joey devilla headshot 900px

I’m a Senior Developer Advocate at Auth0, and I like to work on various technologies. I’ve developed software for all sorts of platforms, from CD-ROM and the PalmPilot to my current area of focus, mobile phones, IoT devices, and AI. When I’m not looking for strange new platforms to write software for, I’m playing a strange old instrument — the accordion!

Senior Developer Advocate

Joey deVilla

Detect hackers with Auth0 Actions and special accounts designed to catch them in the act.

Use Honeytokens and Auth0 Actions to Catch Malicious User Logins

Nabeel-Saeed

Nabeel is a product marketer focused on all things security and identity. He has contributed to publications like Wirecutter, Information Age, and Professional Security. He has also been a guest speaker at the Bay Area Cybersecurity Meetup, and delivered talks on IAM across the US, Canada, Israel, and Singapore. He is passionate about helping build secure auth experiences that amaze users and delight businesses.

Product Marketing

Nabeel Saeed

Attackers are getting better at compromising customer accounts. Here's how to stop them

Customer Identity (CIAM) is a unique segment of the wider Identity and Access Management (IAM) space, as customer-facing applications face a different threat landscape and must deliver an experience that's user-friendly — as well as secure and private. It must rely on subtle techniques to achieve and maintain a strong security posture while also driving conversions and building trust with consumers.

Our [2022 State of Secure Identity Report](https://auth0.com/resources/whitepapers/2022-state-of-secure-identity-report) presents trends, examples, and observations unearthed from observing the billions of authentications on our platform in the hope that bringing light to such insights will help organizations understand the threats against customer identity and drive informed conversations around Zero Trust.

### Fraudulent registrations are an ever-present and growing threat

In the first 90 days of 2022, signup fraud accounted for approximately 23% of signup attempts on our platform, up from 15% in the same period last year (per last year's report). Financial Services and Energy/Utilities experienced the highest proportion of signup attacks, with such threats accounting for 64.8% and 72.5% of registration attempts in those two industries, respectively.

### Credential stuffing is on a record pace

2022 has already delivered the two largest such credential stuffing attacks we have ever witnessed, and across all industries, credential stuffing accounts for 34% of overall traffic/authentication events on our platform. While most industries experienced a credential stuffing rate of less than 10% of login events, in several cases — Retail/eCommerce (more than 80%), Financial Services, and Entertainment — these attacks represented the majority of login attempts.

### Threat actors are targeting MFA

Because of its proven merits, more application and service providers are recommending or requiring MFA. Consequently, the first half of 2022 has seen a higher baseline of attacks against MFA than any previous year in our dataset. As attackers become more sophisticated at targeting this important defensive measure, it's critical that MFA be implemented correctly and that strong secondary factors are chosen.

### Breached Passwords are a pervasive but poorly understood threat

Account takeover attacks with stolen credentials are one of the most common and costly cyber threats. Entire marketplaces exist to sell lists of user credentials leaked in third-party breaches. In fact, 58% of all Auth0 customer applications have experienced login attempts using breached/leaked credentials, illustrating the widespread nature of these attacks. What's more, most of the services that purport to protect against breached passwords use web scanners and scrapers that rely on breach data being made public, which can be months or even years after the initial breach. Reusing passwords across sites increases the risk of an attack and makes it more difficult for organizations to prevent fraudulent access to user accounts. In order to defend apps and users against this pervasive threat, it's imperative that breached passwords are detected as soon as they are compromised and accounts notified.

### CIAM at the vanguard of identity security

In an enterprise environment, security trumps convenience, so administrators can impose controls with comparatively little regard for the user experience — but customer identity management must maintain security and privacy while minimizing friction. Because of this restriction, CIAM exists at the vanguard of identity security and innovation, as it depends upon defenses that can withstand sophisticated threats but that are nearly invisible to users.

With this report, we aim to increase awareness of both threats to customer identity and the techniques that can be layered to build reliable defenses.

### Three ways to stop identity-based attacks

1. **Implement MFA everywhere.** It is still one of the best defenses we have against sophisticated attacks.
2. **Augment with defense-in-depth tools. **These work in combination across the user, application, and network layers, such as scanning for bot traffic and breached passwords among your user base.
3. **Invest in a customer identity solution.** Embrace flexibility by default and customize security and ease of use depending on your risk appetite, user requirements, and implementation.

> 📈 [Download the report](https://auth0.com/resources/whitepapers/2022-state-of-secure-identity-report) for a deeper dive into insights gained from a platform that authenticated billions of logins each month.

### Methodology

This report is based on data from Okta customers using the Auth0 platform around the world and so represents real-world observations of identity attacks. The data was retrieved by Auth0's security researchers by running simple and anonymous queries against our aggregate database of operational telemetry. Industry segmentations are based upon each customer's self-reported segment. Observations are from the first 90 days of 2022 unless otherwise noted.

Top Insights From Our 2022 State of Secure Identity Report

arthur-bellore

I’m a tech content creator. I enjoy breaking up seemingly complicated topics into easy-to-understand pieces for people to read. When I’m not in front of a computer, you’ll usually find me reading books.

Cybersec Writer

Arthur Bellore

With modern computers capable of testing millions of password combinations per second, securing your online accounts with only a password may not be sufficient anymore.

The Working Principles of 2FA (2-Factor Authentication) Software

df6c864847fba9687d962cb80b482764?size=200 avatar

df6c864847fba9687d962cb80b482764?size=200

Martin Gontovnikas, a.k.a Gonto, is a software engineer at heart who moved to the ‘dark side’ and became VP of Marketing at Auth0. He considers himself lucky to have found a way to combine his two passions and apply his engineering thinking model to marketing.<br/><br/> Gonto’s analytical thinking is a huge driver of his data-driven approach to marketing strategy and experimental design. He is based in the Bay area, and in his spare time, can be found eating gourmet food at the best new restaurants, visiting every local brewery he can find, or traveling the globe in search of new experiences.

