineer since 2014, particularly as a backend engineer and doing system design. I consider myself a language-agnostic developer but if I had to choose, I like to work with Ruby, Python, and Elixir.  

After realizing how fun it was to create content and share experiences with the developer community I made the switch to Developer Advocacy. I like to learn and work with new technologies. 

When I'm not coding or creating content you could probably find me going on a bike ride, hiking, or just hanging out with my dog, Dasha. 

Carla Urrea Stabile

Learn what is a Yubikey and how you can set one up with your Auth0 account.

If you are reading this blog post, you are interested in security and how to make your accounts more secure. This blog post will teach you about Yubikeys, their benefits, and how to provide two-factor authentication (2FA) in your applications with Auth0.

<AmpContent>
<amp-youtube
    data-videoid="hS3tHjK0p_E"
    layout="responsive"
    width="480" height="270">
</amp-youtube>
</AmpContent>
<NonAmpContent>
<div class='embed-container' style="position: relative; padding-bottom: 56.25%; height: 0; overflow: hidden; max-width: 100%;margin-bottom:40px;"><iframe style="position: absolute; top: 0; left: 0; width: 100%; height: 100%;" src='https://www.youtube.com/embed/hS3tHjK0p_E' frameborder='0' allowfullscreen></iframe></div>
</NonAmpContent>

## What is a Yubikey?

**A Yubikey is** a hardware authentication device that makes two-factor authentication easier by plugging it into your laptop and tapping it. Yubikeys are a type of [security key](https://www.okta.com/identity-101/security-token/) manufactured by [Yubico](https://www.yubico.com/).

Usually, when logging in to any service, you must enter **something you know**, such as your login credentials, email, and password. In our case, 2FA adds another layer of security by requiring you to provide **something you have**, for example, a code from an authenticator app or SMS on your phone. Instead of using a code, you can use a device such as your Yubikey. In other words, **2FA is the process requiring a user to verify their identity in _two unique ways_** before they are granted access to a system. [It's a form of Multi-Factor Authentication.](https://www.okta.com/blog/2021/07/what-is-two-factor-authentication-2fa/)

## How Does a Yubikey Work?

Yubikeys use [U2F (Universal 2nd Factor)](https://auth0.com/blog/the-working-principles-of-2fa-2-factor-authentication-hardware/#How-The-U2F-Protocol-Was-Created), an open standard for two-factor authentication based on [public-key cryptography.](https://auth0.com/blog/how-to-explain-public-key-cryptography-digital-signatures-to-anyone/#The-Keys) 

With your Yubikey, you must first register it into your account to authenticate later. 

### Register your Yubikey

1. First, you must authenticate using another method, like your email and password. 
2. When you plug in your Yubikey and signal that you want to register a security key, the server you want to authenticate with sends a challenge and an AppID to the Yubikey. 
3. When the Yubikey receives this information, you'll be prompted by the browser to tap the Yubikey to confirm the request. 
4. Your Yubikey will generate a [nonce](https://en.wikipedia.org/wiki/Cryptographic_nonce) and hash it together with the AppID and the secret key to create a private and public key. 
5. The nonce and public key are sent back to the server to be stored so they can be used later when the user wants to authenticate.


### Authenticating with your Yubikey 

1. The server remembers you had registered a Yubikey, so it generates a new challenge to send back along with the AppID and nonce created when you first registered your Yubikey. 
2. The browser prompts you to tap the Yubikey, and the Yubikey will use the information received in step 1 to re-create the same key pair created when you registered your Yubikey. 
3. If everything goes well, your Yubikey encrypts the challenge sent by the server with the private key and sends the challenge back. 
4. The server decrypts the challenge using the public key it already has, and if the challenge matches the one the server sent, it means the user authentication was successful. 

## Benefits of Using a Yubikey 

One of the advantages of using a Yubikey is that they **protect against phishing attacks**. Registering a new key to a server sends an AppID that could be the website URL you're trying to authenticate. Therefore, **the credentials you create in a server are linked directly to a single website**.  

Yubikeys provide **one-touch login** without requiring a mobile phone to complete an authentication challenge.

You can also register as many Yubikeys as you want to minimize the chances of account lockout. You should have more than one key and register them simultaneously; **that way, if you lose any, you'll always have a backup.**

As a developer, using a device like a Yubikey might make your life easier, especially if you use [**WebAuthn**](https://webauthn.me/). It's a specification for an API that enables browsers to **create and use** strong public-key credentials so you can authenticate your users on your web applications. **In the WebAuthn process, the authenticator can be a Yubikey.**


## Set Up Your Yubikey with Auth0

You can set up your Yubikey with most mainstream websites like Google, Facebook, Instagram, etc .[Yubico provides an extensive list](https://www.yubico.com/es/works-with-yubikey/catalog/?sort=popular) of all the  applications that support Yubikeys.

In this case, you will set your Yubikey with your Auth0 application to allow your users to log in with a tap!


### Requirements 
- A [**Yubikey**](https://www.yubico.com/products/)
- **An Auth0 account ** <a href="https://a0.to/blog_signup" 
  data-amp-replace="CLIENT_ID" 
  data-amp-addparams="anonId=CLIENT_ID(cid-scope-cookie-fallback-name)">
  which you can get by signing up here
</a>

### Enable and define an MFA Factor 

First, head up to the [Auth0 Dashboard](https://manage.auth0.com/dashboard). On the left-hand menu, click **Security** and under this section, **Multi-factor Auth**. You will see a list of [Factors](https://auth0.com/docs/secure/multi-factor-authentication/multi-factor-authentication-factors):  

![Auth0 MFA Factors](https://images.ctfassets.net/23aumh6u8s0i/18uOwO0agDCb0gfQc9nmKC/61533e04f9b7bbedf7c67a2232dfef4b/Screenshot_2023-01-05_at_4.30.56_PM.png)

Click the factor called **"WebAuthn with FIDO Security Keys"**. It will navigate to the factor configuration page, where you can enable it by using the toggle button on the top right as follows: 

![MFA Factor WebAuthn with FIDO Security Keys config page](https://images.ctfassets.net/23aumh6u8s0i/6oH5pOPesYN4HC26M4hzui/24974cde91e7d132c09122d83ab731ea/Screenshot_2023-01-09_at_6.17.22_PM.png)

### Define an MFA policy 

Once you have enabled your MFA Factor, click **"Back to Multi-factor Authentication"**, next, scroll down to find the **Define Policies** section. 

A policy determines when to prompt users to complete to prove they own a particular account. For the sake of this tutorial, you can select **"Always"** and click **"Save"**

![MFA Policies](https://images.ctfassets.net/23aumh6u8s0i/1LnK0IMESXmCtY7p7fPFEa/cc38bef3e4d43b4c777d81ecbce59ce2/mfa-policies-always.png)

### Test your MFA strategy with your Yubikey 

First, **plug your Yubikey into your laptop**. Make sure it lights up when you do it to make sure it's plugged in correctly.

Next, head to the [Auth0 Dashboard](https://manage.auth0.com/dashboard) and find the **"Try your Login box"**, then click **"Try it out"**.

![Try your Login Box](https://images.ctfassets.net/23aumh6u8s0i/6x1ti069gOiQQEfKMxJOkA/1a574fcaa21a63c27af49c46f945ac5d/auth0-try-login-box.png)

The Universal Login page should open, so **go ahead and Sign Up** with either an email and password or with Google.

<img src="https://images.ctfassets.net/23aumh6u8s0i/1qNiYSkRJ2LV9ofWcmilUi/67d360f73933aeab8af3b1f6ff665891/universal_login_try_it_out.png" alt="Universal Login Page" width="500"/>

After you Sign Up, **your browser will detect that you have a Yubikey**, and it will take you to the following page so you can register your Yubikey:

<img src="https://images.ctfassets.net/23aumh6u8s0i/1o0j38TBwuyW7NoqQJUk9k/c0600bbf6ad4561c2e5d9fc52a606b95/Screenshot_2023-01-05_at_5.07.06_PM.png" alt="Add your Security Key" width="500"/>

Click "Use security key". A modal will pop up; select "USB Security Key": 

<img src="https://images.ctfassets.net/23aumh6u8s0i/4aGvztvwh1NH15CBhmmWHn/ab1ca9633bcf26c2c3dc6a7bc6626010/Screenshot_2023-01-05_at_5.09.29_PM.png" alt="Select your Security Key" width="500"/>


At this point, you'll be asked to **tap your Yubikey**:

<img src="https://images.ctfassets.net/23aumh6u8s0i/bo8pyABsZITlIghPPmWNV/04af1578bec8ca62d2f2562cb041c4f5/tap_key.png" alt="Tap Yubikey" width="500"/>


Next, you'll need to **add a name for your Yubikey**. Make sure to use a name that will help you identify which Yubikey you need to use.

<img src="https://images.ctfassets.net/23aumh6u8s0i/4sX3zXNfxEGWeb9TyXV6QA/a20804c8bfd843b299b9e32fd3cb69f1/Screenshot_2023-01-05_at_5.16.15_PM.png" alt="Name Yubikey" width="500"/>

And that's it! You have set up your Yubikey with Auth0! 🎉 You'll see a success message like this one:

<img src="https://images.ctfassets.net/23aumh6u8s0i/5MamqbabTSGXTwVkpoqtDb/6889544b4747fd3f2b73d3bab34c375e/yubikey_added.png" alt="Security key success message" width="500"/>

## Summary

In this post, you learned about Yubikeys and how to set them up with Auth0.

Yubikeys are a type of security key made by Yubico that makes two-factor authentication easier. Yubikeys use U2F, which is based on public-key cryptography. 

Using a Yubikey allows you to do a one-touch login and have as many Yubikeys as you want. 

Setting a Yubikey with Auth0 is a relatively straightforward process; all you need is the Yubikey and an Auth0 Account. 

What do you think? Will you be using a Yubikey in the future? Let me know in the comments. 

Thanks for reading!

What is a Yubikey and how to set it up with Auth0?

Nabeel-Saeed

Nabeel is a product marketer focused on all things security and identity. He has contributed to publications like Wirecutter, Information Age, and Professional Security. He has also been a guest speaker at the Bay Area Cybersecurity Meetup, and delivered talks on IAM across the US, Canada, Israel, and Singapore. He is passionate about helping build secure auth experiences that amaze users and delight businesses.

Product Marketing

Nabeel Saeed

Attackers are getting better at compromising customer accounts. Here's how to stop them

Customer Identity (CIAM) is a unique segment of the wider Identity and Access Management (IAM) space, as customer-facing applications face a different threat landscape and must deliver an experience that's user-friendly — as well as secure and private. It must rely on subtle techniques to achieve and maintain a strong security posture while also driving conversions and building trust with consumers.

Our [2022 State of Secure Identity Report](https://auth0.com/resources/whitepapers/2022-state-of-secure-identity-report) presents trends, examples, and observations unearthed from observing the billions of authentications on our platform in the hope that bringing light to such insights will help organizations understand the threats against customer identity and drive informed conversations around Zero Trust.

### Fraudulent registrations are an ever-present and growing threat

In the first 90 days of 2022, signup fraud accounted for approximately 23% of signup attempts on our platform, up from 15% in the same period last year (per last year's report). Financial Services and Energy/Utilities experienced the highest proportion of signup attacks, with such threats accounting for 64.8% and 72.5% of registration attempts in those two industries, respectively.

### Credential stuffing is on a record pace

2022 has already delivered the two largest such credential stuffing attacks we have ever witnessed, and across all industries, credential stuffing accounts for 34% of overall traffic/authentication events on our platform. While most industries experienced a credential stuffing rate of less than 10% of login events, in several cases — Retail/eCommerce (more than 80%), Financial Services, and Entertainment — these attacks represented the majority of login attempts.

### Threat actors are targeting MFA

Because of its proven merits, more application and service providers are recommending or requiring MFA. Consequently, the first half of 2022 has seen a higher baseline of attacks against MFA than any previous year in our dataset. As attackers become more sophisticated at targeting this important defensive measure, it's critical that MFA be implemented correctly and that strong secondary factors are chosen.

### Breached Passwords are a pervasive but poorly understood threat

Account takeover attacks with stolen credentials are one of the most common and costly cyber threats. Entire marketplaces exist to sell lists of user credentials leaked in third-party breaches. In fact, 58% of all Auth0 customer applications have experienced login attempts using breached/leaked credentials, illustrating the widespread nature of these attacks. What's more, most of the services that purport to protect against breached passwords use web scanners and scrapers that rely on breach data being made public, which can be months or even years after the initial breach. Reusing passwords across sites increases the risk of an attack and makes it more difficult for organizations to prevent fraudulent access to user accounts. In order to defend apps and users against this pervasive threat, it's imperative that breached passwords are detected as soon as they are compromised and accounts notified.

### CIAM at the vanguard of identity security

In an enterprise environment, security trumps convenience, so administrators can impose controls with comparatively little regard for the user experience — but customer identity management must maintain security and privacy while minimizing friction. Because of this restriction, CIAM exists at the vanguard of identity security and innovation, as it depends upon defenses that can withstand sophisticated threats but that are nearly invisible to users.

With this report, we aim to increase awareness of both threats to customer identity and the techniques that can be layered to build reliable defenses.

### Three ways to stop identity-based attacks

1. **Implement MFA everywhere.** It is still one of the best defenses we have against sophisticated attacks.
2. **Augment with defense-in-depth tools. **These work in combination across the user, application, and network layers, such as scanning for bot traffic and breached passwords among your user base.
3. **Invest in a customer identity solution.** Embrace flexibility by default and customize security and ease of use depending on your risk appetite, user requirements, and implementation.

> 📈 [Download the report](https://auth0.com/resources/whitepapers/2022-state-of-secure-identity-report) for a deeper dive into insights gained from a platform that authenticated billions of logins each month.

### Methodology

This report is based on data from Okta customers using the Auth0 platform around the world and so represents real-world observations of identity attacks. The data was retrieved by Auth0's security researchers by running simple and anonymous queries against our aggregate database of operational telemetry. Industry segmentations are based upon each customer's self-reported segment. Observations are from the first 90 days of 2022 unless otherwise noted.

Top Insights From Our 2022 State of Secure Identity Report

Secure apps and protect users with enterprise scale account takeover protection

It’s 2022, yet passwords still remain the [most common form of authentication](https://www.idrnd.ai/5-authentication-methods-that-can-prevent-the-next-breach/) online. Like it or not, they are not going away anytime soon. Even if they’re becoming riskier than ever. The very fact that there are so many more applications that users have to register for and log in to makes password reuse across multiple sites even more likely for all but the most security-conscious users. No wonder that the threat of account takeovers (ATOs) [nearly doubled in 2020](https://www.techrepublic.com/article/account-takeover-attacks-spiked-in-2020-kaspersky-says/).

Breaches impact everybody. The average email address is now associated with [130 online accounts](https://www.linkedin.com/pulse/b2b-identity-software-deep-dive-clement-vouillon/?trackingId=C11skBW3qNhNTv25nHkiEQ%3D%3D). Chances are that a significant portion of your users are using the same or similar usernames and passwords as they use on other sites. So when a password gets leaked in a data breach, that same password, or a slight variation thereof, has a high chance of being successful at multiple other online accounts that the user owns. Even if your own site hasn’t been breached, there’s still a good chance that your users' information may be compromised due to a leak that occurred elsewhere. 

![Improve Detection Response](https://images.ctfassets.net/23aumh6u8s0i/KbvD9MBeJw2z9YfGaC2Rv/567a40c8cb1cf8cdf565aa3827030351/Credential-Guard_crop1.jpg)

With [Auth0 Credential Guard](https://www.auth0.com/breached-passwords#credential-guard), you can protect your applications from bad actors logging in with stolen credentials. You can alert the user about their compromised password, challenge the user using an additional factor, or block access by forcing a password reset. Typical breached password detection relies on breach data released to the public. From the time when a breach happens to when it’s announced, there is a gap (typically months) during which your users and business remain at risk. Credential Guard eliminates this gap: a team of dedicated security experts infiltrates criminal communities and gains access to exposed data as soon as breaches occur. With this advantage, you can better protect your users and secure your applications by resetting stolen passwords sooner.

## Improve Detection Response

A typical account takeover attempt is performed using bots that hit login screens that use credentials obtained in data dumps that follow breaches. These indiscriminate attacks account for [90% of ATO attempts](https://spycloud.com/resource/targeted-vs-automated-ato/), yet only inflict 20% of the losses that business incur due to breaches. Targeted attacks, on the other hand, are disproportionately costly, even though they are far fewer in number. These attacks use sophisticated and clandestine methods of obtaining passwords, using these compromised credentials to inflict damage long before there is any traceable record of the breach. Traditional breach detection services that use scanners and scrapers to identify leaked credentials are therefore of no use when it comes to these types of attacks.

Credential Guard counters this threat with a team of security experts that infiltrate the dark web to mine out the exposed information before criminals can monetize it. This unique capability allows us to identify ATO risks months, even years before breach data is made public. Given importance of timeliness in identifying targeted attacks, companies can secure their applications during login by detecting and resetting stolen passwords as soon as breaches happen

![Expand Reach Globally](https://images.ctfassets.net/23aumh6u8s0i/5lO6E741lPvTK11haSvP5Z/1c5d39145aa0fbc1741f624bb50041c9/Credential-Guard_crop2.jpg)

## Expand Reach Globally

Breached passwords are not only a threat to the companies’ applications but also their users. As mentioned above, users reuse passwords across multiple sites, so it’s not just an account that’s at risk but their entire online identity. 

Credential Guard automates the detection and remediation of breached passwords across more than 35 languages and 200+ countries and territories for global account protection.

## Improve Security Posture 

We all have heard ad nauseum about the trade-off between user experience (UX) and security. Human psychology tells us that we make choices based on perceived threat. When a threat goes from being abstract to real, we’re much more likely to take it seriously and adjust our behavior to account for it. The same user that scoffs at stronger authentication methods when there is no perceived risk might enthusiastically sign up for the same measure if the choice is presented at a time when the alternative was to lose control of their account. Companies can alert a user that their password has been leaked in a data breach, and then offer to improve their security posture enrolling in MFA, without risking conversion, impacting UX or retention.

![Secure Your Login Box, Protect Your Users](https://images.ctfassets.net/23aumh6u8s0i/1sJJusx7kMMHjOgw5Bv4zY/c889e692d0bb0be2a2d35a230f0fa4bc/Credential-Guard_crop3.jpg)

## Secure Your Login Box, Protect Your Users

As security enthusiasts, we know that passwords worry both users and app owners alike. Yet they persist, and will likely do so for the foreseeable future. Using Auth0 Credential Guard, companies can stay ahead of criminals trying to exploit breached passwords. It protects companies as well as users’ online identities, which are increasingly bound up with a single, widely used password. While password protection is no silver bullet, making password protection part of a strategy to improve authentication choices, companies can reduce chances of being breached by [up to 89%.](https://www.verizon.com/business/resources/reports/dbir/) 

Learn more about implementing Credential Guard [here](https://auth0.com/docs/secure/attack-protection/breached-password-detection).

