News for hackers. Stuff that matters.

A comment on Security 101 for SaaS startups.

Re:Security 101 for SaaS startups by Puts on Sunday March 05, 2017 @05:10PM (#13799082)
> Remember that SSL encrypts network traffic, but does not supply authentication. SSL is also not a replacement for 2FA.

False and false.

[ Parent | on HN ]
Re:Security 101 for SaaS startups by jankedeen on Sunday March 05, 2017 @05:55PM (#13799370)
Are you referring to something like SRP+DSS|RSA? Not widely supported but I've used it via gnutls as a custom auth proxy layer for various things. 1password uses something like this iirc.

A really simple TFA pattern with SSL enabling is requiring a signed client cert with additional directory services auth (or even basic auth).

[ Parent | on HN ]