Former SVP of Marketing and Growth at Auth0

Martin Gontovnikas

MFA adoption urged to fight e-commerce fraud


Fraudulent purchases and data breaches are an incredibly costly problem for online retailers, and they are on the rise. A [ThreatMetrix report](https://www.signifyd.com/blog/2018/06/26/ecommerce-fraud-grow-threatmetrix/) found that in the first quarter of 2018, the growth of e-commerce fraud attempts outpaced the growth of overall e-commerce transactions by 83%.

According to the latest data from [IBM](https://digitalguardian.com/blog/whats-cost-data-breach-2019), the average cost of a data breach is currently $150 per compromised record, and the costs of data breaches will only increase with the passage of new privacy legislation.

For business leaders concerned about protecting profits and customer data from attacks the National Institute of Standards and Technology’s (NIST) [recent guidance for e-commerce businesses](https://www.nccoe.nist.gov/projects/use-cases/multifactor-authentication-ecommerce) to implement multi-factor authentication (MFA) can offer some relief.

<include src="TweetQuote" quoteText="According to the latest data from IBM, the average cost of a data breach is currently $150 per compromised record"/>

When deployed properly, MFA is one of the strongest defenses against fraudulent purchases and administrative data breaches, yet e-commerce has been [slow to adopt it](https://www.experian.com/assets/decision-analytics/reports/global-fraud-report-2018.pdf). [Experian’s research](https://www.experian.com/assets/decision-analytics/reports/global-fraud-report-2018.pdf) found that only 44% of businesses currently employ MFA, which they attribute to concerns about it negatively impacting customer experience.

Yet modern MFA solutions allow businesses to balance [security and convenience](https://auth0.com/blog/security-vs-convenience/). The NIST’s guidelines offer actionable advice for e-commerce to catch up to current security standards and what to look for when embracing MFA.

In this piece, we’ll go over what MFA is, how the NIST defines sound MFA solutions, and how e-commerce businesses can effectively implement MFA while balancing their other business needs.

## MFA in a Nutshell

In the simplest terms, [MFA](https://auth0.com/learn/get-started-with-mfa/) is a protocol for determining if individuals using your system are who they claim to be. MFA demands more than one (usually two) types of credentials:

* Something someone knows (like a password or their mother’s maiden name)
* Something they have (such as a phone on which they can receive a one-time SMS code)
* Something they are (biometric ID such as a fingerprint or facial scan)

![Multi-Factor Authentication Auth0](https://images.ctfassets.net/23aumh6u8s0i/4VTHSpJTsDhLuAyznJK2BE/27185cb5d398e5f1dc609141c781d57b/mfa-auth0)

A business using MFA can request additional verification at any point in a user’s session: login, purchase, or when navigating within a site or app.

Developers generally consider MFA to be the safest form of authentication, but there are a wide variety of MFA solutions available, and [they are not all created equally](https://auth0.com/blog/is-multifactor-authentication-the-best-way-to-secure-your-accounts-myths-and-reality/).

Finally, while most of us are familiar with MFA from our own online shopping experiences, it isn’t just for end users. The NIST emphasizes that requiring MFA for e-commerce admins is crucial for preventing data breaches rising from admin phishing attacks.

## Why E-Commerce Needs MFA

The continually-evolving digital threat landscape makes e-commerce businesses particularly vulnerable. As the NIST’s guide explains, 2015 saw the introduction of security improvements to credit cards and in-store terminals. These improvements reduced traditional credit card fraud but had the unintended effect of pushing more theft online.

E-commerce businesses are vulnerable to several types of attack, including [brute force attacks](https://www.scmagazineuk.com/brute-force-dictionary-attacks-400-percent-2017/article/1473168), [phishing](https://www.vadesecure.com/en/ecommerce-security-issues/), and [credential stuffing](https://auth0.com/blog/credential-stuffing-is-a-persistent-threat-to-your-users/), which the NIST gives particular focus to in its guidelines.

In credential stuffing, user IDs and passwords stolen from one site are used to log in to another, preying on the tendency of users to recycle the same few passwords. Credential stuffing is arguably the [most dangerous and prevalent](https://blog.barracuda.com/2019/04/02/is-2019-the-year-credential-stuffing-dominates-the-threat-landscape/) security threat of 2019. An [Akamai report](https://www.akamai.com/us/en/multimedia/documents/state-of-the-internet/state-of-the-internet-security-retail-attacks-and-api-traffic-report-2019.pdf) found that retail was the single most vulnerable vertical for this attack, with over 10 billion credential abuse attempts in 2018.

<include src="TweetQuote" quoteText="Developers generally consider MFA to be the safest form of authentication"/>

Credential stuffing is difficult to combat, and will likely worsen as hackers develop more sophisticated bots that can combine data from multiple breaches in their attacks. Successful credential stuffing can lead to account takeover. For customers, account takeovers can result in fraudulent purchases being shipped to strangers.

For admins, they can lead to even [more serious data breaches](https://www.zdnet.com/article/anatomy-of-the-target-data-breach-missed-opportunities-and-lessons-learned/).

So how do you know if your current authentication system is at risk for these types of breaches? NIST lists the following common traits of vulnerable systems:

* Allow multiple incorrect logins without account lockouts
* Purchasers have reused the same password on multiple systems
* Accept weak passwords

If any of those describe your company’s authentication system, implementing MFA can quickly patch those leaks to project you and your customers while you strengthen your identity solution.

## What Makes a Good E-Commerce MFA Solution

MFA is open-source technology, but there’s a great deal of variance between implementation methods. NIST specifies a few “must-haves” for MFA solutions to protect your business effectively.