<include src="asides/AboutAuth0" />

Detect Breached Passwords Faster with Auth0 Credential Guard

With Auth0’s Actions, it’s easy to ensure that users can sign up for an account only between a specific start date and end date.

Some applications have a limited lifetime. A website or app for limited-time events such as a conference, convention, or concert will only be useful when the event takes place. Since there’s no point in allowing people to sign up for an account after the event is over, you may want to limit registration to a specific set of dates.

It usually takes a considerable amount of work to limit the dates when new users could register an account. However, if you’re using Auth0 to authenticate your users, this task became a lot easier thanks to Actions!

Actions are a new feature that allows you to extend Auth0 beyond what it can do “out of the box”. They’re Node.js functions that you can add to various flows within Auth0’s processes, including logging in, changing passwords, and signing up for a new account. You write and store these functions in the Auth0 dashboard, where they’re part of your tenant’s settings, and Auth0’s servers execute them.

In this article’s exercise, you’ll learn how to write an Action that limits when users can sign up for an account for a specific application. If a user signs up for an account outside the defined valid registration period, their attempt to sign up will be canceled, and they will see a message explaining why.


## Prerequisites

You’ll need the following for this exercise:

- **Auth0 account:** Actions are an Auth0 feature, which means you need an Auth0 account to use them. <a href="https://auth0.com/signup" data-amp-replace="CLIENT_ID" data-amp-addparams="anonId=CLIENT_ID(cid-scope-cookie-fallback-name)">You can sign up for free,</a> and the process is pretty painless.
- **Any application that uses your Auth0 tenant to provide Universal Login.** Any web-based, mobile, or desktop application will do, just as long as it is one of your tenant’s applications. You’ll need it to log in and see how defining Actions changes how login works. If you don’t have any applications that use Auth0 for authentication, you can download one from the [Auth0 Quickstarts](https://auth0.com/docs/quickstarts/) page.


## Create a New Action

The first step in creating a new Action is navigating to the appropriate authentication flow. Do this by selecting **Actions** from the left-side menu, then select **Flows** from the sub-menu that appears:

![The Auth0 dashboard’s “Getting Started” page, with instructions to select “Actions” and “Flows” from the left side menu.](https://images.ctfassets.net/23aumh6u8s0i/6Fm12KNWxp84G1d0fo7Mwe/5a5e2ed7081685188631b9bd24210534/select_actions_then_select_flows.png)

You’ll be at the *Choose Flow* page, where you can select the flow for your Action. In this case, we want to create an Action that runs immediately after the user submits an email address and password to sign up for an account. Do this by selecting the **Pre User Registration** flow:

![The “Choose Flow” page, with an instruction to select “Pre User Registration”.](https://images.ctfassets.net/23aumh6u8s0i/1FuLu1sJEPZAkqr1NrCrs7/8687dc2967b23e8a8047e98fdcdb9b72/select_pre_user_registration.png)

This will take you to the *Pre User Registration* flow page, which contains a flowchart depicting the pre-user registration flow in the center of the page, and a column labeled *Add Action*, which lists Actions you can add to the flow.

It’s time to create an Action to add to the flow. Do this by clicking the **+** button in the *Add Action* column, then select **Build Custom** from the menu that appears:

![The “Pre User Registration” page, with instructions to click the “+” button, then select “Build Custom”.](https://images.ctfassets.net/23aumh6u8s0i/6oAnPkD7GIzbH7Xum2x4ra/03191b4a3cd51bbdc39e1cc073b65c6e/click_the_plus_button_then_build_custom.png)

The *Create Action* dialog box will appear. Give the Action an appropriate name in the **Name** field. I chose **Limit App 001 registration to Jan 2022**. Leave the **Trigger** and **Runtime** menus at their default settings, and click the **Create** button:

![The “Create Action” dialog box.](https://images.ctfassets.net/23aumh6u8s0i/185ogMV4v4tNO9darSqBPj/94ed284bac44add5983108887c3611f0/create_action.png)

You’ll be taken to the code editor for your newly created Action:

![The code editor for the newly created Action.](https://images.ctfassets.net/23aumh6u8s0i/4s2yJTUGUYJvQGWr7khSdV/389419f0fa32a28ff1968e33d4dfb1f9/code_editor.png)


## Write Code for the Action

Let’s write a quick specification for the Action before we code it.

The Action should:

- Only affect sign-ups for a given application. In this exercise, we’ll call it “App 001”. It should not affect sign-ups for any other applications in the tenant.
- Limit registration so that users can sign up for an account only between a given start date and end date. For this exercise, let’s limit registration to January 2022.
- If a user tries to sign up before or after the registration period above, their attempt should fail, and they should be shown a message explaining why.

Here’s the code that implements that specification. It limits registration to the month of January 2022. You should adjust the start and end dates for the registration period as you see fit:

```javascript
exports.onExecutePreUserRegistration = async (event, api) => {
  if (event.client.client_id === /* CLIENT ID GOES HERE */) {
    // Remember, Date objects are GMT by default!
    const startDate = new Date(/* START DATE/TIME GOES HERE */) 
    const endDate = new Date(/* END DATE/TIME GOES HERE */)
    const now = new Date()

    if (now < startDate || now > endDate) {
      const LOG_MESSAGE = "APP 001 registration outside January 2022"
      const USER_MESSAGE = "Registration for this app is limited to January 2022."
      api.access.deny(LOG_MESSAGE, USER_MESSAGE)
    }
  }
}
```

You’ll need to customize the code above for your situation:

- Replace the `/* CLIENT ID GOES HERE */` comment with the application’s client ID that this Action should apply to. The Auth0 dashboard’s *Applications* list (select **Applications** → **Applications** from the menu on the left side of the page) shows the client ID of every application in your tenant.

![Copying a client ID from the “Applications” page.](https://images.ctfassets.net/23aumh6u8s0i/3p7mcb0rAUFt1zl8eSV8Uf/2234916fcfe8217c85d685fdd20fe10d/copy_client_id.png)

- Replace the `/* START DATE/TIME GOES HERE */` comment with the date and time of the start of the valid registration period. Since we want to limit registration to January 2022, use a start date value of “2021-01-01T00:00:00”.
- Replace the `/* END DATE/TIME GOES HERE */` comment with the date and time of the start of the valid registration period. For this exercise, use an end date value of “2021-01-31T23:59:59”.

Auth0 calls the `onExecutePreUserRegistration()` function just after the user has provided an email address and password to sign up for an account but before the account is created. Any code entered into this function can examine the credentials provided by the user or use any other information to decide if the registration should take place or be canceled.

`onExecutePreUserRegistration()` takes two parameters, whose properties you can use to perform tasks prior to the user being registered:

1. `event`: An object that contains details about the request to register a new user. The Action uses `event` ’s `client.client_id` property to identify the application that triggered it. Remember, the limited registration period should apply only to App 001.
2. `api`: An object with methods that you can use to change the behavior of the Pre User Registration flow. The Action uses `api`’s `access.deny()` method to cancel registration. `access.deny()` has two parameters:
  - `reason`: A string containing an *internal-facing* reason why registration is being canceled. This value will appear in your tenant’s logs.
  - `userMessage`: A string containing an *external-facing* reason why registration is being canceled. This value will be displayed to the user to explain why they can’t sign up for a new account.

With the code entered, click the **Deploy** button to save it. 


## Add the Action to the Flow

Now that you now have a working Action, it’s time to incorporate it into the flow.

Go back to the *Pre User Registration* page. There are a couple of ways to do this:

- Select **Actions** → **Flows** from the menu on the left side of the page, then click on **Pre User Registration**.
- If it’s onscreen, click on the **Back to Flow** link. It will be near the upper left corner of the code editor).

Once you’re on the *Pre User Registration* page, you should see the Action you just created in the *Add Action* column:

![The “Pre User Registration” flow, with an instruction to start dragging the newly-created action.](https://images.ctfassets.net/23aumh6u8s0i/7fNARXSPtCo7Gt0gwinM9h/682c304760f28e3dc3c250f484885b44/pre_user_registration_flow_1.png)

Drag the Action into the flow, as shown in the screenshots above and below.

![The “Pre User Registration” flow, with an instruction to drag the newly-created action into the flow.](https://images.ctfassets.net/23aumh6u8s0i/p6eeehO3r4ZHl2kMrRSSu/90a3d139cca604a9c7430ead524dc1e1/pre_user_registration_flow_2.png)

Click the **Apply** button near the upper right corner of the page. The change you just made to the flow will not take effect until you do so.


## Try to Sign Up for an Account

At this point, your Action is now part of the Pre User Registration flow. Whenever a user submits their email address and password to sign up for a new account, your Action will be triggered and execute its code.

Run the app that you wrote the Action for. Sign up for a new account instead of logging in when you reach the login screen. As long as the current date is outside your Action’s start date and end date, you should be able to enter any valid email address and password because the registration will never happen. You should see the following instead:

![The login box for the application, with a message under the “Password” field that says “Registration for this app is limited to January 2022.”](https://images.ctfassets.net/23aumh6u8s0i/w362yU7dfAnTDbLT42YHU/a2dcb648b06602cd95583cd5c2bbf591/sign-in_canceled.png)


## Experiment!

Now that you know the basics of restricting new registrations, you might want to try some different test conditions, such as:

- **Limiting sign-ups to users in specific countries.** There may be legal, business, or security reasons for letting only users in specific countries sign up for an account. The `event` object provides a lot of information about the request to create a new user account, including the user’s geographical location based on their IP address, which you can access using `event.request.geoip.countryName`. Check out our article, [*Country-Based Access with Auth0 Actions*](https://auth0.com/blog/country-based-access-with-auth0-actions/), to see how you can apply this technique to logins.
- **Disallowing sign-ups from certain IP addresses.** If you see a lot of malicious activity from certain IP addresses, you can block their sign-up requests. This is another use case where the `event` object comes in handy. Use `event.request.ip` to determine the address of the user attempting to register and deny their registration if it appears in a list of known malicious addresses.
- **Limiting sign-ups to weekdays.** You can use JavaScript’s `getDay()` function to see if the current date/time falls is a weekend day. Keep in mind that while Saturday (for which `getDay()` returns `6`) and Sunday (for which `getDay()` returns `0`) constitute the weekend in most places, some regions have different weekend days. Once again, you may also have to account for time zone differences.

Limit User Registration to Specific Dates with Auth0 Actions

auziros:jeana-tahnk

Jeana has been in the tech industry for 15+ years, both as a communications professional and writer. As Director of Global Communications at Auth0, she works with her internal team and external agencies to amplify the company's visibility worldwide and establish its leadership in the identity industry. When she is not working, she can most likely be found on a field watching one of her three kids playing sports, or cleaning up after her one-year-old retriever who chews everything.

Senior Director, Global Communications

Jeana Tahnk

New feature adds a dedicated security team and support for multiple languages to prevent fraudulent access with stolen credentials

**BELLEVUE, Wash. – February 9, 2022 – [Auth0](https://auth0.com/)**, a product unit within [Okta](https://www.okta.com/) (NASDAQ: OKTA), today announced the general availability of [Credential Guard](https://www.auth0.com/breached-passwords#credential-guard), a new security feature that helps enterprises prevent account takeover attacks by detecting and resetting stolen passwords faster. Credential Guard upgrades Auth0’s existing breached password detection with a dedicated security team, and support for more than 35 languages and 200+ countries and territories to reduce breach detection time.

Credential Guard gives application builders the tools to help secure their apps and to help protect their users from bad actors logging in with stolen credentials. Auth0’s breached password detection enables organizations to automatically screen for stolen passwords, and alert the user, prompt for additional verification, or block access by forcing a password reset. Credential Guard adds even more visibility and speed with a dedicated security team that infiltrates criminal communities to gain access to otherwise unavailable breach data.

Auth0’s security team conducted an internal test on 100,000 random usernames, and found that the ability to detect breached passwords (breach detection efficacy) increased by a minimum of 250% when using Credential Guard compared to an automated detection solution alone.

“The goal with Credential Guard is to help organizations detect breaches as soon as they happen, to reduce the risk to the business and its users,” said Shiv Ramji, Chief Product Officer at Auth0. “Traditional web scanners and scrapers rely on breach data being made public, which can be months or even years after the initial breach. Credential Guard enables security teams to shrink that gap, and better protect their customers’ digital identities on a global scale.”

Account takeover attacks with stolen credentials, targeting everything from sensitive healthcare data to loyalty points, are one of the most common and costly cyber threats. Verizon’s 2021 [Data Breach Investigations Report](https://www.verizon.com/business/resources/reports/dbir/) (DBIR) found that 89% of web application breaches involve some sort of credential abuse (use of stolen credentials or brute force). Reusing passwords across sites increases the risk of an attack and makes it more difficult for organizations to prevent fraudulent access to user accounts. With Credential Guard, organizations can secure their apps and protect their users during the login process by detecting and resetting exposed passwords before they fall into the wrong hands.

Credential Guard is available as an Enterprise Add-on for existing Auth0 customers. For more information, please visit the [Auth0 blog](https://auth0.com/blog/detect-breached-passwords-faster-with-auth0-credential-guard/).

<include src="asides/AboutAuth0" />

## About Okta

Okta is the leading independent identity provider. The Okta Identity Cloud enables organizations to securely connect the right people to the right technologies at the right time. With more than 7,000 pre-built integrations to applications and infrastructure providers, Okta provides simple and secure access to people and organizations everywhere, giving them the confidence to reach their full potential. More than 14,000 organizations, including JetBlue, Nordstrom, Siemens, Slack, Takeda, Teach for America, and Twilio, trust Okta to help protect the identities of their workforces and customers.

### Media Contacts

Global Communications<br />
Auth0 <br />
[press@auth0.com](mailto:press@auth0.com)<br />

### Investor Contact

Investor Relations<br />
[investor@okta.com](mailto:investor@okta.com)<br />

<br>
<div class="alert alert-info alert-icon">
  These materials and any recommendations within are not legal, privacy, security, compliance, or business advice. These materials are intended for general informational purposes only and may not reflect the most current security, privacy, and legal developments nor all relevant issues. You are responsible for obtaining legal, security, privacy, compliance, or business advice from your own lawyer or other professional advisor and should not rely on the recommendations herein. Okta is not liable to you for any loss or damages that may result from your implementation of any recommendations in these materials. Okta makes no representations, warranties, or other assurances regarding the content of these materials. Information regarding Okta's contractual assurances to its customers can be found at <a href="https://www.okta.com/agreements/">okta.com/agreements</a>.<br> 
</div>



Auth0 Credential Guard Detects Breached Passwords Faster to Prevent Account Takeover

Learn about the three kinds of information stored with each Auth0 user account and how to access them in your Android apps.

Working with Auth0 User Profile Information and Metadata in Android Apps

Vittorio

Vittorio Bertocci is a Principal Architect for Auth0. Before Auth0, he had a lengthy career with Microsoft, where Vittorio worked with Fortune 100 and Global 100 companies, including working on Microsoft’s Azure Active Directory team as principal program manager focusing on the developer experience. He contributed to the inception and launch of Microsoft's claims-based platform components (Windows Identity Foundation and ADFS, ADAL and MSAL SDKs, ASP.NET middleware). Vittorio is a well known speaker, educator and published author.

Principal Architect

Vittorio Bertocci

A first-person account of how modern open identity standards are made

From Idea to Standard: How the JWT Profile for OAuth 2.0 Access Tokens Became RFC9068

arthur-bellore

I’m a tech content creator. I enjoy breaking up seemingly complicated topics into easy-to-understand pieces for people to read. When I’m not in front of a computer, you’ll usually find me reading books.

Cybersec Writer

Arthur Bellore

With modern computers capable of testing millions of password combinations per second, securing your online accounts with only a password may not be sufficient anymore.

The Working Principles of 2FA (2-Factor Authentication) Software

abhishek-hingnikar

I am a Specialist Solutions Engineer at Auth0. I specialize in Identity and Access Management and enjoy building software. I have experience developing software in several frameworks and a variety of domains. I enjoy traveling, cooking, and building robots!

Specialist Solutions Engineer

Abhishek Hingnikar

Learn about Apple's new One Tap Account Upgrades presented at WWDC 2020



For the average person, it’s a monumental task to constantly monitor if any of their accounts have been affected by a breach. Because [password reuse](https://securityboulevard.com/2020/04/8-scary-statistics-about-the-password-reuse-problem/) is an unfortunately extremely common practice, it becomes even more challenging to monitor all of the accounts that may be using the same credentials as the one involved in a breach.

On top of this, some passwords may not have been involved in a breach, but are still weak and should be updated. Some people have hundreds of accounts across all of their applications, so how can they possibly keep track of all of these credentials and make sure they aren’t vulnerable to an attack?

Apple aims to solve this problem with One Tap Account Upgrades.

At [WWDC 2020](https://developer.apple.com/wwdc20/), Apple announced some huge upgrades to how iOS manages passwords. These upgrades aim to alleviate some of the challenges faced by password management. In this article, we’ll look at Apple’s recent announcements on password upgrades, why they matter, and how they work behind the scenes.

## What’s with Apple and Passwords?

Apple users often rely on Keychain and iCloud Keychain, Apple’s built-in credentials management system, to store and manage their passwords. Keychain is integrated deep within all of their operating systems and powers features such as WiFi hotspot credential sharing, beyond just being a password manager.

This year, Apple added several capabilities to Keychain related to breached or weak password detection and mitigation. Keychain now monitors for weak, re-used, or breached passwords, notifies the user regarding a breach, and offers mitigation options right away.

<div class="row">
  <div class="col-sm-6">
    <img src="https://images.ctfassets.net/23aumh6u8s0i/55jOFPkV1LnvLEWpp9PLmD/582968258c37e5d1dea08b2b0c62f860/keychain-homescreen-iOS-14" alt="Apple Keychain homescreen" style="padding:20px 0;"/>  
  </div>
  <div class="col-sm-6">
    <img src="https://images.ctfassets.net/23aumh6u8s0i/7qJW5Rx3iAn46QmfCHmm6n/f87c675e5da4326b613f6f3a163acc78/keychain-suggestions-screen" alt="Apple Keychain password suggestion screen" style="padding:20px 0;"/>
  </div>
</div>
<div class="row">
  <div class="col-sm-offset-3 col-sm-6">
    <img src="https://images.ctfassets.net/23aumh6u8s0i/61eqEuOhA40P8QaeWnY8fF/afc3ff16294e1aa1383315fbf45ac68f/keychain-mitigation-options" alt="Apple Keychain easily guessed reused password" style="padding:20px 0;"/>
  </div>
</div>

The ability to check if your credentials or information were found in a breach is a great step towards mitigating the threats caused by a breach. Users have been able to check if they were affected by a breach using 3rd party password managers like 1Password or by checking websites like [haveibeenpwned.com](https://haveibeenpwned.com). Breached password detection is also offered by some service providers, such as [Auth0’s breached password detection](https://auth0.com/breached-passwords). With Apple’s recent announcement, this security feature has now been introduced to more than one billion iOS devices. 

