Re:Passwords Evolved: Authentication Guidance for the Modern...
by raesene6 on Wednesday July 26, 2017 @10:53AM
(#14856652)
You can implement a basic level of this just by storing some information about users and then comparing it on login. Some relatively simple examples
- Inform users of unsuccessful login attempts since their last sign-in. This can let them know if someone is trying to attack their account.
- Notify the user if they login from a new browser. You can record information about the client (user agent plus other identifiers that are visible server-side) and then notify the user when connections are made from new systems that haven't been seen before.
- For GeoIP there are basic datasets that cover things like country of origin that are generally available for free. You could use one of those to note the customers general country of origin and then notify when that changes.
None of these are flawless of course, but they could provide some basic means to help users protect their accounts.
Re:Passwords Evolved: Authentication Guidance for the Modern...
by NMDaniel on Wednesday July 26, 2017 @02:41PM
(#14858942)
I think this is actually a case for delegated authentication, you can quite simply let Facebook(or Google,MS or some other trusted auth provider) handle these things
instead of implementing them yourself. Use some form of social login(OAuth2/OpenID Connect)
People take for granted that an organisation can just hook into a bunch of paid external services, GeoIP, Browser/Device Database, etc. First off, there's a great many organisations who cannot or will not be able to use an external GeoIP database for example, and even if they could how is a threshold of "abnormal" determined?
I too love Facebook's implementation. How do I make that without hooking into half a dozen paid external providers? I'm legitimately asking, because this seems like a "research team and five years" type of issue.
[0] https://xkcd.com/1425/