* **Customization**: Not every transaction should require additional authentication, so a good MFA solution allows you to tailor your system to your needs. NIST lists the most common parameters to trigger verification as cost threshold (a purchase above a certain dollar amount) and risk threshold. You can customize your definition of risk any number of ways, such as a customer using a new shipping address, paying with a new card, buying an item commonly associated with fraud, or making a purchase at an unusual time of day.
* **Require MFA for admin tasks**: A criminal with fraudulent admin credentials can do incalculable damage to your business, so NIST recommends that any administration activity requires verification.
* **Dashboards for suspicious activity**: The NIST report specifically mentions that e-commerce businesses should “enable system-activity situational awareness by providing dashboards that display account lockout and authentication activity.” Auth0’s dashboard does just this: giving you a high-level look at your users, allowing your admins to spot patterns and being aware of new threats as they evolve.

![Auth0 Dashboard](https://images.ctfassets.net/23aumh6u8s0i/7sbXQ9SWpmPS7HuKh9pGhE/427d1c43629461957d5c506e8e9e535d/auth0-dashboard)

Auth0 also offers [breached password protection](https://auth0.com/docs/anomaly-detection), which tracks security breaches at third-party sites and flags potentially stolen credentials. Taken together, these features are a proactive way for e-commerce teams to detect and prevent fraudulent transactions.

## How an IDaaS Partner Manages Your MFA Needs

Many e-commerce executives have been slow to push for MFA because they feared alienating customers with irritating demands for credentials. However, online shoppers are increasingly reassured rather than irritated by such measures.

In [Experian’s 2018 Global Fraud and Identity Report](https://www.experian.com/assets/decision-analytics/reports/global-fraud-report-2018.pdf), 66% of surveyed customers reported that they “like all the security protocols when I interact online because it makes me feel protected." Yet customer tolerance isn’t infinite, and in the same survey, a third of customers reported that security demands caused them to make fewer online purchases.

E-commerce businesses have to find an MFA solution that provides both effective fraud prevention and positive user experiences. By partnering with an identity management platform like Auth0, you can reap the benefits of increased security without taxing your developers or frustrating your customers.

* **Balance of ease and customizability**: Auth0’s MFA solutions can be turned on by flipping a single toggle, so you don’t have to wait weeks or months for your developers to secure your system. However, Auth0 also gives your team the freedom to write customized rules for MFA around any of the parameters discussed above.
* **Reduced friction for users**: Auth0’s MFA lets developers choose which factors for authentication suit their needs, whether that’s SMS, a token generator app, or Guardian, which lets users authenticate via a push notification.This allows users to utilize the MFA method they want while maintaining proper security practices.

![Multi-Factor Authentication Auth0](https://images.ctfassets.net/23aumh6u8s0i/4VTHSpJTsDhLuAyznJK2BE/27185cb5d398e5f1dc609141c781d57b/mfa-auth0)

Guardian doesn’t require your customers to install an app or even have a smartphone, so it’s a truly universal solution that meets both security and UX needs.

* **Evolves with and for you**: Keeping on top of current security standards can be a full-time job. But it’s not your full-time job, so outsourcing MFA to a highly respected and [accredited IDaaS partner](https://auth0.com/blog/the-real-roi-of-auth0-part-3-security/) like Auth0 can provide peace of mind to your customers and yourself.

## NIST Guidance Can Offer Immediate Protection

Though NIST’s guidelines are voluntary suggestions, their very existence points to the urgent need for MFA adoption to protect online shopping as a whole. As the guide says: “fraud impacts the e-commerce ecosystem by decreasing purchaser confidence...and by increasing costs to offset the e-commerce fraud.”

Business leaders are under pressure to protect their customers from identity-based attacks without sacrificing revenue through excessive security measures. Finding this balance requires expert help, so reach out to an [Auth0 resource](mailto: sales@auth0.com) to talk about how you can put NIST advice into practice.

<include src="asides/AboutAuth0" />

---


Why NIST Recommends MFA to Fight E-Commerce Fraud

8f9f6a577da77a9add9cadbb90e66b75

Matthew Machuga

Give your users a choice to link their accounts when accidentally using another provider with the same email address.

# An Easy Way for Users to Link Accounts

A few months ago, Diego Poza wrote an article on [The 3 Best Ways To Create the Single Vision of A Customer](https://auth0.com/blog/the-three-best-ways-to-create-the-single-vision-of-a-customer/).
In it he said the number one must-have is Centralized Identity Management. He 
described that in Auth0, if a user signed in with their Facebook login, then 
their Google account next, they would have two accounts. Auth0 already
provides rules for allowing these accounts to be linked back together 
automatically, but we're happy to announce a new option that gives the
user a choice as to whether they'd like to link the accounts or not.

This happens as part of our [Account Link extension](https://auth0.com/docs/extensions/account-link). It's extremely simple to
set up and can save your users a lot of hassle.

Let's walk through how this gets presented to your users to demonstrate how the
functionality is helpful. Let's say one of your users has the email address
`spencer@example.com`. They've used this email address to sign up for Facebook,
Twitter, Google Apps, and your site. If your site offers all of these social
sign in options and database users, it can be understandably hard for a user
to remember what account they used to sign up for your site. Like in our
example above, we'll assume that `spencer@example.com` signed up with their
Facebook account originally, but now that they're back on the site they can't
remember. They incorrectly guess they used Google to sign in.

With the extension enabled, instead of being taken to your site with a new
account, they are sent to a prompt from the extension, notifying them that they
appear to already have an account registered with that email address on your
site. The most prominent option is to continue linking the accounts. When
**Continue** is clicked, the user will be redirected to log in with the account
that's already detected on your site. Assuming their authentication is
successful, they'll be redirected to your site successfully as their original
account, with the new account merged in as an identity of the original. This
then, conveniently, lets them sign in with either option to the same account.