When it comes to handling a breach, notifying the user is only half of the problem. The other half is mitigating the threat. When a breached credential is detected, a user has to mitigate the threat by resetting the password manually, which can involve several steps. Apple intends to offer a one-tap mitigation to remove this burden on the user. 

## Easy Mitigation of Breached Credentials

One of the easiest ways to encourage a user to do something is to offer them a call to action (CTA) right away. Many password reset experiences are long and time-consuming, and some even require you to enter the answer to a secret security question that you set up ages ago!

Apple solves this problem by offering a CTA right in the report, inviting the user to mitigate the threat immediately. If a breached or weak password is detected, Keychain offers you a simple button that will replace the weak password with a new one or offer you to upgrade to Sign in with Apple. The image below demonstrates what happens when Keychain detects a weak password. 

<div class="row">
  <div class="col-sm-offset-3 col-sm-6">
    <img src="https://images.ctfassets.net/23aumh6u8s0i/5cTx5qLP0kqWYqvGciEYMy/8550e1b88ebfb7b25f057c1581c8350a/password-upgrade-option" alt="Apple Keychain easily guessed weak password" style="padding:20px 0;"/>
  </div>
</div>

For this to work, there are two requirements:

- The app must be installed on iOS 
- The app must offer an Account Upgrades Extension that offers the Upgrade to Strong Password capability

In addition to this, Apple introduced another call to action for apps that support Sign in with Apple. If your app supports it, Keychain will now offer a quick and easy way to upgrade the user’s account to Sign in with Apple with just the click of a button. Now, the user doesn’t have to worry about managing another username and password for that application!

It's exciting to see these password security upgrades. My personal wishlist for these features would include an experience similar to [App Clips](https://developer.apple.com/app-clips/), but for account upgrades. App Clips are Apple’s ephemeral apps, which means you do not need to install the full application to use them. App Clips offer a great balance between opening a web page and installing an app. If you want to learn more about App Clips, keep an eye out for our upcoming blog post on App Clips.

For now, let’s look at how Account Upgrades work and some of the options Apple is offering to enhance password security:

- Upgrade to Strong Password
- Upgrade to Sign in with Apple
- In-App Upgrades

## How do Account Upgrades work? 

Apple uses something called an App Extension to power the button that upgrades a weak password to Sign in with Apple. 
If you are unfamiliar with iOS nitty-gritty, an App Extension can be thought of as a service, intent, or an action handler. These are single-purpose micro-apps with specific entry and exit points. They are iOS triggered events that let a developer return a custom action in response. This is similar in concept to Auth0’s Hooks and Rules, but in this case, all of this is on the iOS client.

Some App Extension examples include Account Upgrade, SSO Capabilities, and more. Let’s take a closer look at the Account Upgrade Extension introduced in WWDC 2020.

**The Account Upgrade Extension has four tasks:**

- Present the UI to accommodate extra steps when changing the password.
- Upgrade the user’s password. 
- Present the UI to accommodate extra steps when changing the password. 
- Upgrade the user’s account to use Sign in with Apple.
- To implement Account Upgrade Extension, you simply add a new target and select “Account Upgrade Extension”.
- XCode then generates a template extension file, which includes each task as a single function handler. You are then expected to provide the business logic to perform the tasks. XCode will also generate an `Info.plist` file for the extension that informs iOS about the individual capabilities for account upgrades offered by this extension.

Next, let’s look at how the Upgrade to Strong Password feature works.

## Upgrade to Strong Password 

Programmatically, the Upgrade to Strong Password flow is similar to how the Account Upgrade to Sign in with Apple described in the previous section works.

On a high level, the Upgrade to Strong Password flow works as follows:

- User taps on the "Upgrade to Strong Password" button
- iOS will generate a strong password 
- Optionally, you can define the specific criteria for this password
- iOS then activates your extension and calls `changePasswordWithoutUserInteraction` with the existing set of credentials and the new set of generated credentials. 
- At this point, your application needs to perform additional steps, such as calling an API, to actually finish this operation. Some next steps may include:
  - Check if the credentials don’t exist with `.credentialIdentityNotFound`
  - If second-factor authentication is required, you can respond with `.userInteractionRequired`
  - In any other error scenario, you can respond with `.failed`
  - Lastly, if everything goes correctly, you should invoke the `completeChangePasswordRequest` with the new set of credentials. This tells iOS that the process has successfully completed, at which point iOS will update its copy.
- If your application responds with `.userInteractionRequired`, iOS will call `prepareInterfaceToChangePassword` to actually update the password.

The screenshots below show the Upgrade to Strong Password process in action. The “Easily guessed password warning” is displayed in the application. The user clicks “Change to Strong Password”, then the password is updated.

<div class="row">
  <div class="col-sm-6">
    <img src="https://images.ctfassets.net/23aumh6u8s0i/5cTx5qLP0kqWYqvGciEYMy/8550e1b88ebfb7b25f057c1581c8350a/password-upgrade-option" alt="Apple Keychain change to strong password upgrade" style="padding:20px 0;"/>  
  </div>
  <div class="col-sm-6">
    <img src="https://images.ctfassets.net/23aumh6u8s0i/7tbnmBMMube9CZcJ4KDstZ/78e58802767c32d832636129ed905cdc/password-upgrade-confirmation-prompt" alt="Apple Keychain password upgrade confirmation" style="padding:20px 0;"/>
  </div>
</div>
<div class="row">
  <div class="col-sm-offset-3 col-sm-6">
    <img src="https://images.ctfassets.net/23aumh6u8s0i/3u0QxLw46MmkYvMablSZSp/5e5b30638f1c5e2b9549389199621a0d/password-upgrade-final-screen" alt="Apple Keychain account using strong password screen" style="padding:20px 0;"/>
  </div>
</div>

Here is an example of what the Upgrade to Strong Password would look like in your application code:

```swift
override func changePasswordWithoutUserInteraction(for serviceIdentifier: ASCredentialServiceIdentifier, existingCredential: ASPasswordCredential, newPassword: String, userInfo: [AnyHashable : Any]? = nil) {
  changePassword(existingCredentials, newPassword, userInfo) { result in
    switch (result) {
      case .error(let errorCode):
        self.extensionContext.cancelRequest(withError: NSError(domain: ASExtensionErrorDomain, code: errorCode))
      case .success(_):
        let newCredential = ASPasswordCredential(
          user: existingCredential.user, 
          password: newPassword
        )
        self.extensionContext.completeChangePasswordRequest(
          updatedCredential: newCredential
        )
    }
  }
}
```

Let’s break it down a bit.

- `changePassword` performs the actual operations for changing the user’s password.
- If the result fails, it responds by canceling the request and showing the error to the user.
- If the API change was successful, it will notify iOS regarding the state of the change.

Next, let’s look at how Upgrade to Sign in with Apple works.

## Upgrade to Sign in with Apple

The Upgrade to Sign in with Apple flow is almost exactly the same. However, instead of a new set of credentials, iOS provides the original set of credentials and offers a way to perform Sign in With Apple interactions without having to start the application.

This interaction is slightly different from the usual Sign in with Apple flow when signing up or logging the user in. It explicitly informs the user about the action being taken and that their information from the past account will be linked to the new identity.

The flow is as follows:

- The user taps on Upgrade to Sign in with Apple.
- iOS will invoke convertAccountToSignInWithAppleWithoutUserInteraction with the set of existing credentials.
- Like the password reset, you can respond with the appropriate error, and iOS will offer to perform second-factor authentication or inform the user.
- Once this flow is complete, it’s important to note that Keychain will remove the password from its store. From this point, the user is supposed to use Sign in With Apple.

<div class="row">
  <div class="col-sm-6">
    <img src="https://images.ctfassets.net/23aumh6u8s0i/2fsp4SpqEmZyKVRusBZCtH/1c0eba802069d5be8fff6091723e7fe0/siwa-upgrade-option" alt="Apple Keychain easily guessed password" style="padding:20px 0;"/>  
  </div>
  <div class="col-sm-6">
    <img src="https://images.ctfassets.net/23aumh6u8s0i/pcTJO06Uz5EI1qmzm7UZD/0f158138f66b396ee3db7e5b2e312348/siwa-upgrade-action" alt="Apple Keychain SIWA upgrade" style="padding:20px 0;"/>
  </div>
</div>

Let's walk through some of the code that could be used to accomplish this:

```swift
override func convertAccountToSignInWithAppleWithoutUserInteraction(for serviceIdentifier: ASCredentialServiceIdentifier, existingCredential: ASPasswordCredential, userInfo: [AnyHashable : Any]? = nil) {
  let challenge = validateExistingAccountAndPrepareForUpgrade(existingCredentials, userInfo)
  self.extensionContext.getSignInWithAppleUpgradeAuthorization(
    state: challenge.state, 
    nonce: challenge.nonce
    ) { (authorization, error) in
      if error != nil {
        // Handle error
        self.extensionContext.cancelRequest(withError: NSError(domain: ASExtensionErrorDomain, code: ASExtensionError.failed.rawValue))

        return
      }

      // handle the authorization 
      upgradeAccount(challenge, authorization) { error in
        if error != nil {
          // Handle error
          self.extensionContext.cancelRequest(withError: NSError(domain: ASExtensionErrorDomain, code: ASExtensionError.failed.rawValue))

          return
        }

        self.extensionContext.completeUpgradeToSignInWithApple(userInfo: nil)
      }
    }
  }
}
```

Let’s break it down a bit.

- `validateExistingAccountAndPrepareForUpgrade` performs the actual operations for changing the user’s password.
- If the result fails, it responds by canceling the request and showing the error to the user.
- If the API change was successful, it will request Sign in with Apple authorization using `getSignInWithAppleUpgradeAuthorization` on `extensionContext`.
- If this is successful, it will then try to upgrade the accounts.

## In-App Upgrades
 
Since the underlying API is an extension, Apple also allows you to leverage the extension you have built from within your application. When doing so, you do not access the password, as your application should have already logged the user in.

You can do this as follows:

```swift
class ASInAppSIWALinkHelper: NSObject, ASAccountAuthenticationModificationControllerDelegate {
  var controller: ASAccountAuthenticationModificationController =  ASAccountAuthenticationModificationController()
  
  func accountAuthenticationModificationController(_ controller: ASAccountAuthenticationModificationController, didFail request: ASAccountAuthenticationModificationRequest, error: Error) {
    print("Error \(error) \(request.description)")
  }
  func accountAuthenticationModificationController(_ controller: ASAccountAuthenticationModificationController, didSuccessfullyComplete request: ASAccountAuthenticationModificationRequest, userInfo: [AnyHashable : Any]? = nil) {
    print("Success \(String(describing: userInfo))")
  }
  
  func siwaUpgrade() {
    print("Attempt")
    let userInfo = ["someid": "foobar"]
    let siwaUpgrade = ASAccountAuthenticationModificationReplacePasswordWithSignInWithAppleRequest(
        user: userIdenitifer,
        serviceIdentifier: ASCredentialServiceIdentifier(
            identifier: "yourdomain.com",
            type: .domain
        ),
        userInfo: userInfo
    )
    controller.delegate = self
    controller.perform(siwaUpgrade)
  }
}
```

Note that you are only sending the user’s identifier to the extension here. The app should retrieve the existing credentials from Keychain (or any storage mechanism) and use that token instead. The code for the upgrade will stay the same for the rest. This means that you can re-use most of your logic for In-App Upgrades as well as Keychain-initiated upgrades.

## Security Concerns

As of writing this, the API for these features is currently in beta. iOS 14 is due to release in September, so we may see some changes in the APIs by then. In their current state, there are some concerns regarding these APIs.

One concern is that the Upgrade Password request does not allow the use of more modern password resetting flows, such as sending a [one-time password reset link](https://auth0.com/docs/mfa/guides/configure-otp) through email or some other verifiable factor.  Additionally, in case of a breached credential, an attacker would be able to use the same API to potentially take over the account. While [second-factor password](https://auth0.com/docs/mfa) does offer protection here, you should implement some sort of second-factor before allowing either interaction.

## Conclusion

Apple has released several welcome changes to the Keychain that all iOS users can benefit from. This improves security for everyone on iOS. However, there are still some concerns to be resolved and design decisions to accommodate these solutions.

How would you use these extensions and enhancements in your application? What does your password reset experience look like? Do you wish to offer account upgrades in your app? Let us know in the comments below!

<include src="asides/AboutAuth0" />

**Sources**

- [Apple Developer Documentation](https://developer.apple.com/documentation/authenticationservices/asaccountauthenticationmodificationviewcontroller) for `ASAccountAuthenticationModificationViewController`
- [WWDC 2020 One-tap account security upgrades presentation](https://developer.apple.com/videos/play/wwdc2020/10666/)


Apple One Tap Account Upgrades from WWDC 2020

5e074956ee8ba1fea26e30d28c190495?s=300 avatar

5e074956ee8ba1fea26e30d28c190495?s=300

Full stack developer creating content at Auth0. I love taking a deep dive into hard-to-understand concepts and creating content that makes them easier to grasp. In my free time you can usually find me reading, hanging out with my dogs, or curling in the squat rack.

Former Developer Content Manager

Holly Guevara

Find out how you can handle the Instagram API deprecation using Auth0's account linking feature.



## Legacy Instagram API Deprecation

The [Legacy Instagram API](https://www.instagram.com/developer/) will be shutting down on **March 31, 2020**, in favor of the [Instagram Graph API](https://developers.facebook.com/docs/instagram-api) and [Instagram Basic Display API](https://developers.facebook.com/docs/instagram-basic-display-api).

This means that if you have implemented [Instagram authentication through the legacy API](https://www.instagram.com/developer/authentication/), your Instagram users will no longer be able to sign in to your application starting March 31, 2020.

Instagram now requires developers to use the [Facebook Login](https://developers.facebook.com/docs/instagram-api/getting-started) flow instead, so you'll need to re-implement authentication using the [Instagram Graph API](https://developers.facebook.com/docs/instagram-api) and re-submit your application to Instagram for review.

The new [Instagram Basic Display API](https://developers.facebook.com/docs/instagram-basic-display-api/) does allow you to get a user access token, but this cannot be used for authentication. As noted in the [Instagram documentation](https://developers.facebook.com/docs/instagram-basic-display-api):

> Note: Instagram Basic Display is not an authentication solution. Data returned by the API cannot be used to authenticate your app users or log them into your app. If you need an authentication solution, we recommend using Facebook Login instead.

If you try to do this anyway, your application will be rejected at the review stage.

These changes can cause a headache if you have users that are still using the legacy Instagram login, and you haven't had time to implement Facebook Login instead. Fortunately, Auth0 has a simple solution.

## How Auth0 can Handle Instagram API Deprecation

If you're still using the Legacy Instagram API for Instagram login, you can take advantage of [Auth0's user account linking](https://auth0.com/docs/users/concepts/overview-user-account-linking) feature for a quick fix.

### What is account linking

Auth0 offers a simple way to take two or more separate accounts and [link them into one profile](https://auth0.com/docs/users/concepts/overview-user-account-linking#automatic-account-linking). For example, when a user logs in with email and password, you can [create a rule](https://auth0.com/docs/rules) that automatically links any other accounts using that same email.

### Account linking for Instagram

If you have users that are only using Instagram for login and you're using the Legacy Instagram API, you can still take advantage of account linking, even though they don't yet have another account to link.

You can create a [user-initiated account linking](https://auth0.com/docs/users/concepts/overview-user-account-linking#user-initiated-account-linking) solution that runs when a user tries to sign in with Instagram.

Once they log in, you'll display a message that they will no longer be able to sign in to their account after March 31, 2020, and they need to choose another method such as email/password or a different social provider.

You'll list the authentication options on that page so that the user can sign up right then. After they sign in with their new account, you'll then be able to link the old Instagram account to the new account.

![Auth0 account linking](https://images.ctfassets.net/23aumh6u8s0i/5x4IVeFoam2v0q55S8TiqT/722bc8ad4fbae49e98f0184c2ea85353/spa-user-settings)

Now, the user will still be able to access their account, and you won't need to go through the trouble of migrating to the new Instagram API if you're only using it for authentication.

> Note: The first step in this method requires the user to still authenticate with Instagram. If you'd like to take advantage of Auth0's account linking, you must notify your users of the upcoming change and instruct them to create their new account before March 31, 2020.

<include src="asides/AboutAuth0" />

If you have any questions about account linking with Auth0, please reach out in the comments or click the "Talk to Sales" button in the header. You can also <a href="https://auth0.com/signup" data-amp-replace="CLIENT_ID" data-amp-addparams="anonId=CLIENT_ID(cid-scope-cookie-fallback-name)">sign up for a free Auth0 account</a> now to explore the dashboard.


Handling Instagram API Deprecation with Auth0 Account Linking

adam-nunn

I'm a security and compliance professional with a passion for emerging cloud technologies. I specialize in risk, privacy regulations, and industry-standard security frameworks.

Sr. Director of Governance, Risk, and Compliance

Adam Nunn

Executives are being held to account by regulators and seeking to shape the law


In January 2020, the FTC released a [statement](https://www.ftc.gov/news-events/blogs/business-blog/2020/01/new-improved-ftc-data-security-orders-better-guidance) defining its new position on data security orders, to give companies a clearer understanding of the FTC’s expectations for security practices. The new orders specifically emphasize the role of executives in taking responsibility for overseeing policy, in the hopes that C-Suite and board-level buy-in will improve compliance.

Under the new orders, companies must present their board with an annual report on their security program, and senior officers must directly provide the FTC with certifications of compliance. According to the FTC’s statement, “This will force senior managers to gather detailed information about the company’s information security program, so they can personally corroborate compliance with an order’s key provisions each year.”

The FTC asserts that requiring high-ranking executives to provide certifications under oath has been effective in other sectors, such as securities law since it creates direct accountability for individual executives. They cite two studies that correlate executive involvement in data security with a decrease in breaches, including one that found a 35% decrease in the probability of breaches when a company’s Chief Information Security Officer is in the top management team and has access to the board.

<include src="TweetQuote" quoteText="Find out why the @FTC’s new data security orders will require the C-suite and board to strengthen data security strategies."/>

## Executives Are Influenced by Policy and Are Influencing It

PWC’s [Top Policy Trends 2020](https://www.pwc.com/us/toppolicytrends) report surveyed over 400 CEOs, CFOs, and COOs, and concluded that data is “the unifying thread” across all the major policy areas the C-Suite is concerned within 2020. Specifically, the report highlighted data privacy as a central concern for the C-Suite, with 44% of CEOs listing it as one of the top three policies impacting their business the most.

For the past two years, organizations have been forced to adapt their data policies to a rapidly evolving regulatory landscape, most notably the EU’s [General Data Protection Regulation (GDPR)](https://auth0.com/docs/compliance/gdpr) and the [California Consumer Protection Act (CCPA)](https://auth0.com/resources/whitepapers/simple-guide-CCPA-compliance). Most executives recognize the need for greater regulation on how businesses collect, store, share, and protect sensitive personal data. However, many are also worried that a global patchwork of contradictory regulations could hamstring their ability to operate their businesses across various jurisdictions and hope to work toward more universal standards for data privacy and security. Indeed, of the C-Suite executives PWC surveyed, close to 70% say their organization is “very actively” seeking to shape data privacy policy.

While it’s healthy for executives to help create laws that are informed by the reality of doing business, business leaders must exercise care in attempting to influence legislation, or risk a backlash. A prime example is CCPA, which in its current form is significantly weaker than the original ballot referendum, which would have granted Californians more rights.

While fines under CCPA can still be significant, one of the initiative’s drafters, [Mary Stone Ross](https://www.fastcompany.com/90444501/i-helped-draft-californias-new-privacy-law-heres-why-it-doesnt-go-far-enough), publicly criticized corporate lobbyists for their role in drafting the final legislation.  Ross voiced the hope that new laws at the state and federal level would “learn from California and guard against the relentless efforts of corporations to weaken people’s rights.” In the long-term, this negative perception of corporate influence erodes public trust and makes it more difficult for businesses to wield their influence responsibly. Already, [CCPA 2.0](https://www.barrons.com/articles/california-consumer-privacy-act-alastair-mactaggarts-51576779571), which gives consumers more rights and increased enforcement powers, is set to be a ballot initiative in 2020. 
Policy aside, the public at large is increasingly sensitive to businesses whose actions don’t live up to their professed values. When Facebook’s stock tumbled 7% in January, despite strong quarterly revenue, [_The Guardian_](https://www.theguardian.com/technology/2020/jan/29/facebook-fourth-quarter-earnings-stock) suggested that “continuing scandals and regulatory roadblocks may finally be catching up with the social media giant.”

## Strategies for the C-Suite to Lead on Data Privacy
In the second edition of [_Navigating the Digital Age_](http://securityroundtable.org/ndte/ndte2.pdf), published by Palo Alto Networks and the NYSE, experts and executives from across various tech sectors joined together in a clarion call for greater innovation, collaboration, and leadership on issues of privacy and security. Their advice ranges from big picture ideas (the word “moonshot” appears 28 times) to small but crucial suggestions for improvement.

In his chapter, security advisory Marc Goodman advises leaders to pay attention to the UX of cybersecurity, since the design of many legacy security programs is “abysmal and painful.” The design of a pop-up security warning window might seem insignificant, but if it’s all that’s standing between your employee and a catastrophic security mistake, it’s a big deal. Says Goodman: “It’s not enough that our security protocols work in theory; they have to work where the rubber meets the road at the end of a keyboard... And that requires a good understanding of human behavior—something infrequently accounted for in organizational cybersecurity strategies.”

<include src="TweetQuote" quoteText="@FTC ordered the C-Suite and board to get more involved with data security. Why IAM is a strong place to start."/>

One subject that many experts mention as a lynchpin in transforming cybersecurity is authentication. Ann Johnson, Microsoft’s Corporate Vice President of Cybersecurity Solutions, writes that one of the most encouraging current developments in cybersecurity is “the imminent demise of passwords.” This outdated and breach-prone form of authentication is “giving way to biometrics and other steps in multi-factor authentication, making it harder for bad actors to penetrate our firewalls and grab our personally identifiable information, intellectual property, and digital assets of every format.” Of course, experts have been predicting the demise of passwords for ages, but until that day actually comes, it’s crucial to do a better job of securing usernames and passwords.

There’s a growing consensus that sophisticated Identity and Authentication Management (IAM) platforms offer executives a fast and comprehensive way to get control of data and step up security. That consensus is largely responsible for [Auth0’s explosive](https://auth0.com/blog/auth0-closes-103m-in-funding-passes-1b-valuation/) growth in recent years. As [Auth0 customer Rolf Bekkstrand](https://auth0.com/blog/the-real-roi-of-auth0-part-3-security/) attested, “As a CTO, I really don't want to be responsible for a data leak that showed passwords and user logins and those kinds of things. I'm 100% sure that Auth0, a company that is built around this, will have better ability to take care of the security than I'm able to do — your entire business depends on it.”

## To Get Involved With Data Privacy, Start by Getting Educated
For the C-Suite, taking the lead on issues of data privacy and cybersecurity begins with listening. Executives must listen to their users’ concerns, and they must also seek out opportunities for expert education so that they can make informed decisions for their companies.

At Auth0, we pride ourselves on providing not just a cutting-edge IAM platform, but also advice for leaders (whether they’re our customers or not) who are interested in stepping up their approach to security. If you’d like to explore strategies to get your C-Suite up to speed, [reach out to an Auth0 resource](mailto:sales@auth0.com).


The FTC Orders the C-Suite to Get Involved in Data Security

lila-pustovoyt

Lila is a student with interest in identity and Consumer IoT. She likes writing games and iOS and Web apps, as well as building drones and robots.

Associate CIAM Specialist

Lila Pustovoyt

Use account linking and Auth0 to improve your experience with the new Sign in with Apple.

Improving the Sign in with Apple Experience with Account Linking

steven-rees-pullman

I am an Internationally proven professional with experience including full P&L, Business Sector and Corporate planning and execution roles. My specialities — driving revenue and organisational growth in the EMEA.

General Manager EMEA

Steven Rees-Pullman

An interview with our partner, Houston Inc. about why identity is critical for building an audience


Thanks to digitization (and a lot of human effort and planning), the media and entertainment industry has transformed from a network of products to a network of services. Media and entertainment customers now enjoy media and entertainment wherever they are &mdash; via mobile apps, streaming subscriptions, and connected devices.

But all that convenience also created the login box.

Now, media companies must provide a frictionless login experience in addition to creating content and increasingly personalized experiences. Growing audience means meeting (and exceeding) customer expectations &mdash; often growing that audience one person at a time by marketing on a one-to-one basis. And all of this has to take place while minimizing data breach risks that might compromise sensitive user information.

With so much to achieve, where should media companies begin? We asked one of our Nordic partners, [Tomi Ruotimo, CEO of Houston Inc.](https://houston-inc.com/) Consulting for his perspective.

![Headshot of Tomi Ruotimo, CEO of Houston Inc.](https://images.ctfassets.net/23aumh6u8s0i/3NYv1ZHycLe4eaQxi6LuBx/91e28da1c0953dee5385b49c9c97bca1/tomi-ruotimo-ceo-houston-inc)

Tomi founded Houston in 2003 with the vision to help companies design and build digital services to solve specific business problems. Fifteen years later, Houston has 100  employees and have helped companies like Finnish media giant Alma Media, Finnair and Konecranes digitise their offerings. Working with Houston and Auth0, [Alma Media](https://auth0.com/learn/alma-media-sees-30-total-savings-seamless-brand-access/) achieved 30% total savings by providing seamless access across their brands.

**Why is identity important in the Nordics?**

The European Commission ranks Denmark, Sweden, and Finland as the EU's most advanced digital economies, with the highest levels of [digitization](https://ec.europa.eu/digital-single-market/en/desi). According to Reuters, the region also leads the world in paying for [online news](http://media.digitalnewsreport.org/wp-content/uploads/2018/06/digital-news-report-2018.pdf?x89475).

Working with large, multi-brand media companies, we know identity can seem incredibly complex. It's about choosing the right solution for the use case, and giving Nordic media companies a clear roadmap toward turning their free users into paying subscribers.

**What is your answer to "_where do I begin with identity management_?"**

The answer is always: with a good user experience. Your login box is the gateway, and making it as easy as possible for people to sign in is the first step toward conversion. In the case of multi-brand media companies, users should also be able to securely switch between brands or services without having to sign in a second time.

From a technical point of view, the most difficult challenge is merging customer information from different brands and login types into one customer profile. For this, you need verified emails. [The right identity provider can walk you through this process and make identifying single customers much quicker](https://auth0.com/blog/solving-5-media-industry-challenges-with-auth0-identity-solutions/).

Then on the front-end, it's all about reducing friction for the user. Consider [Single Sign On (SSO)](https://auth0.com/single-sign-on/) across brands and features like social login to simplify registrations and logins for end users.

**What about media companies looking for identity management beyond the basics?**

Identity is a great tool for learning about your users, while also complying with data privacy and security laws like GDPR. The key is first-party data, collected directly from the user, with their consent. This doesn't mean companies should ask for a user's life story right away. Customers are turned off by a long sign up form: 86% of users will [quit at registration](https://auth0.com/blog/progressive-profiling/) if the form is too long, while reducing form fields from 11 to 4 increases conversion rates by 120%.

We often recommend "Progressive Profiling," an identity feature that allows media companies to collect information over time, as users interact with their platform. The first time a user signs in, you might just ask for their name and email. The second time, you could ask for their location to improve the experience. The third time could be topics of interest, etc. Ultimately, your goal is to get high-quality information from your users without pushing them away so you can personalize their experience.

**How can media companies use the customer data they've collected?**

Along with our partners like Auth0, we typically recommend that media companies integrate their identity solution with marketing or analytics platforms, so they can deliver personalized messages, content, discounts, etc.

[Media companies](https://auth0.com/media-publishing/) can also use identity data to identify frequent users, and offer them a premium experience or simply message them in a different way. In a similar way, media companies that appeal to a wide demographic can tailor their experiences for different audiences, and make sure they're collecting the appropriate data for each age group. People will want to use your service more if you provide the right content. Netflix and Amazon do this well.

**What advice do you have for media companies investing in identity?**

Look at your business needs, and ask: should I build my own identity platform, or invest in a ready-made product? Auth0 has a good resource with [20 questions for Build or Buy](https://auth0.com/learn/build-or-buy-20-identity-management-questions/). There is always opportunity cost to committing your own resources to identity management. If you choose to buy, find a partner who understands your business and processes, and can validate the right approach to the service, both at the technical level and in the user experience.

The bottom line: if turning free users into subscribers, and monetizing interactions with those subscribers is the goal, then identity is step one.

## About Steven Rees-Pullman

Steven Rees-Pullman is General Manager of Auth0, a leading Identity-as-a-Service platform that secures more than 2.5 billion logins per month. More information can be found at <https://auth0.com/>.

## About Tomi Ruotimo

Tomi Ruotimo CEO and Founder of [Houston Inc.](https://houston-inc.com/) Tomi is an innovative idealist, disruptive thinker, but also known as "enfant terrible of business". He has over 30 years experience in IT. He has founded Houston Inc. which, alongside with a sibling organization called Houston Analytics are one of the leading IoT software consultancy organizations in Scandinavia.

<include src="asides/AboutAuth0" />


If You Want More Paying Subscribers, Invest in Identity

Why Auth0 is succeeding in a diverse region of cultures, languages, and regulatory requirements



> EDITOR’S NOTE: Welcome to the EMEA Blog Takeover, where our EMEA employees take over the Auth0 blog to share success stories from the region. This week, you’ll meet our thought leaders across the pond, discover some of our most compelling use cases, and read about the trends that influence how we do business.

We grew 241% in Q1 2019 vs. Q1 2018 in EMEA. Nearly 30% of that growth came from expansion, which is a direct result of our stellar and growing Customer Success team. We drove more pipeline through the channel and more PR coverage through the media. We set goals in key areas, and we delivered on them.

There’s a massive amount of teamwork that goes on here every day, but I want to touch on three areas that are particularly critical to our success: freedom and space to grow; a localized approach; and a London hub.

{% unless page.url contains '/amp/' %}

  <script src="https://fast.wistia.com/embed/medias/grwc519jwy.jsonp" async></script><script src="https://fast.wistia.com/assets/external/E-v1.js" async></script><div class="wistia_responsive_padding" style="padding:56.25% 0 0 0;position:relative;"><div class="wistia_responsive_wrapper" style="height:100%;left:0;position:absolute;top:0;width:100%;"><div class="wistia_embed wistia_async_grwc519jwy videoFoam=true" style="height:100%;position:relative;width:100%"><div class="wistia_swatch" style="height:100%;left:0;opacity:0;overflow:hidden;position:absolute;top:0;transition:opacity 200ms;width:100%;"><img src="https://images.ctfassets.net/23aumh6u8s0i/5tTCidmZ65eJCaXtuLOmVZ/7f0183ee822bca2ffc3f8ace79f05ff5/swatch" style="filter:blur(5px);height:100%;object-fit:contain;width:100%;" alt="" onload="this.parentNode.style.opacity=1;" /></div></div></div></div>

{% endunless %}

## Nearly 30% of Auth0’s Business, with Freedom and Space to Grow

I’m very fortunate that I work with a group of people who recognize they’re based in America, and they need expertise in other markets. They’ve recruited a team that’s very European, with good diversity across the region, and trust them to build a scalable, and sustainable business. We have an appropriate amount of autonomy to make decisions, and it has paid off.

<include src="TweetQuote" quoteText="Auth0 grew 241% in Q1 2019 vs. Q1 2018 in EMEA."/>

In 2017, from an EMEA perspective, we accounted for between 18-20% of the business. Now, we’re creeping up toward 30%, working with enterprise customers like [Whitbread](https://auth0.com/learn/whitbread-secures-1-2-billion-hotel-website-with-auth0/), [The Economist Group](https://auth0.com/blog/the-economist-wins-2019-kuppingercole-european-identity-and-cloud-award/), and [Nando’s](https://auth0.com/learn/nandos-case-study/).

**Auth0 2018 Revenue by Geography**

![Auth0 2018 Revenue by Geography](https://images.ctfassets.net/23aumh6u8s0i/6ZA7zSHrFD81RGoh568VVC/0003d43d40ab634a9948abb380e6574a/emea-growth_auth0-revenue)

## A Localized Approach for Each Unique Market

Europe is not one region, and we recognize the need and strength of diversity to properly address local markets. We know the markets well, and we have a good set of skills that have helped us reach out to those markets and develop them appropriately. We recently launched a [German version of our website](https://auth0.com/de/), use European laws as opposed to US laws on our contracts, and generally embrace all the things that make us more European friendly.

We have people all across Europe with local language skills. Having someone just down the road who speaks your language, and can share success stories from other customers in the area that you can benefit from as an organization, is priceless. Local knowledge allows you to offer something above software sales and truly add value to the organization, much more than a supplier can.

<include src="TweetQuote" quoteText="Auth0 recently launched a German version of their website - https://auth0.com/de/"/>

So far this year, we’ve added more than 20 new employees in EMEA. Here are some of our recent hires.

<include src="ProfileCard" picture="https://cdn.auth0.com/blog/emea-growth:kevin-switala.png" name="Kevin Switala" title="Enterprise Account Executive" location="Frankfurt, Germany" body="Kevin Switala is responsible for sales strategy in the DACH region, and collaborates with the regional team to gain market share, build the partner network, and expand local brand awareness. He has been in IT industry sales serving Central European Markets for the past 10  years. Prior to Auth0, Kevin was regional sales manager for BeyondTrust, a leader in Privileged Access Management, where he increased qualified pipeline in the DACH region. Follow his travels and food adventures on Instagram @swilalaa."/>

<include src="ProfileCard" picture="https://cdn.auth0.com/blog/emea-growth:mathias-conradt-square.png" name="Mathias Conradt" title="Senior Solutions Engineer" location="Stuttgart, Germany" body="Mathias Conradt engages with Auth0 prospects to understand their technical requirements and guide them to the best identity solution. He has more than 20 years of experience in software engineering and business process management with several certifications. Prior to Auth0, Mathias was managing director for a boutique software company in Germany and Hong Kong, in charge of key accounts such as Atos Origin, Bayer, Blue Cross Blue Shield, China Telecom, Dräger, META Group/Gartner, Philips, SAP, Unilever, and Vodafone. He is a frequent speaker at industry events, and contributes to the Auth0 blog on technical topics (e.g. custom social connections for Verimi and netID). Mathias enjoys sports, sport shooting, motorbiking, playing video games, and reading cyberpunk novels. "/>

<include src="ProfileCard" picture="https://cdn.auth0.com/blog/emea-growth:kris-imbrechts.png" name="Kris Imbrechts" title="Enterprise Account Executive" location="Betekom, Belgium" body="Kris Imbrechts is responsible for revenue growth and new customer acquisition in Benelux and the Nordics. He has more than 20 years of sales management experience with global companies like Oracle, SAP, and Dell. Prior to Auth0, he was key account executive at ForgeRock selling identity solutions to companies in the Benelux region. Kris is a trainer at Belgian sportclub, Team Impact, where you can join him for Muay Thai."/>

<include src="ProfileCard" picture="https://cdn.auth0.com/blog/emea-growth:yvo-van-doorn.png" name="Yvo VanDoorn" title="Senior Solutions Engineer" location="Amsterdam, Netherlands" body="Yvo van Doorn is a technical expert for Auth0 customers seeking to understand the benefits of identity and cloud. He has more than a decade of system administration experience, and manually built and configured bare-metal servers for the first part of his career. Prior to Auth0, Yvo was mission critical engineer at Schuberg Philis, where he specialized in designing and implementing public cloud/SaaS-first solutions for clients in the Benelux region. Yvo is also one of the main organizers for Devopsdays Amsterdam, which attracts more than 500 people every year. Find Yvo sipping a hoppy IPA, exploring the great outdoors, or celebrating Dutch heritage with food and sport."/>

<include src="ProfileCard" picture="https://cdn.auth0.com/blog/emea-growth:matt-gibson.png" name="Matthew Gibson" title="SMB Account Executive" location="London, United Kingdom" body="Matthew (Matt) Gibson acquires new small and medium-sized accounts through direct sales of Auth0’s Identity-as-a-Service (IDaaS) platform in Northern Europe. He has been in business development and sales serving EMEA markets for nearly five years. Prior to Auth0, Matt worked in IT Security at Varonis, where helped organizations protect their data from insider threats, and understand and achieve compliance with  PCI, HIPPA, and GDPR. Outside the office, Matt enjoys playing or watching sports, and socializing with friends."/>

<include src="ProfileCard" picture="https://cdn.auth0.com/blog/emea-growth:charlotte-pichereau-square.png" name="Charlotte Pichereau" title="Account Development Rep" location="London, United Kingdom" body="Charlotte Pichereau works side-by-side with Account Executives to drive meetings with target accounts in France, Middle East, UK. She has more than 10 years of experience in sales and building strong customer relationships. Prior to Auth0, Charlotte was account manager at Inside Marketing, a lead generation company focused on IT and Marketing, where she was responsible for customer growth and retention for Oracle, SAP, Exclusive Networks, and Pulse Secure. Charlotte enjoys simple, good food, dancing, and celebrating her Caribbean heritage."/>

<include src="ProfileCard" picture="https://cdn.auth0.com/blog/emea-growth:frederic-lormeau.png" name="Frederic Lormeau" title="Account Development Rep" location="London, United Kingdom" body="Frederic (Fred) Lormeau is responsible for sales account development in the Nordics and Benelux regions. He has been in the business development sector for more than five years. Prior to Auth0, Fred was business development manager EMEA for Inside Marketing, where he led a team of eight business development reps and secured renewals with Oracle, Gigamon, Rocket Software, Malwarebytes, and other enterprise clients. Follow his travels adventures and acroyoga moves on Instagram @fredbcbg"/>

## A Truly European Business with a London Hub

We hire the best talent regardless of location, and our employees live all over the world. At the same time, we have headquarter offices in Seattle, London, Buenos Aires, Sydney, and Tokyo. We are remote-friendly, but it's important that we also provide spaces where people can come together and work face-to-face.