![Image of extension page](https://images.ctfassets.net/23aumh6u8s0i/6Nd5KcxDJODJ2YK6BIyTtz/1139afaea432a35a18428b1512865a50/hosted-page-example)


But let's assume the opposite for a moment: that your user has intentionally
tried to create a second account with a different provider. Not a problem! They
can simply click the small, diminished link saying, "I want to skip this and
create a new account." and they'll continue to your site logged in as a
new user under their new provider.

Providing the ability to link accounts through the Account Link extension
makes it so your user retains a choice as to whether they'd like their accounts
linked, but will encourage them to link by default since it tends to be the 
most common intent.

You can install it from the [Extensions Gallery](https://manage.auth0.com/#extensions)
and give your users a choice that will make their experience, and your management, easier.

# Aside: Securing Applications with Auth0

Are you building a [B2C](https://auth0.com/b2c-customer-identity-management), [B2B](https://auth0.com/b2b-enterprise-identity-management), or [B2E](https://auth0.com/b2e-identity-management-for-employees) tool? Auth0, can help you focus on what matters the most to you, the special features of your product. [Auth0](https://auth0.com/) can improve your product's security with state-of-the-art features like [passwordless](https://auth0.com/passwordless), [breached password surveillance](https://auth0.com/breached-passwords), and [multifactor authentication](https://auth0.com/multifactor-authentication).

[We offer a generous **free tier**](https://auth0.com/pricing) so you can get started with modern authentication.

An Easy Way for Users to Link Accounts

diegopoza

System Engineer, geek, foodie, technology lover, speaker.

Sr Manager, Developer Advocacy

Diego Poza

Multifactor authentication is important, but the question of implementation is more complex than it seems.



<div class="alert alert-info alert-icon">
  <i class="icon-budicon-500"></i>
  <strong>Forrester Consulting analysis determines that using Auth0 can yield a 548% ROI and $3.7M in identity-related savings. Read the full report: <a href="https://resources.auth0.com/forrester-tei-research-case-study/">Total Economic Impact of Auth0</a>.</strong>
</div>

---

## Intro

In recent years, [multifactor authentication](https://auth0.com/multifactor-authentication) has become quite the buzzword in information security. Products from Twitter to Instagram have implemented their own two-step login processes, responding to widespread user demand for better security and the ever-present reality of hackers cracking accounts and selling them across the internet.

All this popularity has also led to the creation and perpetuation of various myths about [multifactor authentication](https://auth0.com/multifactor-authentication) — what it is, what it's for — that can mislead developers and users alike.  

Going with multifactor authentication is almost always going to be an improvement over not. But it's table stakes now. Sophisticated attackers aren't deterred by poorly configured multifactor authentication systems. To keep internal and user information secure, you need to know what you're doing.

> Give your customers enterprise identity integration, frictionless SSO across your products and adaptive authentication with MFA and Anomaly Detection. [All of this with a flip of a switch](https://auth0.com/b2b-enterprise-identity-management).

## Myth #1: There are only a few different forms of MFA

An authentication [factor](https://auth0.com/identity-glossary) is a vector through which identity can be confirmed or denied, from fingerprint scanners to passwords, from USB sticks to PIN codes. The commonly used term “multifactor authentication” simply refers to an authentication scheme that uses **more than one** of these methods.

It was once true that most MFA systems operated basically the same way. Today, however, there's a great variety of factors you can request from your users, from push notification receipt to SMS to email to fingerprint.

### Reality: MFA is extremely customizable

![MFA alternatives](https://images.ctfassets.net/23aumh6u8s0i/1DLAvyone2D6hjqEsLRrmC/9c24dbdf6a6202d6568f9853d1afa568/mfa-alternatives)

There are three entire genres of factor—knowledge, possession, and inherence:

* **Knowledge:** Something only a particular user knows, such as a password or the answer to a secret question.
* **Possession:** Something only a particular user has, such as a USB stick or identifying badge.
* **Inherence:** Someone only a particular user is, such as determined through a fingerprint scanner or GPS recognition system.

Every multifactor authentication system out there is built upon some combination of these three basic factors. A simple password/secret question system would be made up of two separate knowledge factors, while one that asked you for an [RSA hardware token](https://www.rsa.com/en-us/products-services/identity-access-management/securid/hardware-tokens) in addition to your password would be made up of both knowledge and possession factors.

A [passwordless login system](https://auth0.com/passwordless) relies upon you being in possession of, and able to access, your email inbox. And so on. There are so many different forms of authentication out there now that you can freely choose whether you want something that maximizes ease of use, something that maximizes security through obscurity, or something in between.

## Myth #2: Your use case for MFA doesn't matter

[RSA](https://en.wikipedia.org/wiki/RSA_Security) and [TOTP](https://en.wikipedia.org/wiki/Time-based_One-time_Password_Algorithm) are two of the most popular methods for generating secure codes that we have today, but they are not interchangeable — both have their pros and cons.

The main technical difference between them is that RSA operates asymmetrically, with a public and a private key, and TOTP operates symmetrically, with a single private key shared between both parties. But this isn't just a minor detail about how the two systems work. This single difference affects the appropriate context for each one and the trade-offs you will be making.

### Reality: You have to choose your method based on your needs

The security of the public/private key pair of RSA “relies on the computational difficulty of factoring large integers”:

1. Two extremely large prime numbers are generated using the [Rabin-Miller primality test algorithm](http://searchsecurity.techtarget.com/definition/RSA).
2. The public key is generated from the modulus of those two prime numbers and a public exponent.
3. The private key is generated from the modulus of those two prime numbers and an exponent calculated with the Extended Euclidean algorithm.