Over the last few years, software companies have migrated from along the M4 corridor, back into the center of London. It's a hotbed of talent: people who don't have cars, but have fresh ideas, and want to be involved in innovative, fast-growing organizations, as opposed to the old behemoths.

Sitting in London, particularly on the Waterloo side, where coworking spaces are springing up every day, is a distinct advantage for recruiting. And whether we're hosting our colleagues from Seattle, or a customer day, it's easy to get to us in Central London – and conversely, it's easy for us to get to our customers, whether via train, plane, or other means.

As a company, we chose London to tap into the energy. We favor experimentation, innovation, and the people who come with new ideas, wanting to contribute, and make a difference, versus showing up to grind through a day's work.

We hope you’ll want to join Auth0 as an employee, customer, or partner. There are so many areas where we continue to get better and do more, and we’re looking to hire more talented people for our team.

Want to join the Auth0 team in EMEA? [Visit our Careers page here](https://auth0.com/careers/positions?locations=EMEA).

<include src="asides/AboutAuth0" />

---


How We Achieve 241% YOY Growth in EMEA

jenny-obrien

I'm a former business journalist who's fascinated by the intersection of tech and business strategy — in particular how the right solution can transform an idea into reality. I specialize in ROI, data privacy, and identity.

Business Content Manager

Jenny O'Brien

How innovation, customization can still speed time to market (and increase ROI)



The unisex t-shirt — fits everyone, right?

You know it doesn’t. Not all your employees. Not all your customers. 

But you got the bulk rate, so it’s good for the bottom line, right?

Unlike the t-shirt targeted for donation, one-size-fits-all identity can’t just be put to other uses. Your teams will be forced to come up with workarounds, delaying your time to market while driving up maintenance costs — and stealing your team away from your core business while shrinking your team’s innovation bandwidth to a trickle.

Doing identity wrong can lead to sleepless nights, poor user experiences, brand challenges, data-privacy-related fines, and security threats. [Doing it right](https://auth0.com/blog/how-to-have-a-successful-idm-project/) can enhance any digital transformation effort, [reduce development costs and maintenance overhead](https://auth0.com/blog/auth0-roi-how-are-you-calculating-your-build-formula/), and provide revenue-enhancing customer experiences. 

Ideally, your identity solution adapts to your end users’ needs (even if they don’t know what they are yet) rather than the other way around.

![An identity management solution can set you up for steady growth](https://images.ctfassets.net/23aumh6u8s0i/3mYnaCAVsD5ifrgaOSp4s0/f9efa5f60b42e99bb5905687fd8533fb/roi)

<include src="TweetQuote" quoteText="Unlike the t-shirt targeted for donation, one-size-fits-all identity can’t just be put to other uses."/>

## Implementing at Future-Speed

During due diligence, many of our customers share that [competitor’s](https://auth0.com/auth0-vs) proofs-of-concepts can take months to execute and implementations, particularly in the B2B and B2C space can take longer even with just minimal customization. This time loss quickly negates the benefits of the one-size-fits-all solution. Auth0 believes that organizations should be entitled to the best of both from their IAM provider: value from day one out-of-the-box with the ability to easily adapt and customize over time  — several key areas stand out:

### Scaling for Steady Growth and Spikes

Internal IAM solutions leveraged for external purposes often fail due to required scale.

Enterprises may manage tens, hundreds, or thousands of employee identities with an internal IAM, but customer identities can range well into the millions or even billions. The need for scale might be slow and steady, but customer use might spike during specific times of the year, say with the Super Bowl, like with Auth0 customer [fuboTV](https://auth0.com/learn/sports-centric-streaming-service-fubotv-sees-50-roi-just-auth0s-security/). A flexible IAM solution can easily accommodate dramatic shifts in need.

### Increasing Account Security

When it comes to employee identity and data created within internal applications, ownership belongs to the business. Customer identities created across sites and applications ultimately belong to consumers.

But while brands must gain permission to capture and collect consumer identity data, once a customer’s identity is on a business' property and his/her information is stored in its database, that business is responsible for protecting that customer’s data.

<include src="TweetQuote" quoteText="When it comes to employee identity and data created within internal applications, ownership belongs to the business."/>

Using a third-party identity expert like Auth0 makes it easier for companies to protect end user data because the company no longer needs to remain current with the cryptographic algorithms and best identity security practices — Auth0 does it for them. And we’re regularly tested by third-party assessors to maintain [certifications](https://auth0.com/security/) like ISO 27001, ISO27018, SOC 2, HIPAA, and others — all while enabling our customers to create user experiences tailored to their customer’s needs As our customer [Act.md](https://auth0.com/learn/act-md-sees-2x-dev-savings-auth0/) Chief Medical Officer Narath Carlile explains, “In creating a collaborative environment for you and your loved ones, we wanted to have the best level of security and authentication that’s available in the industry today. That’s why we partnered with Auth0.”

### Improving User Experience

[Seamless authentication experiences across multiple brands](https://auth0.com/learn/alma-media-sees-30-total-savings-seamless-brand-access/) can be easy with Auth0, as is coming up with solutions that may seem ‘impossible,’ like the Single Sign On for Microsoft products using G Suite [Auth0 helped create for Sprinklr](https://auth0.com/learn/sprinklr-achieves-impossible-sso-with-auth0/). We know that some logins need to rely on username/password, while others need social login, or end-user-specific solutions. We’ve even been recognized by Frost & Sullivan for our [innovative](https://auth0.com/blog/auth0-named-technology-innovation-award-winner-by-frost-and-sullivan/) approach to identity. We know your customer needs aren’t static, so we’ve created a solution that can give you out-of-the-box functionality within days that can be customized to your evolving needs.

## Balancing Security and User Experience Doesn’t Have to Hurt. 

Revisiting digital strategies and balancing user experiences can conjure up some painful experiences, but you can have an identity solution that suits your needs now — and the ones your future will demand. A “best-in-breed” solution doesn’t try to force your organization to fit into their identity sizing. You know best your organization’s specific challenges, goals, legacy infrastructure, culture, team skills, etc, so you should be in control, with a solution adapts to your evolving needs. If you’re ready to shift to a “best-in-breed” solution, please reach out to [sales@auth0.com](mailto:sales@auth0.com).

<include src="asides/AboutAuth0" />


One-Size Doesn’t Fit All

df6c864847fba9687d962cb80b482764?size=200 avatar

df6c864847fba9687d962cb80b482764?size=200

Martin Gontovnikas, a.k.a Gonto, is a software engineer at heart who moved to the ‘dark side’ and became VP of Marketing at Auth0. He considers himself lucky to have found a way to combine his two passions and apply his engineering thinking model to marketing.<br/><br/> Gonto’s analytical thinking is a huge driver of his data-driven approach to marketing strategy and experimental design. He is based in the Bay area, and in his spare time, can be found eating gourmet food at the best new restaurants, visiting every local brewery he can find, or traveling the globe in search of new experiences.

Former SVP of Marketing and Growth at Auth0

Martin Gontovnikas

They safeguard your account, but they're not exactly all they're cracked up to be.



You set up your security questions when you sign up (sometimes) and totally forget about them. Then, one day, you inevitably forget your password and find yourself robotically entering your place of birth, your dog's name, and your mom's birthday to get access to your account.

Bang, boom, and you're back in with your security questions and a quick password reset.

But hold on—dog's name, birthplace... are these questions really secure? Or are questions that are supposed to safeguard your account really a point of weakness?

Much like passwords, security questions are something that could, in theory, be very secure. But when you start putting people in the position of handling hundreds of accounts, keeping security questions, well, secure can become a daunting task.

## How Easy is it to Hack a Security Question?

As with passwords, there are basically two ways that a hacker can nab the answers to your security questions: a breach or a guess.

### Breaches

Unfortunately, breaches are more common that anyone would like, and there's only so much you can do on an individual level to keep your info from getting stolen in a breach.

Yes, breaches happen, and sometimes your security questions get stolen. But that doesn't make them inherently less secure than passwords, phone numbers, and your biometric data (which can be stolen), or SMS or other 2-factor authentication messages, which can be intercepted or go to a compromised account.

Breaches are a mark against security questions, but they're also a threat to many other forms of authentication. At best, security questions are no more hackable than passwords, at worst they're both vulnerable.

### Guesses

While you're probably not doing something as egregious as putting “answer” as the answer to all your security questions, picking easy to remember answers can lead you to having your questions easily guessed.

* **Generic answers:** depending on where you are, that “unique” piece of information about you could get you into some statistical trouble. Google reports that “a single guess an attacker would have a [19.7%](https://static.googleusercontent.com/media/research.google.com/en//pubs/archive/43783.pdf) success rate at guessing English-speaking users’ answers” to a question about their favorite food. If you're from South Korea, a hacker would get your birthplace 39% of the time with just ten guesses. Hackers can crowdsource information and use other database tools, which can add up to a compromise of your security.

* **Searchable answers:** if the information is on your LinkedIn, your Facebook, or Twitter feed or other social media platform, it's not a good answer to a security question. Some of these, like hometown, are generally available and obvious. But things like favorite team or athlete, where you met your spouse (alma mater, hometown, etc.), and favorite vacation spot can be just as easily guessed from a quick scroll through your profile.

![Common questions are easy to guess.](https://images.ctfassets.net/23aumh6u8s0i/1ZhMUzaFCuxyuX3OHbOzCN/be44a01b3a19a74949512731e0f7066b/challenge)

If you're using an easy-to-guess answer, then you security questions are not safe. The caveat is that this isn't an inherent problem with security questions—if your answers are unique, then you're ok.


## How Can We Make Security Questions as Safe as Possible?

In a perfect world, security questions would be a lot safer than they are now. To ensure that your answers are as safe as possible:

* **Make every answer completely unique, and not guessable.** Leave behind your hometown and your mother's maiden name. Instead, use a mix of letters, numbers, and characters to create random answers to every security question.

![Use a mix of letters, numbers, and characters to create random answers](https://images.ctfassets.net/23aumh6u8s0i/4Nh85rHlIHKrDn3w80nGys/2bcaf2b21ced60dbe17a4b1eb75da8f6/mix-of-letters)

* **Make your own questions.** If you are given the option to make your own security question, take the opportunity to make a question that only you will be able to figure out the answer to. Microsoft found that when the most generic questions were used, [hackers could guess their way into an account 15%](https://www.microsoft.com/en-us/research/publication/its-no-secret-measuring-the-security-and-reliability-of-authentication-via-secret-questions/?from=http%3A%2F%2Fresearch.microsoft.com%2Fpubs%2F79594%2Foakland09.pdf) of the time—and that's without knowing personal info about the account owner.
* **Never duplicate an answer to a security question.** Although you may be asked to provide the answers to nearly identical questions across multiple accounts, don't use the same answers, or variations on one answer.

### How You Can Implement These Changes in Your Own Accounts

If you read the above and thought *there's no way I'll be able to remember all of that!* then you're not alone. Most people couldn't remember a completely unique set of security question answers to every single account they have.

* **Use a password manager.** We've talked about these before, but password managers allow you to store passwords and other account information securely. So when you make a bunch of unique security question answers, you can recall them through the manager instead of having to remember every one yourself.
* **Set up 2-factor authentication.** Don't rely on security questions to keep yourself safe—connect multiple ways of identifying yourself to your account, including a recovery email and phone. Double check what options are available for your accounts, and keep your info up to date.
* **Clean up your social media.** While certain things will have to stay, taking your hometown off of Facebook isn't going to affect your quality of experience on that social network. If you know you might still have generic security question answers floating around, consider taking that type of information down—nobody who knows you will miss it.

![Clean up personal information that no one cares about.](https://images.ctfassets.net/23aumh6u8s0i/6ApuDl9nxmygMA3LX9vJeE/a257e699ed46d3b9df326c56894f2d8f/clean-up)

* **Work backwards.** Yes, changing all your security question answers is a daunting task. Start with the most important accounts (banking, primary email) and update your security questions on those first. Set up a password manager and make sure that you note the answers. Then, chip away at your less important accounts.

## Security Questions: Safe After All?

At the end of the day, security questions have their up and downsides, like every other security measure. No technology is going to promise perfect safety for anyone, but we can mitigate the risk of being hacked by taking practical measures to protect ourselves.

Security questions aren't bad in theory; it's in practice that they start to come with strings attached. But this is something you can guard yourself against.

If you're taking security questions seriously, make them unique and don't reuse them. Reset them if you think your account may have been compromised. And whatever you do, just stop using your mother's maiden name, ok?


Are Your Security Questions As Safe As You Think?

diegopoza

System Engineer, geek, foodie, technology lover, speaker.

Sr Manager, Developer Advocacy

Diego Poza

Pros, cons, and exceptions to asking users to create an account.



Most of the time on the Auth0 blog, we talk about logging in and signing up as though it's obvious that everyone will do it. However, asking users to sign up for your product isn't always an easy decision to make. Some people are worried about the friction it causes, or if it's necessary for their product. Sometimes, worries about maintaining secure logins make asking for signups seem like more trouble than not asking users to sign up at all. 

As experts on signup and login, we've thought of — and encountered — use case after use case, and find that asking users to log in almost always offers benefits to both the business and the user. From security to enterprise concerns to customer support, the power that login has to better your product is something you should seriously consider as you build and grow your business.

This isn't an exhaustive list of every reason why you should ask users to log in. Rather, it's an overview of why you should have users create accounts, why login is mutually beneficial, and the very few exceptions where this isn't the case. 

## The basics of login

Whether you're using a username and password or a complex multi-factor setup, the core principles of login remain the same:

* **Login requires a signup for your product.** This means that there is only a certain group of users who are allowed access your product, although login doesn't have to mean that your product is 'exclusive.' For example, anyone may be able to sign up for a gaming app, but only paying customers for an analytics software. 
* **Login creates a user account.** This means that users are uniquely identifiable within your product.
    * **For users** this frequently means that they can see their own profile and information, change that information, and keep track of what are the identifiers on their account (profile picture, username, etc.)
    * **For companies** this means that user data can be linked to an individual profile. This profile probably contains all the information the user inputs, and can also be a home for any other data that a company chooses to attach to that profile (type of device, for example).

## Security and accountability

### User Accounts

Enabling a user to create an account and log in, is equipping them with security for and control over their information. 

When a user can see the information they've given you in their user profile, they understand what you're using to connect with them. So when a user gets, for example, a promotional email, they know where it came from. They can simply go into their settings, change their email, check and unsubscribe from promotions. 

Otherwise, users might be wondering what happened to the email address they used to make an in-app purchase.

If they want, they can also change privacy settings, update personal information, and delete their projects and profile, leaving no question about what is hanging around in your product. 

**For your users:** Accounts help put users in the driver's seat for their data. 

**For your company:** Letting users see and control their data builds trust with users, which helps foster transparency about what information is stored by a company (especially when [nobody](https://www.theguardian.com/money/2011/may/11/terms-conditions-small-print-big-problems) reads terms and conditions). 

### Enterprise concerns

Login is also incredibly important for enterprise customers, for a number of reasons. 

* **Security.** Enterprise customers want to have everything within their system secured, which means providing a sign up that works with [enterprise login requirements](https://auth0.com/blog/how-enterprise-federation-helps-shorten-the-sales-cycle/).

![Enterprise Connections](https://images.ctfassets.net/23aumh6u8s0i/5QEgErqXGl2jN1edEZS2Uz/682cd255a8d7d7d0f2610dd323927104/enterprise-connections)

* **Managing roles.** With potentially hundreds of employees all needing to access your product, enterprise customers want to be able to designate and manage roles. The head of marketing might need admin access to an analytics platform, but a sales person definitely doesn't. 
* **Tracking employee data.** When each employee has an account, it's easy to track who is making changes, who is working on what projects, and how teams are working together. Enterprise companies especially are interested in keeping track of who is doing what, so anything that comes up down the line, whether mistake or triumph, can be properly attributed.

**For your users:** Accounts and login helps enterprise customers trust your product and integrate it with their existing tools.

**For your company:** If you are considering working with enterprise customers, you will need to implement a sign on feature. Truthfully, we've only scratched the surface of what enterprise customers expect out of their login — it can be make or break for you if you don't have a login to fit their needs, no matter what your product. 
 
### Customer experience

Login can be a powerful tool for shaping customer experiences. Beyond simply getting someone into a product, login can be a way to manage data on a user and help them get the most out of your product. 

* **Giving better support.** When a customer contacts support with a problem, imagine if they could get welcoming, customized support — like being greeted by name, and not having to answer a long list of questions about their product history or what devices they're using. If you don't have a user account to store data like name and device type, that's simply not possible. Keeping an internal profile of every customer through your login is a great way to personalize your support.
* **Catering to a multi-device world.** When there's no login, there's no easy way for a user to use your product on multiple devices without starting fresh. Even if you're a simple game app, letting people save their progress and access from different devices can keep users habitually engaging with your product.  

![Multi-device world](https://images.ctfassets.net/23aumh6u8s0i/2TtPauGPyLLd8ksJWl5kIB/c53db80c1be8c47fa36b3eb7743faaec/multi-device)

* **Offering a social component**. Whether people want to share their favorite songs, their pictures and videos, their high score or their sales data, any sort of social or sharing component in a product can benefit from a login. By giving people an account and a profile at login, you make it easy for someone to find just the right person to connect with, whether that's for business or friendship. Without login, finding and sharing things to a select group is difficult.

If you're still worried about having the login as a barrier between potential users and your product, consider offering options like passwordless login and social login, that ask less of users than traditional or multifactor authentications. 

## Exceptions to the rule

So, we've been over many reasons why using a login is a good idea. But there's always exceptions to the rule — here are the three biggest. 