This also means that computational power is required to encrypt and decrypt RSA when it's used properly. That makes RSA slower, but the benefit is that only one side of the transaction needs to actually [possess the private key](http://crypto.stackexchange.com/questions/11293/hmac-sha256-vs-rsa-sha256-which-one-to-use).

TOTP, on the other hand, operates symmetrically. A secret key is known to both the signer and the signee at the same time. A hash function is used to blend the secret key with the time at the moment of authentication (requiring fairly precise clock synchronization) and a one-time password is generated that is valid only for a short amount of time.

![TOTP screenshots](https://images.ctfassets.net/23aumh6u8s0i/59ont0UsxtdYX86pmfRUOw/489f1c775b9b6d8e9d1632fd3917c190/totp-screenshot)

This takes significantly less time and processing power than RSA, but it does mean certain vulnerabilities become hypothetically possible. If a key was somehow compromised on the server-side, for instance, an employee of an organization could potentially impersonate a user to malicious ends. With RSA, the same employee would have to [change the codebase](http://crypto.stackexchange.com/questions/11293/hmac-sha256-vs-rsa-sha256-which-one-to-use) to do such a thing—likely leaving a paper trail.  

If you absolutely need your users to be able to download and store their private keys on their own systems—maybe you're working with [financial data](http://resources.docs.salesforce.com/204/14/en-us/sfdc/pdf/salesforce_security_impl_guide.pdf) like credit cards, health records, or other forms of sensitive information—you may want to go with an asymmetric method like RSA.

## Myth #3: All MFA solutions work basically the same way

Mass adoption of multifactor authentication is still a significant work in progress, and it's fair to say that most sites should simply focus on implementing it in some form or another—not which method is the absolute perfect one.

That does not, however, mean that every single form of multifactor authentication is equally secure. Each occupies a different position on the axes of security and ease of use, which means that each one will be optimal under a different set of circumstances.

### Reality:  you have to choose what you value most

SMS is one of the older and more common forms of multifactor authentication that you see out there. You log in to a website, and then to double-check your identity, a code is sent to a phone number that you have on file. You receive a text on your mobile phone that contains a code, and then you enter that code into the website to verify yourself. Simple.

But the U.S National Institute of Standards and Technology has recently come out with a report saying they believe that SMS multifactor is vulnerable to hijacking, [particularly when used](http://thehackernews.com/2016/07/two-factor-authentication.html) by subscribers to a VoIP phone service like Google Voice. SMS is also vulnerable to social engineering—in some instances, attackers have been able to simply call up a victim's phone company and, impersonating their target, ask that all text messages to that account be forwarded to a different one.  

These vulnerabilities, plus the fact that other forms of authentication have become more user-friendly, mean that many sites and apps enabled with multifactor authentication are moving on to different methods.

![Different multifactor alternatives](https://images.ctfassets.net/23aumh6u8s0i/1AV7Hb9MZLBz8ACf4w3W1h/bdc724d1db6ef8d086748059b8cd03ed/apps-of-mfa)

There's the time-based one-time password algorithm, or TOTP, which is most notable used by apps like Google Authenticator. A single-use password is generated from the combination of a secret key and the current time, and you enter that into the app asking for authentication rather than a code that could have been intercepted in transmission.  

TOTP, because it often involves users manually copying a six-digit code from their phone to their computer, is often considered to be a burden on users. With [Auth0 Rules](https://auth0.com/docs/rules), though, you can get the benefit of MFA without that annoyance by setting up special conditions under which authentication will be requested.

Say someone tries to call your bank's customer support to reset your password — as they did to [Brian Krebs](https://auth0.com/blog/how-paypal-could-have-avoided-account-hack/) — that event could be flagged as requiring a temporary extra authentication. You could trigger the same kind of request in the event of a new email account being added, an address being changed, and the like. This will keep your users' personal information and account more secure without disrupting their usage of your product, as they likely won't be performing these kinds of actions very often.

## Myth #4: MFA is always annoying for users

At many companies where multifactor authentication is tried but fails, one of the most common complaints is that it makes logging in too much of a hassle for users.

They have to first enter in their username and password, and *then* open up their email client or take out their phone, and *then* manually copy a code. Or they lose the hardware key that they were given during onboarding, or they misplace their mobile device and are no longer able to login to anything.

 These companies get so many annoyed emails from their employees, or start noticing users forgetting their passwords and consequently churning, that they finally turn MFA off.

### Reality: MFA can be as easy as tapping a push notification

MFA does not have to be troublesome for users. It doesn't have to require keeping track of a token, manually writing a code, or copying and pasting a code from a mobile device to your computer.

With [Auth0 Guardian](https://auth0.com/guardian/), you can make logging in through multifactor authentication a simple matter of swiping and tapping a push notification from your [phone's lock screen](https://auth0.com/blog/announcing-Auth0-Guardian-a-new-way-to-login/).

![Auth0's Guardian App](https://images.ctfassets.net/23aumh6u8s0i/4AioGEVTLJvh8eWtJ24e9N/99cd88daab3f584eb21e5689264aa87a/auth0-guardian-mfa)

It's available for both iOS and Android, and can be enabled with a [simple toggle](https://auth0.com/guardian). Check out the full docs [here](https://auth0.com/docs/multifactor-authentication/guardian).

## Myths Busted

There's no doubt that [implementing multifactor authentication is one of the best ways to improve the security of a website or an app](https://auth0.com/multifactor-authentication) that doesn't have it. But as with any decision regarding the privacy and security of your users and their information, nothing is as simple as it appears at first glance.

At [Auth0](https://auth0.com/), we want to make sure that MFA is something you can implement knowing that it will protect your accounts without harming the user experience. With [Guardian](https://auth0.com/guardian/), we're pushing that project forward, and we're really excited to have you try it out. Check it out!

> [Auth0 offers a generous **free tier**](https://auth0.com/pricing) to get started with modern authentication.


Is Multifactor Authentication The Best Way To Secure Your Accounts? Myths And Reality

667b1c82b6cc2241ff176d50c65da603?s=200 avatar

667b1c82b6cc2241ff176d50c65da603?s=200

Guest Author

Eugene Kogan

How to prevent criminals to mess with your accounts



Yes, definitely. It’s happened to a number of people I work with.

Imagine you’re walking down the street, checking Slack or Facebook, and someone on a bike rides by and grabs your phone. Guess what, your phone is unlocked and ready for the thief to start using it. The same thing can happen in a bar, the subway, or any other crowded place. Even Scotland Yard has started [using](http://www.bbc.com/news/uk-38183819) this technique (but that’s another matter).

![Getting robbed while phone is unlocked](https://images.ctfassets.net/23aumh6u8s0i/4Kr00xYZ8Z4iCkFPziAi6y/7f5e7c11ed2ede9a715a1ba481859d37/getting-robbed)

The average iPhone thief doesn’t care about your data, he just wants to wipe the phone so he can resell it. This kind of crime is especially prevalent in countries like [Argentina](http://money.cnn.com/2016/09/14/technology/argentina-iphone-black-market/), where there’s a large black market for Apple products. You might be thinking that the thief still needs to disable Find My iPhone to release Apple’s [Activation Lock](https://support.apple.com/en-us/HT201365). That’s true, but if the phone itself is already unlocked, all he needs is your iCloud password.

Do you get your email on your phone? Is it the same email address that’s tied to your iCloud account? Well, guess where iCloud password reset emails used to go? Before a recent update to iOS, it was possible to reset someone’s iCloud password directly from their unlocked phone, simply by virtue having access to their email account. Even if you use Apple’s [two-factor authentication](https://support.apple.com/en-us/HT204915) (which you absolutely should), that works over SMS or push notifications, which also go to your phone.

Previous, there was nothing blocking a thief from stealing your phone while it was in use (and unlocked), resetting your iCloud password via your email account, disabling Find My iPhone, and finally wiping it to be resold. Thankfully, Apple appears to have quietly fixed this loophole by making it more difficult to reset an iCloud password. If you attempt it from your phone (even via Safari), it will ask you for your unlock PIN.

I used to recommend taking an additional precaution to mitigate this risk, but it’s not really necessary anymore (although it can’t hurt). If you follow these steps, the iCloud account settings will be completely unavailable until you disable “Restrictions” with an extra PIN that you’ll set below. Go to *Settings > General > Restrictions > Enable Restrictions > [create a PIN, enter it twice] > Accounts > Don’t Allow Changes*

Now that Apple has added the necessary security checks to the iCloud password reset process, my recommendations are simpler: enable two-factor authentication for iCloud, and choose a hard to guess, 6-digit (or longer) PIN on your iPhone. With Touch ID, you rarely have to type it anyway.

![Apple's two factor authentication](https://images.ctfassets.net/23aumh6u8s0i/1JZgMtXTm0TfSnGCab8MWK/c2a81630672de5ada598f83c417b2d2b/apple-2-factor-auth)

**Kudos to Apple for making this improvement. I believe it will help keep people safer by discouraging iPhone muggings.**

Now, if you’re a bit more paranoid and want to really limit what someone can access if they snatch your phone while you’re in the middle of using it, there is one more thing you can do.

An [engineer](https://twitter.com/radekk) on my team at Auth0 told me about [Guided Access](https://support.apple.com/en-us/HT202612), an iOS feature that lets you temporarily restrict the phone to a single app, and can even limit the actions available to the user within an app. With Guided Access configured (*Settings > General > Accessibility > Guided Access*), you can press the home button three times to enable it at any time, within any app. Once it’s on, you’ll need the Guided Access PIN or Touch ID to exit the app. It’s that easy.

Imagine you’re reading the news on your iPhone on the subway. You can quickly enable Guided Access, and lock it down to that one app only. Then even if someone grabs your unlocked phone, they’ll be stuck in the news app forever! (No one wants to read the news for too long nowadays.) Sure, the thief can always power it off, but then the phone will be really locked and essentially useless to them, even for reselling.

Guided Access is intended for situations like when parents let their kids play with their iPhones (or iPads), but it’s actually quite powerful. You could even use it if you think Scotland Yard might be after you…

Could your iPhone get stolen while it's unlocked?

eHk3ciM

I am the Group Manager, Developer Content at Okta, and a Google Developer Expert in Web Technologies and Angular. I'm passionate about identity, authentication, constant learning, and developer communities. As a developer advocate, engineer, mentor, and international speaker, I love learning from and sharing with other inhabitants of the tech space.

Group Manager, Developer Content

Kim Maida

Yahoo has confirmed that in late 2014, at least 500 million user accounts were stolen in a large-scale data breach, exposing names, emails, and more.



---

## Half a billion Yahoo accounts were leaked in large-scale data breach

Yahoo has confirmed that 500 million user accounts were exposed in a massive data breach that occurred in late 2014. Breached data potentially included users' names, emails, phone numbers, birthdates, hashed passwords, and in some cases, encrypted or unencrypted security questions and answers. Yahoo claims that financial information such as bank accounts or credit card credentials were not included in the breached data.

The official notification from Yahoo's Chief Information Security Officer Bob Lord can be read here: [An Important Message About Yahoo User Security](https://yahoo.tumblr.com/post/150781911849/an-important-message-about-yahoo-user-security).

Yahoo announced that the company believes the hacker to be a state-sponsored actor: a hacker acting on behalf of a non-US government. A spokesperson for the FBI said they are aware of the intrusion and investigation is underway.