* **Product demos:** Although some companies have you create an account to access a product demo, most require only your email or sometimes nothing at all. When you're giving people the chance to try out your product, it doesn't always make sense to have them go through the process of creating an account, especially if it's a short demo and not a free trial. If a user just wants to see what you're about, sometimes it's better to let them get some time to explore without having to sign up.
* **Checkout:** Users shopping online are skittish about signing up in order to check out, especially if they're a new customer and aren't sure if they like your product yet. Removing a requirement to sign up and allowing a guest checkout can benefit your conversions at checkout. Clothing retailer ASOS [halved](https://econsultancy.com/blog/10355-eight-out-of-top-10-us-retailers-offer-guest-checkout/) it's abandonment rate by adding a guest checkout. 

![Checkout experience](https://images.ctfassets.net/23aumh6u8s0i/2gZuegLMzCtwWTguaXRykB/10b3e56cbc728a7e467ef3dba0eb952d/checkout)

* **Mobile**: It seems like almost every mobile app requires a login, save for weather apps and a few games. One reason for this may be that the [download is the real source of friction](https://www.quora.com/Is-it-better-to-force-a-login-signup-to-use-an-app-or-let-users-use-it-freely-until-they-hit-a-feature-that-requires-a-login) to adopting use of a mobile app — once you've gone through the trouble of actually getting the app from the app store, the time it takes to sign up is negligible. Still, if you're offering a simple mobile service without any social features, it might be worth skipping the extra step. 

These exceptions come with deep understanding of your product, and how users are moving through it. When login becomes a big source of friction, it can make sense to remove it. Take the “[$300 million dollar change](https://articles.uie.com/three_hund_million_button/)” that one major e-commerce company made.

They didn't see their request for users to login as a problem — but their users sure did. When interviewed, they expressed that having to login before checkout was a huge nuisance, and when they looked at their analytics they saw 160,000 requests for forgotten password a day — clearly, login was hampering their customers from checking out, not helping them. 

When they dropped their login requirement, they immediately saw a huge sales boost.

So, if you are thinking about ditching your login, do some exploratory work and see what is tripping people up as they're trying to use your product. If it seems to be login, it could be worth a shot to remove it and see how things go.

## Let your login lead the way

If you're trying to decide whether or not to add a login feature to your product, don't fall prey to thinking that all login is is a box for a username and password that only creates friction for your users. When you're actually thinking about what login can do for you, it's clear that there's a host of benefits for both you *and *your users that simply aren't possible if you don't require a login.

Of course, making these benefits a reality means implementing a more sophisticated login than that box for your username and password, and that's where Auth0 is ready to help. When you implement that sophisticated login, you're letting it lead you to better customer experiences, no matter the product.

**Aside: Securing Applications with Auth0**

Are you building a [B2C](https://auth0.com/b2c-customer-identity-management), [B2B](https://auth0.com/b2b-enterprise-identity-management), or [B2E](https://auth0.com/b2e-identity-management-for-employees) tool? Auth0, can help you focus on what matters the most to you, the special features of your product. [Auth0](https://auth0.com/) can improve your product's security with state-of-the-art features like [passwordless](https://auth0.com/passwordless), [breached password surveillance](https://auth0.com/breached-passwords), and [multifactor authentication](https://auth0.com/multifactor-authentication).

[We offer a generous **free tier**](https://auth0.com/pricing) so you can get started with modern authentication.


Should You Make Your Users Log In?

8f9f6a577da77a9add9cadbb90e66b75

Matthew Machuga

Give your users a choice to link their accounts when accidentally using another provider with the same email address.

# An Easy Way for Users to Link Accounts

A few months ago, Diego Poza wrote an article on [The 3 Best Ways To Create the Single Vision of A Customer](https://auth0.com/blog/the-three-best-ways-to-create-the-single-vision-of-a-customer/).
In it he said the number one must-have is Centralized Identity Management. He 
described that in Auth0, if a user signed in with their Facebook login, then 
their Google account next, they would have two accounts. Auth0 already
provides rules for allowing these accounts to be linked back together 
automatically, but we're happy to announce a new option that gives the
user a choice as to whether they'd like to link the accounts or not.

This happens as part of our [Account Link extension](https://auth0.com/docs/extensions/account-link). It's extremely simple to
set up and can save your users a lot of hassle.

Let's walk through how this gets presented to your users to demonstrate how the
functionality is helpful. Let's say one of your users has the email address
`spencer@example.com`. They've used this email address to sign up for Facebook,
Twitter, Google Apps, and your site. If your site offers all of these social
sign in options and database users, it can be understandably hard for a user
to remember what account they used to sign up for your site. Like in our
example above, we'll assume that `spencer@example.com` signed up with their
Facebook account originally, but now that they're back on the site they can't
remember. They incorrectly guess they used Google to sign in.

With the extension enabled, instead of being taken to your site with a new
account, they are sent to a prompt from the extension, notifying them that they
appear to already have an account registered with that email address on your
site. The most prominent option is to continue linking the accounts. When
**Continue** is clicked, the user will be redirected to log in with the account
that's already detected on your site. Assuming their authentication is
successful, they'll be redirected to your site successfully as their original
account, with the new account merged in as an identity of the original. This
then, conveniently, lets them sign in with either option to the same account.

![Image of extension page](https://images.ctfassets.net/23aumh6u8s0i/6Nd5KcxDJODJ2YK6BIyTtz/1139afaea432a35a18428b1512865a50/hosted-page-example)


But let's assume the opposite for a moment: that your user has intentionally
tried to create a second account with a different provider. Not a problem! They
can simply click the small, diminished link saying, "I want to skip this and
create a new account." and they'll continue to your site logged in as a
new user under their new provider.

Providing the ability to link accounts through the Account Link extension
makes it so your user retains a choice as to whether they'd like their accounts
linked, but will encourage them to link by default since it tends to be the 
most common intent.

You can install it from the [Extensions Gallery](https://manage.auth0.com/#extensions)
and give your users a choice that will make their experience, and your management, easier.

# Aside: Securing Applications with Auth0

Are you building a [B2C](https://auth0.com/b2c-customer-identity-management), [B2B](https://auth0.com/b2b-enterprise-identity-management), or [B2E](https://auth0.com/b2e-identity-management-for-employees) tool? Auth0, can help you focus on what matters the most to you, the special features of your product. [Auth0](https://auth0.com/) can improve your product's security with state-of-the-art features like [passwordless](https://auth0.com/passwordless), [breached password surveillance](https://auth0.com/breached-passwords), and [multifactor authentication](https://auth0.com/multifactor-authentication).

[We offer a generous **free tier**](https://auth0.com/pricing) so you can get started with modern authentication.

An Easy Way for Users to Link Accounts

mike-hearn

Guest Author

Mike Hearn

Focus on your core competency. Outsource your login systems



<div class="alert alert-info alert-icon">
  <i class="icon-budicon-500"></i>
  <strong>Thanks to Mike Hearn for letting us repost his blog post. You can find more amazing content from him in his personal blog: <a href="https://blog.plan99.net/">Mike's blog</a>.</strong>
</div>

[Troy Hunt](https://www.troyhunt.com) recently published a blog post titled [“Authentication guidance for the modern era”](https://www.troyhunt.com/passwords-evolved-authentication-guidance-for-the-modern-era/). It has a big pile of solid advice on what password rules your website should use, with references to formal government recommendations, always useful for convincing colleagues or a boss.

One of the projects I worked on during my time at Google was their unified account system ([specifically, anti-hijacking](https://googleblog.blogspot.ch/2013/02/an-update-on-our-war-against-account.html)). Login systems are a part of most websites, so reading Troy’s article inspired me to put together some advice for building them.

## 1. Ideally, Don’t

Whatever your business is, user authentication is not your core competency. Modern login systems are expected to do a lot. Passwords are only the start. If you are successful you will eventually also want:

* Forgotten password recovery
* Email address verification
* Log out, which is harder than it looks (see below)
* Password brute-forcing protection
* Two-factor authentication via SMS, phone app and hardware key
* Account hijacking protection (when an attacker already knows the correct password, and the user does not have 2FA)
* Region/language/name/profile photo preferences
* Support for mobile/desktop sign-in
* Unusual activity notifications
* Phone-only sign-in

As big companies raise user expectations and attackers get better, the effort to keep up is becoming impractical. Fortunately, you can outsource your authentication to those companies using OAuth.

Often web developers see adding a “[sign in with Facebook](https://developers.facebook.com/docs/facebook-login)” or “[sign in with Google](https://developers.google.com/identity/sign-in/web/sign-in)” button as a kind of optional nice-to-have, which comes only after building their own account system. If you’re reading this because you’re starting a new website from scratch, I argue that “Sign in with …” should be the only option you offer. Building your own account system these days is like building your own datacenters instead of using AWS. It’s an expensive distraction.

Sometimes people worry that if they only offer “Sign in with …” the big ID providers might one day try to steal their customers. The usual indication someone’s worrying about this is you sign in with an ID provider and are then asked to set a password anyway. Don’t worry about this. In the unlikely event that this happens, you can always migrate your customer base to a new system of your own later by simply emailing them a link.

## 2. Use Email/Phone Numbers to Identify Users

Don’t ask users to pick usernames, even if you want a username-oriented experience like on a chat forum. Users are always identified to you by email address, phone number, or both, and if you want a different name for user-to-user identification (a display name), that should be chosen separately. Why?

* You will ask for the email address anyway.
* If the username becomes a form of self-expression on your service, users will want to change it from time to time.
* Users forget usernames but not their email/phone numbers.
* Picking a username is frustrating. Every time a user selects a name that’s already taken, some will give up, and your customer acquisition pipeline narrows.
* Separating username from display name will reduce the temptation to impose arbitrary restrictions on how users appear, like forbidding spaces.

## 3. Don’t Use Passwords at All

![NoMorePasswords](https://images.ctfassets.net/23aumh6u8s0i/4b5H4xeQkEJAslBJrrHRzL/8c39aa959868e752d679862b23f8e5ea/1_1S1yaiqUAmfLZE2uF5AvDw)

If you aren’t quite ready to rely 100% on third party ID providers, at least do everyone a favor and don’t make users pick a password at all.

This isn’t as stupid as it sounds. You are already asking the user for their email address. The very first feature you will add to your login system after going live is forgotten password recovery, which will work by sending the user a clickable link via an email. Therefore anyone who can read your user’s email can log in as them anyway, and your own site password adds no extra security.

Instead, skip the first step and go straight to the second, your login system can be as simple as emailing the user a link that sets a login cookie when clicked. [Medium.com is an example of a site that does this.](https://blog.medium.com/signing-in-to-medium-by-email-aacc21134fcd)

This approach works as long as every device where the user might log in to your service has an email client. This is true for desktops, laptops, phones, and tablets. It is not true for game consoles or TVs, but you probably aren’t targeting them yet. If you are, it’s better to use a Bluetooth style pairing process anyway, as these devices don’t have convenient keyboards.

There have been suggestions in the past that users can be confused by the lack of a password entry box. But the modern Google sign-in experience starts by asking the user for their email address only, so it’s unlikely users are confused by this any more … and the benefits are huge.

This approach has an additional benefit: some users have phone numbers but not email addresses. This is especially true in developing countries, so if this is a possible target market for your website, you may eventually want to support users who can only log in by receiving a code to their phone. Such accounts won’t have passwords at all, so if you assumed all users do have passwords, it would require you to go back and add lots of special cases to security-sensitive code paths (this can easily lead to fatal mistakes).

## 4. Don’t Use Secret Questions

If you simply must use passwords, perhaps you don’t want to try explaining to your boss why you did things differently. At the very least, don’t let the user recover using secret questions and answers.

* The answers to secret questions are often trivially guessed. Users find it incredibly hard to think of questions that only they could answer and nobody else.
* Pre-supplied questions make the guessing problem worse.
* Pre-supplied questions often have a cultural bias that makes them useless for many users (e.g., “what was your high school’s mascot?”)
* Some savvy users realize they can’t think of a hard-to-guess answer, so just use it as a second password field, meaning they then can’t recover when they forget.
* There is a long list of high profile celebrity and VIP hacks that worked by abusing password recovery flows. You don’t want this to be you.

Google had severe problems with secret questions. A couple of my old colleagues published research on it that’s worth reading or [watching.](https://youtu.be/h8YwQvJm7rk)

Some examples of problematic Q/As:

* **Q: Favourite food. A: Pizza.** The answer is always pizza. You can break into around 20% of English-speaking accounts with just a single guess using this answer. With just ten guesses, you can break into over a third of all English-speaking accounts that have this question. For Korean accounts, you can get into 43% of all accounts within ten guesses.
* **Q: On what day did I get married? A: Thursday.** A custom question, but fatally flawed — the attacker needed only five guesses, too few to be detected as a brute-forcing attempt.
* **Q: In which city was I born? A: Seoul.** In some countries, almost everyone lives in a handful of large cities. Observing the language, the ID verification UI is written in can thus narrow down the list of possible cities dramatically. For Korean accounts, you only need ten guesses to break 40% of accounts using this question.
* **Q: What was the name of my first teacher? A: Mr. Smith, Smith, John, John S. Smith, JOHN SMITH, Jon Smth.** All of these answers are correct but won’t be matched by a straightforward implementation. I added fuzzy matching for questions like these because users so often got them ‘nearly’ right. The matching logic often needs to understand something about the question (Levenshtein distance by itself is insufficient for things like street addresses). Good luck doing this for all the languages your product supports!

Not surprisingly, professional account systems do not use knowledge of secret Q/A alone to allow users to recover accounts. It’s just one signal, amongst many. I give you a <2% chance of writing something sophisticated enough to get this right. That’s why Google phased secret Q/A out in favor of SMS recovery. SMS based recovery has its own issues, but it’s still a lot better than secret questions.

## 5. Outsource 2-Factor Authentication

Two-factor auth is a pretty common feature these days. Again, doing this well is hard, expensive, and you do not want to implement it yourself.

![Authenticator](https://images.ctfassets.net/23aumh6u8s0i/3jlImkLJR1lwJ8tJviARHw/8d67128edc548fdd0771e83c9c16b993/1_GmSsoIZQN49cIBMeNDoYlA)

* SMS is unreliable, especially in some countries. Recovery codes will occasionally just not show up. You will eventually want to implement phone calls with speech synthesis as a result because phone calls are much more reliable, but now you need multi-lingual speech synthesis engines.

* Doing lots of SMSs or phone calls is extremely expensive, even if you can negotiate good bulk discounts.

* People lose access to their phone numbers all the time. If you rely on email addresses, your password recovery flow can be pretty easy, but once solid 2FA is introduced, your password recovery becomes the weakest point in the system. If you don’t upgrade it, attackers will simply go around it. If you block it, then you will discover that …

* 2FA can be abused by attackers who add it to accounts they phished or hacked. This is to prevent real users from stealing the account back whilst the malicious activity is performed.

* Phone numbers are vulnerable to porting attacks, so the trend is towards asking users to set up mobile apps or security keys. Implementing those is even more work, and of course, both of those can be lost too, so you will ultimately still need some customer support flow to help them recover.

* As you’re figuring out, 2FA adds a lot of manual customer support work because you can no longer just push users towards email or secret Q/A based recovery. That’s expensive.

Some of these problems are fundamental, but most of them are solved already by the big players who will pay the phone bills and customer support people on your behalf, for free!
Still, if you don’t want to use them, there are startups that will solve small parts of the 2FA puzzle for you.

## 6. Don’t Force Password Changes

Troy already covered this just fine, so I won’t repeat it here, except to say that this is really important. Don’t require users to change passwords just because it’s been a while.

* Some users won’t make it through the process, and you will bleed users.
* Some users will be smarter than you and use tricks like changing their password (once, twice, three times) and then immediately changing it back to their old password, meaning you will end up wanting to store a history of recent passwords to prevent this behavior. But I bet your first implementation won’t do this.
* It doesn’t improve security anyway.

## 7. Don’t Expire Sessions

Yet another best practice that isn’t. It’s tempting to set your session cookies to expire. Sometimes people think that this improves security for the same reason they think expiring people’s passwords improves security.

* Attackers tend to perform malicious activities immediately, so expirations don’t help much.
* Session expiry trains users that random unexpected password prompts are normal, which makes them incredibly easy to phish.
* Sessions that expire randomly create an explosion of bugs that your developers will waste large amounts of time on. Most parts of your website will not be written to handle the case of sessions expiring halfway through an action, so you’ll have to go back and fix them, assuming you even notice the problems at all. Expiry tends to surface as user reports of random flakiness, which are hard to track down.

## 8. Remember Sign-Out

Getting sign-out wrong is remarkably common in immature account systems. It sounds superficially easy, but the most obvious ways to do it have flaws.

* Simply deleting the session cookie is fine as a convenience to the user, but means you can’t recover from XSS. Once an XSS is found, you may wish to invalidate possibly stolen session cookies, but if sign-out is just “ask the browser to delete the cookie,” then you can’t do it.
* Adding timestamps to session cookies and then setting a “last sign-out time” requires every action to check against the accounts database to discover if the user’s session is too old. This can slow things down, meaning developers will be tempted to optimize it out (it doesn’t seem dangerous to do so after all). But then if they remove the check for an endpoint of interest to attackers, you’ve still got the problem in step one. Additionally, this means signing out of one browser or device signs the user out of all of them, which isn’t expected behavior.

The right way to do this is by keeping a list of invalidated session cookies with in-memory caching. But for most companies, there’s a less costly approach which is good enough: have the user’s sign-out link be just a way to clear the session cookie and nothing more, then make session cookies expire but be automatically and silently replaced every 5 minutes or so. The act of replacing an expired session cookie consults the database to see if the administrators have forced a logout. If the user is presenting an expired cookie, then they are required to log in again. This recognizes that cleaning up after cookies may have been stolen is a relatively rare event.

## 9. Separate Account Emails from Marketing Mail

![Marketing mail](https://images.ctfassets.net/23aumh6u8s0i/5s8qtUTXT1INJCaItlfzng/48fe0ae9e212bb39e6e345151cc92664/1_kg2ZRHcCDGJ83rEz8D7saA)

The obvious way to send password recovery links, signup verifications, etc. is simply from your company’s main email server. Unfortunately, some people in your company are trying to build a “relationship” with the user by sending them commercial mails they don’t want.

Even if users agreed to receive these during account signup, many of them don’t want them anymore, and some will solve this by reporting them as spam. This is an expedient solution for the savvy user who has noticed that simply clicking “Report spam” a couple of times makes the emails go away, without any mental effort expended on finding tiny light-grey-on-white-6pt-font unsubscribe links or … gasp … writing email filters.

Unfortunately, this entirely normal behavior will start to degrade the reputation of your main email domain. Mail from your account system may start going into the user’s spam folder. We’ve all seen warnings on signup or password recovery flows telling us to check our spam folders, that’s why.