[Verizon is currently in the process of acquiring Yahoo for $4.8 billion](http://www.usatoday.com/story/tech/news/2016/07/25/verizon-winner-yahoo-sale/87500668/). Verizon was made aware of the data breach within the last couple of days, but a spokesperson for the communications company claims Verizon has "limited information and understanding of the impact [of the security incident]."

To comprehend the scope of this attack, let's compare it to another within the last decade. In 2007, the [TJX data breach](http://www.nbcnews.com/id/21454847/ns/technology_and_science-security/t/tjx-breach-could-top-million-accounts/#.V-RR99yClTY) exposed 94 million credit and debit card accounts. At the time, it headlined as the biggest cybersecurity attack ever. At an estimated minimum of 500 million, the Yahoo incident leaked over five times as many accounts, making it the new largest data breach in history.

Yahoo asserts that they are notifying potentially affected users. The company is also recommending that users update their passwords and security questions if they have not done so since 2014. 

Although financial data may not have been leaked in the Yahoo data breach, Yahoo also provides login for [Flickr](https://www.flickr.com/) as well as [Oauth](https://developer.yahoo.com/oauth/) for third party websites. In addition, users frequently reuse the same email addresses and passwords for multiple accounts. When user credentials are leaked, it can compromise many more accounts than the one specifically exposed.  

## Aside: Protect your users from password leaks with Auth0

Auth0 provides breached password detection that can be enabled simply and easily. The Auth0 security team maintains a database of third party breached credentials. This database is updated daily. On each login, user credentials are checked against the leaked passwords database. If a breach is suspected, the user is notified and cannot log in until they change the compromised password.

<video autoplay loop width="600">
  <source src="https://cdn.auth0.com/blog/breach/lock-2.m4v"/>
<img src="https://images.ctfassets.net/23aumh6u8s0i/3DpdlDPwLfrdGGb7RUQ6NU/d959326b776a71764727d5e3eae43c8a/lock"/>
</video>

Read about [Breached Passwords](https://auth0.com/breached-passwords) and [Anomaly Detection](https://auth0.com/docs/anomaly-detection) to learn more about how to protect users and their credentials with Auth0. You can also <a href="https://auth0.com/signup" data-amp-replace="CLIENT_ID" data-amp-addparams="anonId=CLIENT_ID(cid-scope-cookie-fallback-name)">sign up for a free Auth0 account</a>!



Yahoo Confirms Data Breach of Half a Billion User Accounts

In this post you'll learn 5 techniques that can prevent your users' accounts from being hacked and would have made Brian happier



Yesterday, _Brian Krebs_ from [Krebs on Security](http://krebsonsecurity.com/2015/12/2016-reality-lazy-authentication-still-the-norm/) reported that his PayPal account had been hacked using one of the oldest hacking methods: **social engineering**, and knowing some pieces of static information about the account owner —the last four digits of an old credit card and the last four digits of the social security number—.

Being a known security expert, Brian had a strong account password; that is, it was long and complex, and used all types of characters. A strong password is mandatory, especially for a service that is directly linked to the user's credit cards. In Brian's case, he soon discovered that it was not his password that was compromised. Instead, the cyber criminal called PayPal customer support, impersonated him, and got access to his account in a matter of minutes, having provided only that static and easy-to-obtain information about the user, not once but twice.

## 5 Things that Could Have Prevented the Hack

In this post, we'll teach you five things you can implement to prevent your users from being hacked. Make Brian safe again!

### 1 - Multifactor Authentication

**Multifactor Authentication (MFA)** is a method of identifying users by presenting several separate authentication stages. Some of those stages could be a Time-based One-Time Password (TOTP), mobile verification, or a hardware token, among others.

> Learn more about MFA, in the [Get Started with MFA landing page](https://auth0.com/learn/get-started-with-mfa).

Believe it or not, most of the biggest retail stores don't provide these additional layers of security or are just starting to provide them. For example, [**Amazon**](http://www.amazon.com) added this option in mid-November without making an official announcement, as reported by [The Verge](http://www.theverge.com/2015/11/18/9753888/amazon-two-factor-authentication-2fa).

With MFA, a cyber criminal must not only know the password, but also possess a mobile phone or token device in order to access the account. Some companies believe that enforcing multifactor authentication could result in the loss of a significant number of users; for those companies, an intermediate solution can be achieved by requiring a second factor only for resetting the password.

PayPal has this option available by using hardware tokens, but evidently this is not required in their password reset flow.

<div class="" style="text-align: center;"><img style="margin: 0; max-width: 200px;" src="https://images.ctfassets.net/23aumh6u8s0i/2LB9dXQu6yRDwVt2oQFwqR/3dba5964313886fdef5f86bcb282c98d/why-is-mfa-necessary" alt="Multifactor Authentication" />
</div>

### 2 - Passwordless Login via sms and email
With Passwordless Login you can use one-time codes or “magic links” delivered via SMS or email. In this way, only users who have access to the registered email account or registered phone will be able to login. If PayPal support had offered this option, they could have ensured that the person claiming access was the legitimate owner by sending an email or SMS with a code or link.
​​
> You can read more about Passwordless [here](https://auth0.com/blog/2015/09/30/auth0-passwordless-email-authentication-and-sms-login-without-passwords/).

![Passwordless Login](https://images.ctfassets.net/23aumh6u8s0i/3QYNw3edBKso3qNe2A6djc/d8449a97f4bb29e325c3459fa495fa99/pwdless-locks)

### 3 - Step Up Security
With **Step Up Security**, critical actions in user accounts—adding or changing email accounts, changing passwords, and so on—require additional security measures. Brian Krebs' attacker called customer support to reset his password. This critical action needed stronger security measures—such as multifactor or passwordless authentication—as the company should have ensured that it was being performed by the legitimate user.

![Step Up Security](https://images.ctfassets.net/23aumh6u8s0i/7MieEkMD4W8csXw1s959XX/136172cf228821b1575b772c930c620e/step-up-security)

### 4 - Trained Support
Companies **must invest** in training their customer support employees in security procedures. This point is often inadequately considered, which leads to situations like granting access to anyone with the sufficient static information. And this in turn will make the company lose its reputation.

<include src="TweetQuote" quoteText="Companies must invest in training their customer support employees in security procedures."/>

However, we have learned from past attacks that social engineering [virtually always will succeed eventually](http://www.wired.com/2014/01/my-epic-hack-revisited/). While training of support staff is needed, it must be part of a larger security strategy. Using a method above to build a system that requires customer verification is an important step in preventing social engineering.

![Trained Support](https://images.ctfassets.net/23aumh6u8s0i/3euV9iQyU0NVBE6W0X8efW/7cf38b6a199db837a7f2280cefffe4fd/trained-support)

### 5 - Single Sign On with Another Service
Using Single Sign-On, once you log into one trusted service or provider, you don't have to enter your credentials again when entering another application that supports it, as you will be automatically logged into all supported applications, regardless of the platform, technology, or domain.

If PayPal had allowed Single Sign-On with another trusted service, it would have added an additional security layer to prevent the hack. A legitimate user who lost his password but could log into a trusted service could easily reset his password without needing to go through customer support.

> Learn more about [Single Sign-On](https://auth0.com/learn/how-to-implement-single-sign-on).

<div class="" style="text-align: center;"><img style="margin: 0; max-width: 200px;" src="https://images.ctfassets.net/23aumh6u8s0i/74MkL0x1mxFBflGp20ecX/222af83745d01410e75bca971c39a390/bg-login" alt="Single Sign On" />
</div>

## Aside: How Auth0 Can Help You Strengthen the Security of Your Application's Accounts
Using Auth0 you can add the following features to your application in a breeze.

- **Multifactor Authentication**: Using Auth0 you can have MFA implemented in minutes! You can use the out-of-the-box providers or easily integrate any different provider using Auth0's extensibility.

- **Passwordless**: [Auth0 Passwordless](https://auth0.com/passwordless) supports one-time codes or “magic links” delivered via SMS or email without having to worry about the implementation details.

- **Single Sign-On**: By taking advantage of our wide range of SDKs you will have Single Sign-On with any Identity Provider running in minutes. Provide your users with a seamless authentication experience when they navigate either through the applications you built and/or third party apps.

## Final Words
What it is interesting is that **PayPal**, populated by a lot of smart people and with more actual experience in online payment systems than almost anyone, relies on inherently insecure procedures. They certainly know everything Krebs talks about in his post, they have the resources to do something different, and yet they don’t. Why Paypal doesn’t have tighter procedures? The answer to that question is probably because their cost of fraud is lower than the cost of implementation. You can be 100% sure they’ve modeled it out and believe that tighter security drives away customers or some other cost factor that outweighs the cost of fraud. As we always say, if companies don't handle security properly, that could lead to losing their most precious asset: its reputation.


How PayPal could have easily avoided the last account hack

eugenio-pace-new-avatar

Pace co-founded Auth0 in early 2013 with CTO and “brother-in-arms” Matias Woloski while living 7,000 miles apart from each other. Since then, Pace has played an instrumental role in growing Auth0 into a leading identity management company that is loved by developers and trusted by global enterprises. He loves traveling and has visited more than 35 countries for business and pleasure. He currently lives in Redmond, Washington with his wife, two sons, and their labrador retriever. In his spare time, he enjoys the outdoors, rowing, riding bikes, spending time with his family, restoring his 1970 Karmann Ghia, writing his blog, and reading history and philosophy.

CEO and Co-Founder

Eugenio Pace

Today Amazon announced a new Login Service, which allows you to connect with millions of their customers

Today Amazon announced [a new Login Service](http://login.amazon.com), which allows you to connect with millions of their customers:

From their [press release](http://phx.corporate-ir.net/phoenix.zhtml?c=176060&p=irol-newsArticle&ID=1824961&highlight=):
> Today, Amazon launched __Login with Amazon__, a new service that will enable the over 200 million active Amazon customers to securely and simply login to apps, games, and websites. Login with Amazon allows developers to easily reduce sign-in friction for their customers, leading to higher engagement and order conversion.

The good news for those using Auth0, is that connecting with Amazon is just a click away. We launched support for Amazon today:

![SSO Amazon](https://images.ctfassets.net/23aumh6u8s0i/1i9UzNljbW660b6J3V2UgQ/5140b7e0b57be3a15622447bf6c7edbf/auth0-amazon-connection)



Auth0 gives you the ability to connect Amazon accounts with _any_ application: web, mobile or native; regardless of what platform it is written on, or what identity protocols it supports. Auth0 supports .NET, Java, Ruby, iOS, Android, Windows, and others with very few lines of code, and minimum intrusion.

And this extends of course to popular apps like __Salesforce__, __Zendesk__, __Dropbox__, __SharePoint__, __MSCRM__, among others. We keep adding popular apps and the list grows quickly!

There are two permission scopes available today in Amazon:

* __Basic Profile__, the default permission that allows you to retrieve the user's name, e-mail and a unique id.
* __Postal Code__, that allows you to retrieve the location of the user.

These two are very easily configured with Auth0 dashboard:

![SSO Amazon](https://images.ctfassets.net/23aumh6u8s0i/5ziOzwL0ROXtyy7UbFQl2y/6310397cd8dbf0a6b7df3f046c6c911d/auth0-amazon-dashboard)

Registration of your instance of Auth0 with Amazon is very straightforward and [fully documented](https://docs.auth0.com/amazon-clientid) right were you need it.

[Try Auth0 yourself!](https://auth0.com)

"accounts"