One way to solve this is by buying a separate top-level domain to send your account mails from and making sure to configure DKIM. But then some users will notice the mismatch and report your email as phishing instead. The best solution is to send your marketing emails from a different DKIM domain, but that will likely involve picking a fight with your product folks. Still … the moment you chose to roll your own, you accepted this pain, remember?

## 10. Keep Your Password Database Well Protected

If you have passwords, you have a database attackers want (and frequently get). They don’t care about your company directly; they just want the passwords so they can try them at higher value targets. Yet data breaches are embarrassing and can lead to big penalties even if the direct impact on your customers is low. A database of OAuth tokens is of far less value to attackers, and thus you’re much less likely to be attacked.

<include src="asides/MarketBasketLinksAbout" />

## Conclusion

There is far more I could write about account systems. Defending your site against malicious account hacking/signup is an entire book all by itself. I can’t write that book, but you can watch [this video of a talk I gave in 2012](https://www.youtube.com/watch?v=XwsaZ4-3muA) instead if you’re curious.

But it’s fair to say the task is deceptively large. That’s why I keep recommending you bite the bullet and outsource your account management to the big boys. Writing design documents for “log out” is not your core business. Diagnosing why you’re bleeding users who forgot their password is not your core business. Diagnosing why SMS message delivery to Peru isn’t reliable isn’t your core business. Every dollar you spend on these things is a dollar your competitors who use “Sign in with …” are spending on their core business.

So throw out your password database, and don’t look back.


Building Account Systems

brandon-redlinger

Brandon Redlinger

Learn various strategies on how to reach the right people through calculated account selection.



David Ogilvy was far ahead of this time. He was known as the King of Madison Avenue. Though often viewed by his peers as eccentric (and even bizarre – he was known to wear capes to board meetings), he got many things right. One particular quote that still stands out and is applicable in today’s B2B word is this:

> “Don’t count the people you reach; reach the people that count.”

Traditional demand gen has been about reaching more people. However, when taking an account based approach, being able to reach the right people is one of the core principles.
Selecting accounts is a combination of art and science, intuition and logic. Companies combine gut feel, historical performance, and sometimes predictive data science to develop an Ideal Customer Profile, tier their accounts, then allocate their resources properly to work said accounts.
Get this wrong, and you’ll be burning money. Get this right, and you’ll be printing money at will. That’s why this is the foundation for every good Account Based Marketing program. In fact, it goes beyond that – it’s the core of [Account Based Everything (ABE)](http://www.engagio.com/hello-account-based-everything-and-goodbye-account-based-marketing/).

> [Give your customers **enterprise identity integration**, frictionless SSO across your products and adaptive authentication with **MFA and Anomaly Detection**. All of this with a flip of a switch.](https://auth0.com/b2b-enterprise-identity-management)

## How Should You Select Your Target Accounts?

The process of choosing target accounts comes down to a specific definition (ICP) of companies that best match your goals. This definition includes the key dimensions that define high-value accounts that are most likely to buy, including things like:

* Firmographics
* Technographics
* Pain points
* Behaviors
* Intent data
* Strategy

One way to decide on your ICP is to reverse engineer your existing best customers to see what they have in common. Another is to analyze the best customers of your closest competitors: where are they winning and why?

Once you know the specific profile of an ideal account, it’s time to actually pick the accounts; to name the companies you’ll be targeting. On this front, there’s a [maturity spectrum](http://www.engagio.com/account-selection-maturity-model/), with increasing accuracy and sophistication as you move up.

![Maturity Spectrum](https://images.ctfassets.net/23aumh6u8s0i/2MOy2gXLGdPZo7wGFmo8Nc/710292ab5bf449bbe835046392b7e21d/abm-tiers)

The accuracy and completeness of your account selection improves as you move up the maturity spectrum. Do what you need to do – but be advised: time, money and effort spent on rigorous account selection will be repaid many times over in the number and quality of opportunities you generate.

“Data is a never ending problem. Prospectors have a clear idea of which companies should be a good t, and which shouldn’t.” - Aaron Ross, Predictable Revenue

## How Should You Tier Your Target Accounts?

Not all accounts are the same, so you'll also need to organize your target accounts into tiers, based on how valuable they might be (and how much research and personalization will go into each one.)
We take a tiered approach where Tier 1 is a classic ABE/ABM approach, Tier 2 is a lighter approach, and Tier 3 is a hybrid approach.

**Tier 1** – These accounts get the “full” Account Based Everything treatment – meaning each one gets deep research, a customized plan, personalized content, bespoke campaigns, and lots of one-to-one attention.  You map out each buying center, understand where there may be revenue potential, build out the organization chart and see which contacts you know and which you need to know, research key business priorities and individual motivations, and identify relationships and connections to the account.  You publish detailed account dossiers, maintain them quarterly, and even have internal chat groups or forums dedicated to each account.

**Tier 2** – These accounts also get individual research, but perhaps it’s limited to a few key talking points for each account. These accounts may not get completely personalized Plays and custom content, but they should still get highly relevant touches based on their industry and persona. Instead of one-to-one campaigns, these accounts get one-to-few campaigns. Instead of fully bespoke content, perhaps you take content written for their industry and customize it with their logo on the cover and a personalized first and last paragraph.

**Tier 3** – This style covers all the accounts that you want to target but don’t have the resources for personalization and customization. ITSMA calls this Programmatic ABM. It’s basically traditional marketing with account-level targeting. The key difference from demand gen is that instead of scoring leads, you track account-level engagement and wait until the account hits a sufficient threshold to label them a [Marketing Qualified Account (MQA)](http://www.engagio.com/what-is-a-marketing-qualified-account-mqa/).

## How Many Accounts Should You Have in Each Tier?

When determining who you’ll target in your Account Based Everything program, an important decision is how many accounts you should be targeting within each tier of your program.

![ABM Accounts Funnel](https://images.ctfassets.net/23aumh6u8s0i/6jbv7N3g72uKPXJAqlEQDF/bc088c3dfc117e16e1ebe8a622d6ae69/abm-accounts)

Like most decisions related to strategy, there is no one-size-fits-all answer. The number of accounts you choose to target for each Tier in your ABE program – and the number of accounts per AE and SDR – will depend on things like:

* Your expected deal sizes
* The length of the sales cycle
* Your available sales resources
* Your current level of engagement with major prospects
* The intensiveness of your account based strategy

## How Should You Allocate Your Resources?

We think the best way to select target accounts is by looking at how many resources you have to invest. This depends on how you handle the different tiers or styles of ABE.

A given enterprise Account Executive may only be handle a few Tier 1 accounts, but a corporate rep could probably handle a few hundred Tier 3 target accounts at a time. **The right number of accounts is the number that your team can handle in a tier-appropriate way**.

We know one company where management felt their reps could have 100 named accounts at a time – but they gave each one 150 accounts so the reps wouldn’t feel like their territories were too small.

Across a sample of Engagio customers, the median number of accounts per account owner is 50. Quite a few Engagio customers have a lower number, 20 to 30 accounts per account owner, and quite a few have 100 or more accounts per owner.

![Engagio Customer Sample](https://images.ctfassets.net/23aumh6u8s0i/4u0xzFNyWQB00kfCwWmiAn/129611a4505b391dcc511f63d116776d/engagio-customer-sample)

As you can see, there’s a lot that goes into establishing the base for your Account Based Everything program. We’ve just scratched the surface of the first step. To learn more about the WHO (and the WHAT and the WHERE) of Account Based Sales Development, download [The Clear & Complete Guide to Account Based Sales Development](http://www.engagio.com/clear-and-complete-guide-to-account-based-sales-development/).

How many accounts does your team manage, on average? How did you make this decision?

> Auth0 can help B2C companies to enrich the profile of their customers through an easy to use [Modern Customer Identity Management solution](https://auth0.com/b2c-customer-identity-management).

<div class="alert alert-info">
<strong>About Brandon Redlinger:</strong><br />
Brandon Redlinger is the Director of Growth at <a href="http://www.engagio.com/" target="_blank">Engagio</a>, the Account Based Everything platform that orchestrates human connections. He is passionate about the intersection between tech and psychology, especially as it applies to growing businesses. You can follow him on Twitter <a href="https://twitter.com/Brandon_Lee_09" target="_blank">@brandon_lee_09</a> or connect with him on <a href="https://www.linkedin.com/in/brandonredlinger" target="_blank">LinkedIn</a>.
</div>


Build The Ultimate Account Based Marketing Machine with Account Selection

Multifactor authentication is important, but the question of implementation is more complex than it seems.



<div class="alert alert-info alert-icon">
  <i class="icon-budicon-500"></i>
  <strong>Forrester Consulting analysis determines that using Auth0 can yield a 548% ROI and $3.7M in identity-related savings. Read the full report: <a href="https://resources.auth0.com/forrester-tei-research-case-study/">Total Economic Impact of Auth0</a>.</strong>
</div>

---

## Intro

In recent years, [multifactor authentication](https://auth0.com/multifactor-authentication) has become quite the buzzword in information security. Products from Twitter to Instagram have implemented their own two-step login processes, responding to widespread user demand for better security and the ever-present reality of hackers cracking accounts and selling them across the internet.

All this popularity has also led to the creation and perpetuation of various myths about [multifactor authentication](https://auth0.com/multifactor-authentication) — what it is, what it's for — that can mislead developers and users alike.  

Going with multifactor authentication is almost always going to be an improvement over not. But it's table stakes now. Sophisticated attackers aren't deterred by poorly configured multifactor authentication systems. To keep internal and user information secure, you need to know what you're doing.

> Give your customers enterprise identity integration, frictionless SSO across your products and adaptive authentication with MFA and Anomaly Detection. [All of this with a flip of a switch](https://auth0.com/b2b-enterprise-identity-management).

## Myth #1: There are only a few different forms of MFA

An authentication [factor](https://auth0.com/identity-glossary) is a vector through which identity can be confirmed or denied, from fingerprint scanners to passwords, from USB sticks to PIN codes. The commonly used term “multifactor authentication” simply refers to an authentication scheme that uses **more than one** of these methods.

It was once true that most MFA systems operated basically the same way. Today, however, there's a great variety of factors you can request from your users, from push notification receipt to SMS to email to fingerprint.

### Reality: MFA is extremely customizable

![MFA alternatives](https://images.ctfassets.net/23aumh6u8s0i/1DLAvyone2D6hjqEsLRrmC/9c24dbdf6a6202d6568f9853d1afa568/mfa-alternatives)

There are three entire genres of factor—knowledge, possession, and inherence:

* **Knowledge:** Something only a particular user knows, such as a password or the answer to a secret question.
* **Possession:** Something only a particular user has, such as a USB stick or identifying badge.
* **Inherence:** Someone only a particular user is, such as determined through a fingerprint scanner or GPS recognition system.

Every multifactor authentication system out there is built upon some combination of these three basic factors. A simple password/secret question system would be made up of two separate knowledge factors, while one that asked you for an [RSA hardware token](https://www.rsa.com/en-us/products-services/identity-access-management/securid/hardware-tokens) in addition to your password would be made up of both knowledge and possession factors.

A [passwordless login system](https://auth0.com/passwordless) relies upon you being in possession of, and able to access, your email inbox. And so on. There are so many different forms of authentication out there now that you can freely choose whether you want something that maximizes ease of use, something that maximizes security through obscurity, or something in between.

## Myth #2: Your use case for MFA doesn't matter

[RSA](https://en.wikipedia.org/wiki/RSA_Security) and [TOTP](https://en.wikipedia.org/wiki/Time-based_One-time_Password_Algorithm) are two of the most popular methods for generating secure codes that we have today, but they are not interchangeable — both have their pros and cons.

The main technical difference between them is that RSA operates asymmetrically, with a public and a private key, and TOTP operates symmetrically, with a single private key shared between both parties. But this isn't just a minor detail about how the two systems work. This single difference affects the appropriate context for each one and the trade-offs you will be making.

### Reality: You have to choose your method based on your needs

The security of the public/private key pair of RSA “relies on the computational difficulty of factoring large integers”:

1. Two extremely large prime numbers are generated using the [Rabin-Miller primality test algorithm](http://searchsecurity.techtarget.com/definition/RSA).
2. The public key is generated from the modulus of those two prime numbers and a public exponent.
3. The private key is generated from the modulus of those two prime numbers and an exponent calculated with the Extended Euclidean algorithm.

This also means that computational power is required to encrypt and decrypt RSA when it's used properly. That makes RSA slower, but the benefit is that only one side of the transaction needs to actually [possess the private key](http://crypto.stackexchange.com/questions/11293/hmac-sha256-vs-rsa-sha256-which-one-to-use).

TOTP, on the other hand, operates symmetrically. A secret key is known to both the signer and the signee at the same time. A hash function is used to blend the secret key with the time at the moment of authentication (requiring fairly precise clock synchronization) and a one-time password is generated that is valid only for a short amount of time.

![TOTP screenshots](https://images.ctfassets.net/23aumh6u8s0i/59ont0UsxtdYX86pmfRUOw/489f1c775b9b6d8e9d1632fd3917c190/totp-screenshot)

This takes significantly less time and processing power than RSA, but it does mean certain vulnerabilities become hypothetically possible. If a key was somehow compromised on the server-side, for instance, an employee of an organization could potentially impersonate a user to malicious ends. With RSA, the same employee would have to [change the codebase](http://crypto.stackexchange.com/questions/11293/hmac-sha256-vs-rsa-sha256-which-one-to-use) to do such a thing—likely leaving a paper trail.  

If you absolutely need your users to be able to download and store their private keys on their own systems—maybe you're working with [financial data](http://resources.docs.salesforce.com/204/14/en-us/sfdc/pdf/salesforce_security_impl_guide.pdf) like credit cards, health records, or other forms of sensitive information—you may want to go with an asymmetric method like RSA.

## Myth #3: All MFA solutions work basically the same way

Mass adoption of multifactor authentication is still a significant work in progress, and it's fair to say that most sites should simply focus on implementing it in some form or another—not which method is the absolute perfect one.

That does not, however, mean that every single form of multifactor authentication is equally secure. Each occupies a different position on the axes of security and ease of use, which means that each one will be optimal under a different set of circumstances.

### Reality:  you have to choose what you value most

SMS is one of the older and more common forms of multifactor authentication that you see out there. You log in to a website, and then to double-check your identity, a code is sent to a phone number that you have on file. You receive a text on your mobile phone that contains a code, and then you enter that code into the website to verify yourself. Simple.

But the U.S National Institute of Standards and Technology has recently come out with a report saying they believe that SMS multifactor is vulnerable to hijacking, [particularly when used](http://thehackernews.com/2016/07/two-factor-authentication.html) by subscribers to a VoIP phone service like Google Voice. SMS is also vulnerable to social engineering—in some instances, attackers have been able to simply call up a victim's phone company and, impersonating their target, ask that all text messages to that account be forwarded to a different one.  

These vulnerabilities, plus the fact that other forms of authentication have become more user-friendly, mean that many sites and apps enabled with multifactor authentication are moving on to different methods.

![Different multifactor alternatives](https://images.ctfassets.net/23aumh6u8s0i/1AV7Hb9MZLBz8ACf4w3W1h/bdc724d1db6ef8d086748059b8cd03ed/apps-of-mfa)

There's the time-based one-time password algorithm, or TOTP, which is most notable used by apps like Google Authenticator. A single-use password is generated from the combination of a secret key and the current time, and you enter that into the app asking for authentication rather than a code that could have been intercepted in transmission.  

TOTP, because it often involves users manually copying a six-digit code from their phone to their computer, is often considered to be a burden on users. With [Auth0 Rules](https://auth0.com/docs/rules), though, you can get the benefit of MFA without that annoyance by setting up special conditions under which authentication will be requested.

Say someone tries to call your bank's customer support to reset your password — as they did to [Brian Krebs](https://auth0.com/blog/how-paypal-could-have-avoided-account-hack/) — that event could be flagged as requiring a temporary extra authentication. You could trigger the same kind of request in the event of a new email account being added, an address being changed, and the like. This will keep your users' personal information and account more secure without disrupting their usage of your product, as they likely won't be performing these kinds of actions very often.

## Myth #4: MFA is always annoying for users

At many companies where multifactor authentication is tried but fails, one of the most common complaints is that it makes logging in too much of a hassle for users.

They have to first enter in their username and password, and *then* open up their email client or take out their phone, and *then* manually copy a code. Or they lose the hardware key that they were given during onboarding, or they misplace their mobile device and are no longer able to login to anything.

 These companies get so many annoyed emails from their employees, or start noticing users forgetting their passwords and consequently churning, that they finally turn MFA off.

### Reality: MFA can be as easy as tapping a push notification

MFA does not have to be troublesome for users. It doesn't have to require keeping track of a token, manually writing a code, or copying and pasting a code from a mobile device to your computer.

With [Auth0 Guardian](https://auth0.com/guardian/), you can make logging in through multifactor authentication a simple matter of swiping and tapping a push notification from your [phone's lock screen](https://auth0.com/blog/announcing-Auth0-Guardian-a-new-way-to-login/).

![Auth0's Guardian App](https://images.ctfassets.net/23aumh6u8s0i/4AioGEVTLJvh8eWtJ24e9N/99cd88daab3f584eb21e5689264aa87a/auth0-guardian-mfa)

It's available for both iOS and Android, and can be enabled with a [simple toggle](https://auth0.com/guardian). Check out the full docs [here](https://auth0.com/docs/multifactor-authentication/guardian).

## Myths Busted

There's no doubt that [implementing multifactor authentication is one of the best ways to improve the security of a website or an app](https://auth0.com/multifactor-authentication) that doesn't have it. But as with any decision regarding the privacy and security of your users and their information, nothing is as simple as it appears at first glance.

At [Auth0](https://auth0.com/), we want to make sure that MFA is something you can implement knowing that it will protect your accounts without harming the user experience. With [Guardian](https://auth0.com/guardian/), we're pushing that project forward, and we're really excited to have you try it out. Check it out!

> [Auth0 offers a generous **free tier**](https://auth0.com/pricing) to get started with modern authentication.


Is Multifactor Authentication The Best Way To Secure Your Accounts? Myths And Reality

667b1c82b6cc2241ff176d50c65da603?s=200 avatar

667b1c82b6cc2241ff176d50c65da603?s=200

Eugene Kogan

How to prevent criminals to mess with your accounts



Yes, definitely. It’s happened to a number of people I work with.

Imagine you’re walking down the street, checking Slack or Facebook, and someone on a bike rides by and grabs your phone. Guess what, your phone is unlocked and ready for the thief to start using it. The same thing can happen in a bar, the subway, or any other crowded place. Even Scotland Yard has started [using](http://www.bbc.com/news/uk-38183819) this technique (but that’s another matter).

![Getting robbed while phone is unlocked](https://images.ctfassets.net/23aumh6u8s0i/4Kr00xYZ8Z4iCkFPziAi6y/7f5e7c11ed2ede9a715a1ba481859d37/getting-robbed)

The average iPhone thief doesn’t care about your data, he just wants to wipe the phone so he can resell it. This kind of crime is especially prevalent in countries like [Argentina](http://money.cnn.com/2016/09/14/technology/argentina-iphone-black-market/), where there’s a large black market for Apple products. You might be thinking that the thief still needs to disable Find My iPhone to release Apple’s [Activation Lock](https://support.apple.com/en-us/HT201365). That’s true, but if the phone itself is already unlocked, all he needs is your iCloud password.

Do you get your email on your phone? Is it the same email address that’s tied to your iCloud account? Well, guess where iCloud password reset emails used to go? Before a recent update to iOS, it was possible to reset someone’s iCloud password directly from their unlocked phone, simply by virtue having access to their email account. Even if you use Apple’s [two-factor authentication](https://support.apple.com/en-us/HT204915) (which you absolutely should), that works over SMS or push notifications, which also go to your phone.

Previous, there was nothing blocking a thief from stealing your phone while it was in use (and unlocked), resetting your iCloud password via your email account, disabling Find My iPhone, and finally wiping it to be resold. Thankfully, Apple appears to have quietly fixed this loophole by making it more difficult to reset an iCloud password. If you attempt it from your phone (even via Safari), it will ask you for your unlock PIN.

I used to recommend taking an additional precaution to mitigate this risk, but it’s not really necessary anymore (although it can’t hurt). If you follow these steps, the iCloud account settings will be completely unavailable until you disable “Restrictions” with an extra PIN that you’ll set below. Go to *Settings > General > Restrictions > Enable Restrictions > [create a PIN, enter it twice] > Accounts > Don’t Allow Changes*

Now that Apple has added the necessary security checks to the iCloud password reset process, my recommendations are simpler: enable two-factor authentication for iCloud, and choose a hard to guess, 6-digit (or longer) PIN on your iPhone. With Touch ID, you rarely have to type it anyway.

![Apple's two factor authentication](https://images.ctfassets.net/23aumh6u8s0i/1JZgMtXTm0TfSnGCab8MWK/c2a81630672de5ada598f83c417b2d2b/apple-2-factor-auth)

**Kudos to Apple for making this improvement. I believe it will help keep people safer by discouraging iPhone muggings.**

Now, if you’re a bit more paranoid and want to really limit what someone can access if they snatch your phone while you’re in the middle of using it, there is one more thing you can do.

An [engineer](https://twitter.com/radekk) on my team at Auth0 told me about [Guided Access](https://support.apple.com/en-us/HT202612), an iOS feature that lets you temporarily restrict the phone to a single app, and can even limit the actions available to the user within an app. With Guided Access configured (*Settings > General > Accessibility > Guided Access*), you can press the home button three times to enable it at any time, within any app. Once it’s on, you’ll need the Guided Access PIN or Touch ID to exit the app. It’s that easy.

Imagine you’re reading the news on your iPhone on the subway. You can quickly enable Guided Access, and lock it down to that one app only. Then even if someone grabs your unlocked phone, they’ll be stuck in the news app forever! (No one wants to read the news for too long nowadays.) Sure, the thief can always power it off, but then the phone will be really locked and essentially useless to them, even for reselling.

Guided Access is intended for situations like when parents let their kids play with their iPhones (or iPads), but it’s actually quite powerful. You could even use it if you think Scotland Yard might be after you…

Could your iPhone get stolen while it's unlocked?

eHk3ciM

I am the Group Manager, Developer Content at Okta, and a Google Developer Expert in Web Technologies and Angular. I'm passionate about identity, authentication, constant learning, and developer communities. As a developer advocate, engineer, mentor, and international speaker, I love learning from and sharing with other inhabitants of the tech space.

Group Manager, Developer Content

Kim Maida

Yahoo has confirmed that in late 2014, at least 500 million user accounts were stolen in a large-scale data breach, exposing names, emails, and more.



---

## Half a billion Yahoo accounts were leaked in large-scale data breach

Yahoo has confirmed that 500 million user accounts were exposed in a massive data breach that occurred in late 2014. Breached data potentially included users' names, emails, phone numbers, birthdates, hashed passwords, and in some cases, encrypted or unencrypted security questions and answers. Yahoo claims that financial information such as bank accounts or credit card credentials were not included in the breached data.

The official notification from Yahoo's Chief Information Security Officer Bob Lord can be read here: [An Important Message About Yahoo User Security](https://yahoo.tumblr.com/post/150781911849/an-important-message-about-yahoo-user-security).

Yahoo announced that the company believes the hacker to be a state-sponsored actor: a hacker acting on behalf of a non-US government. A spokesperson for the FBI said they are aware of the intrusion and investigation is underway.

[Verizon is currently in the process of acquiring Yahoo for $4.8 billion](http://www.usatoday.com/story/tech/news/2016/07/25/verizon-winner-yahoo-sale/87500668/). Verizon was made aware of the data breach within the last couple of days, but a spokesperson for the communications company claims Verizon has "limited information and understanding of the impact [of the security incident]."

To comprehend the scope of this attack, let's compare it to another within the last decade. In 2007, the [TJX data breach](http://www.nbcnews.com/id/21454847/ns/technology_and_science-security/t/tjx-breach-could-top-million-accounts/#.V-RR99yClTY) exposed 94 million credit and debit card accounts. At the time, it headlined as the biggest cybersecurity attack ever. At an estimated minimum of 500 million, the Yahoo incident leaked over five times as many accounts, making it the new largest data breach in history.

Yahoo asserts that they are notifying potentially affected users. The company is also recommending that users update their passwords and security questions if they have not done so since 2014. 

Although financial data may not have been leaked in the Yahoo data breach, Yahoo also provides login for [Flickr](https://www.flickr.com/) as well as [Oauth](https://developer.yahoo.com/oauth/) for third party websites. In addition, users frequently reuse the same email addresses and passwords for multiple accounts. When user credentials are leaked, it can compromise many more accounts than the one specifically exposed.  

## Aside: Protect your users from password leaks with Auth0

Auth0 provides breached password detection that can be enabled simply and easily. The Auth0 security team maintains a database of third party breached credentials. This database is updated daily. On each login, user credentials are checked against the leaked passwords database. If a breach is suspected, the user is notified and cannot log in until they change the compromised password.

<video autoplay loop width="600">
  <source src="https://cdn.auth0.com/blog/breach/lock-2.m4v"/>
<img src="https://images.ctfassets.net/23aumh6u8s0i/3DpdlDPwLfrdGGb7RUQ6NU/d959326b776a71764727d5e3eae43c8a/lock"/>
</video>

Read about [Breached Passwords](https://auth0.com/breached-passwords) and [Anomaly Detection](https://auth0.com/docs/anomaly-detection) to learn more about how to protect users and their credentials with Auth0. You can also <a href="https://auth0.com/signup" data-amp-replace="CLIENT_ID" data-amp-addparams="anonId=CLIENT_ID(cid-scope-cookie-fallback-name)">sign up for a free Auth0 account</a>!



Yahoo Confirms Data Breach of Half a Billion User Accounts

99c4080f412ccf46b9b564db7f482907?s=200 avatar

99c4080f412ccf46b9b564db7f482907?s=200

I'm currently a Senior Developer Advocate at MongoDB. I'm also a Google Developer Expert for Web Technologies and spend most my time giving talks at conferences and meetups, mentoring developers and running workshops, and creating online content to help technology professionals.

Former Auth0 Employee

Ado Kukic

Learn about passwordless authentication and how Facebook Account Kit can help your app become password free.

Passwordless Login with Facebook Account Kit

In this post you'll learn 5 techniques that can prevent your users' accounts from being hacked and would have made Brian happier



Yesterday, _Brian Krebs_ from [Krebs on Security](http://krebsonsecurity.com/2015/12/2016-reality-lazy-authentication-still-the-norm/) reported that his PayPal account had been hacked using one of the oldest hacking methods: **social engineering**, and knowing some pieces of static information about the account owner —the last four digits of an old credit card and the last four digits of the social security number—.

Being a known security expert, Brian had a strong account password; that is, it was long and complex, and used all types of characters. A strong password is mandatory, especially for a service that is directly linked to the user's credit cards. In Brian's case, he soon discovered that it was not his password that was compromised. Instead, the cyber criminal called PayPal customer support, impersonated him, and got access to his account in a matter of minutes, having provided only that static and easy-to-obtain information about the user, not once but twice.

## 5 Things that Could Have Prevented the Hack

In this post, we'll teach you five things you can implement to prevent your users from being hacked. Make Brian safe again!

### 1 - Multifactor Authentication

**Multifactor Authentication (MFA)** is a method of identifying users by presenting several separate authentication stages. Some of those stages could be a Time-based One-Time Password (TOTP), mobile verification, or a hardware token, among others.

> Learn more about MFA, in the [Get Started with MFA landing page](https://auth0.com/learn/get-started-with-mfa).

Believe it or not, most of the biggest retail stores don't provide these additional layers of security or are just starting to provide them. For example, [**Amazon**](http://www.amazon.com) added this option in mid-November without making an official announcement, as reported by [The Verge](http://www.theverge.com/2015/11/18/9753888/amazon-two-factor-authentication-2fa).

With MFA, a cyber criminal must not only know the password, but also possess a mobile phone or token device in order to access the account. Some companies believe that enforcing multifactor authentication could result in the loss of a significant number of users; for those companies, an intermediate solution can be achieved by requiring a second factor only for resetting the password.

PayPal has this option available by using hardware tokens, but evidently this is not required in their password reset flow.

<div class="" style="text-align: center;"><img style="margin: 0; max-width: 200px;" src="https://images.ctfassets.net/23aumh6u8s0i/2LB9dXQu6yRDwVt2oQFwqR/3dba5964313886fdef5f86bcb282c98d/why-is-mfa-necessary" alt="Multifactor Authentication" />
</div>

### 2 - Passwordless Login via sms and email
With Passwordless Login you can use one-time codes or “magic links” delivered via SMS or email. In this way, only users who have access to the registered email account or registered phone will be able to login. If PayPal support had offered this option, they could have ensured that the person claiming access was the legitimate owner by sending an email or SMS with a code or link.
​​
> You can read more about Passwordless [here](https://auth0.com/blog/2015/09/30/auth0-passwordless-email-authentication-and-sms-login-without-passwords/).

![Passwordless Login](https://images.ctfassets.net/23aumh6u8s0i/3QYNw3edBKso3qNe2A6djc/d8449a97f4bb29e325c3459fa495fa99/pwdless-locks)

### 3 - Step Up Security
With **Step Up Security**, critical actions in user accounts—adding or changing email accounts, changing passwords, and so on—require additional security measures. Brian Krebs' attacker called customer support to reset his password. This critical action needed stronger security measures—such as multifactor or passwordless authentication—as the company should have ensured that it was being performed by the legitimate user.

![Step Up Security](https://images.ctfassets.net/23aumh6u8s0i/7MieEkMD4W8csXw1s959XX/136172cf228821b1575b772c930c620e/step-up-security)

### 4 - Trained Support
Companies **must invest** in training their customer support employees in security procedures. This point is often inadequately considered, which leads to situations like granting access to anyone with the sufficient static information. And this in turn will make the company lose its reputation.

<include src="TweetQuote" quoteText="Companies must invest in training their customer support employees in security procedures."/>

However, we have learned from past attacks that social engineering [virtually always will succeed eventually](http://www.wired.com/2014/01/my-epic-hack-revisited/). While training of support staff is needed, it must be part of a larger security strategy. Using a method above to build a system that requires customer verification is an important step in preventing social engineering.

![Trained Support](https://images.ctfassets.net/23aumh6u8s0i/3euV9iQyU0NVBE6W0X8efW/7cf38b6a199db837a7f2280cefffe4fd/trained-support)

### 5 - Single Sign On with Another Service
Using Single Sign-On, once you log into one trusted service or provider, you don't have to enter your credentials again when entering another application that supports it, as you will be automatically logged into all supported applications, regardless of the platform, technology, or domain.

If PayPal had allowed Single Sign-On with another trusted service, it would have added an additional security layer to prevent the hack. A legitimate user who lost his password but could log into a trusted service could easily reset his password without needing to go through customer support.

> Learn more about [Single Sign-On](https://auth0.com/learn/how-to-implement-single-sign-on).

<div class="" style="text-align: center;"><img style="margin: 0; max-width: 200px;" src="https://images.ctfassets.net/23aumh6u8s0i/74MkL0x1mxFBflGp20ecX/222af83745d01410e75bca971c39a390/bg-login" alt="Single Sign On" />
</div>

## Aside: How Auth0 Can Help You Strengthen the Security of Your Application's Accounts
Using Auth0 you can add the following features to your application in a breeze.

- **Multifactor Authentication**: Using Auth0 you can have MFA implemented in minutes! You can use the out-of-the-box providers or easily integrate any different provider using Auth0's extensibility.

- **Passwordless**: [Auth0 Passwordless](https://auth0.com/passwordless) supports one-time codes or “magic links” delivered via SMS or email without having to worry about the implementation details.

- **Single Sign-On**: By taking advantage of our wide range of SDKs you will have Single Sign-On with any Identity Provider running in minutes. Provide your users with a seamless authentication experience when they navigate either through the applications you built and/or third party apps.

## Final Words
What it is interesting is that **PayPal**, populated by a lot of smart people and with more actual experience in online payment systems than almost anyone, relies on inherently insecure procedures. They certainly know everything Krebs talks about in his post, they have the resources to do something different, and yet they don’t. Why Paypal doesn’t have tighter procedures? The answer to that question is probably because their cost of fraud is lower than the cost of implementation. You can be 100% sure they’ve modeled it out and believe that tighter security drives away customers or some other cost factor that outweighs the cost of fraud. As we always say, if companies don't handle security properly, that could lead to losing their most precious asset: its reputation.


How PayPal could have easily avoided the last account hack

New features make it easy for subscribers to ditch passwords and enable their users to log in with just an email account or mobile phone



**BELLEVUE, Wash.**--(BUSINESS WIRE)--[**Auth0**](https://auth0.com), the leading universal identity platform, today introduced [passwordless authentication](https://auth0.com/passwordless), allowing developers to quickly and easily implement secure authentication for their apps without the need for passwords. Passwordless authentication through Auth0 uses email, or SMS to replace a username and password for any application. Also released today is Auth0’s ‘Lock Passwordless’ - a free login box widget for software developers that can be integrated into any web, native or mobile application with just a few lines of code, almost effortlessly enabling use of a fingerprint or one-time access code or link.

*“Passwords can be easily forgotten or stolen,”* said Auth0 CEO, Jon Gelsey. *“By eliminating the need for users to remember passwords, developers and IT professionals can reduce hassles for their users, greatly increase the security of their apps, APIs and IoT devices, and accelerate user acquisition. Now, any application can easily incorporate simple yet strong multifactor identity security.”*

Passwordless authentication uses either a fingerprint, a temporary secret link, a temporary secret code, or a combination of the three to allow access and authenticate a login. The link or code is sent to a user’s verified email address or phone number, or is displayed on an authenticator app on their phone. The link or code expires after a few minutes, ensuring that others cannot gain access if the code becomes compromised. In addition, OS native fingerprint identification can also use the fingerprints of a pre-registered user to log them in. Email, and SMS passwordless authentication can be implemented with just a few lines of code and Auth0’s cloud platform, and can be combined with other features such as multifactor authentication.

*“Human error associated with passwords is a common entry point for hackers to exploit. The prevalence of easy-to-guess passwords or passwords compromised through exploits is low-hanging fruit for black hats,”* Gelsey continued. “Passwordless authentication makes access more secure, while removing the burden of remembering and typing a strong password on a phone.”

<include src="TweetQuote" quoteText="Human error associated with passwords is a common entry point for hackers to exploit."/>

Auth0’s goal is to make secure identity implementation and management easy for developers and IT professionals. Auth0’s passwordless authentication can be used with any identity provider or application, making the migration away from traditional passwords extraordinarily simple. This announcement is the latest addition to Auth0’s comprehensive and ever-growing universal identity security platform which also helps subscribers implement single-sign-on (SSO), multifactor authentication (MFA), and much more across any application, API or IoT device.

<include src="asides/AboutAuth0" />


Auth0 Introduces Passwordless Authentication

eugenio-pace-new-avatar

Pace co-founded Auth0 in early 2013 with CTO and “brother-in-arms” Matias Woloski while living 7,000 miles apart from each other. Since then, Pace has played an instrumental role in growing Auth0 into a leading identity management company that is loved by developers and trusted by global enterprises. He loves traveling and has visited more than 35 countries for business and pleasure. He currently lives in Redmond, Washington with his wife, two sons, and their labrador retriever. In his spare time, he enjoys the outdoors, rowing, riding bikes, spending time with his family, restoring his 1970 Karmann Ghia, writing his blog, and reading history and philosophy.

CEO and Co-Founder

Eugenio Pace

Today Amazon announced a new Login Service, which allows you to connect with millions of their customers

Today Amazon announced [a new Login Service](http://login.amazon.com), which allows you to connect with millions of their customers:

From their [press release](http://phx.corporate-ir.net/phoenix.zhtml?c=176060&p=irol-newsArticle&ID=1824961&highlight=):
> Today, Amazon launched __Login with Amazon__, a new service that will enable the over 200 million active Amazon customers to securely and simply login to apps, games, and websites. Login with Amazon allows developers to easily reduce sign-in friction for their customers, leading to higher engagement and order conversion.

The good news for those using Auth0, is that connecting with Amazon is just a click away. We launched support for Amazon today:

![SSO Amazon](https://images.ctfassets.net/23aumh6u8s0i/1i9UzNljbW660b6J3V2UgQ/5140b7e0b57be3a15622447bf6c7edbf/auth0-amazon-connection)



Auth0 gives you the ability to connect Amazon accounts with _any_ application: web, mobile or native; regardless of what platform it is written on, or what identity protocols it supports. Auth0 supports .NET, Java, Ruby, iOS, Android, Windows, and others with very few lines of code, and minimum intrusion.

And this extends of course to popular apps like __Salesforce__, __Zendesk__, __Dropbox__, __SharePoint__, __MSCRM__, among others. We keep adding popular apps and the list grows quickly!

There are two permission scopes available today in Amazon:

* __Basic Profile__, the default permission that allows you to retrieve the user's name, e-mail and a unique id.
* __Postal Code__, that allows you to retrieve the location of the user.

These two are very easily configured with Auth0 dashboard:

![SSO Amazon](https://images.ctfassets.net/23aumh6u8s0i/5ziOzwL0ROXtyy7UbFQl2y/6310397cd8dbf0a6b7df3f046c6c911d/auth0-amazon-dashboard)

Registration of your instance of Auth0 with Amazon is very straightforward and [fully documented](https://docs.auth0.com/amazon-clientid) right were you need it.

[Try Auth0 yourself!](https://auth0.com)

"account"