start	end	text
14200	17740	Good morning, and welcome to the AppSec Village.
17740	20860	I hope you were here for our first keynote speaker.
20860	25380	Welcome to day one of AppSec Village, part of DEF CON 2020.
25540	29960	I really wish we were all together in one big room like we were last year,
29960	32300	but that's just not going to happen this year.
32300	35680	So, in the meantime, thanks for tuning in.
35680	38560	Thanks for watching along with us.
39420	43620	I want to take the moment to introduce you to our next speaker.
43640	49700	Our next presentation is going to be 2FA in 2020 and beyond by Kelly Robinson.
49700	52460	Kelly works on the account security team at Twilio.
52460	57480	Previously, she worked in a variety of API platforms and data engineering roles at startups.
57480	62300	Her research focuses on authentication user experience and design tradeoffs
62300	65160	for different risk profiles and 2FA channels.
65160	67480	We all know how important 2FA is today.
67480	69680	We all want to protect our accounts.
69760	72160	And I'm looking forward to this talk. I hope you are too.
72160	77100	So, please give a warm AppSec Village welcome to Kelly Robinson.
78360	85920	Hey, everyone. I am coming to you today from Bravel,
85920	90360	wherever you may be on this March 152nd.
90740	95140	Hopefully, your day is going better than the person who has this password.
95380	98540	But even though I trust everyone tuning into a DEF CON talk
98540	104220	to have better password hygiene than something as simple as 1, 2, 3, 4, 5, 6,
104220	109180	the fact is there's still a lot of folks out there with short, guessable passwords
109180	112940	or people that are reusing passwords across multiple sites.
114380	116660	And as much as we'd like to believe that we're better than this,
116660	122120	the website haveibeenowned.com proves that simple passwords like 1, 2, 3, 4, 5, 6
122120	124200	are still incredibly common.
124200	128880	This password has been seen almost 24 million times across data breaches.
129200	133300	And attackers can use this to do credential-stuffing attacks across the web.
133300	137340	And it can basically allow them to hack into a lot of accounts
137340	141100	and compromise a lot of credentials and ultimately make a lot of money
141100	144260	off of unsuspecting individuals.
144340	146200	And that's what we're here to discuss today,
146200	150820	this reality where we are so owned that passwords are no longer enough,
150820	156280	how other factors, second factors, in fact, can help us stay more secure,
156280	159140	and how to evaluate the different options out there.
159920	162160	So my name is Kelly Robinson.
162160	165480	I have been working at Twilio for about three years.
165560	168920	And I specifically work on Twilio's account security team,
168920	172520	working with our products for things like Verify, Lookup,
172520	175860	anything that has to do with phone verification, two-factor authentication,
175860	178760	phone and email intelligence, things like that.
178760	180380	And this team has evolved a lot.
180380	184780	We acquired Authy about five years ago, and that was kind of the genesis of the team.
185700	187780	So Authy is our free consumer application
187780	191760	that was recently rendered to include the Twilio name about five years later.
191760	195960	But we also have APIs for adding things like two-factor authentication
195960	197140	into your applications.
197140	201060	And I spend a good chunk of my time educating developers about security,
201060	203620	especially when it comes to authentication itself.
203660	206820	And so this talk is going to incorporate a lot of the things that I've learned
206820	210560	in the last few years working with developers on a variety of challenges
210560	214640	and our customers on their authentication challenges as well.
216120	219360	And the failure of good authentication often results in
219360	222020	what we call account takeover, or ATO.
222020	224220	And this is why this is such a big problem, right?
224220	227480	Like, if there wasn't anything of value on the other side of an account,
227480	229740	we wouldn't be as concerned about this.
229740	232620	But this is a $7 billion problem,
232620	236360	so the industry is really incentivized to find a solution here.
236360	239560	And from the 2020 Javelin Strategy and Research Study
239560	241920	that just came out a few months ago,
241920	244500	one of the things that they noted is that account takeover fraud
244500	246600	is one of the hardest types of fraud to identify
247260	250960	because there's so many channels, multi-channel account access,
250960	254580	and the desire to reduce friction in the consumer experience.
254600	257340	And so we're trying to make it easy for people to log in,
257340	262420	but we also want to keep out the people that shouldn't have access to those accounts.
262420	265180	And those can sometimes be conflicting goals.
265180	268680	So how do we accomplish this, and how do we accomplish those goals?
269720	274500	So protecting our accounts, we have these three types of factors that we'll talk about.
274520	277300	You need to use a factor of authentication,
277300	281920	and using any two of these means that you're using two-factor authentication.
282080	284000	So there are three types of factors that we talk about.
284000	286540	Something that you know, this could be like a password.
286600	289820	Something that you have, this could be a key or a phone.
289820	292860	And then something that you are, so this is something biometrics,
292860	296620	like a fingerprint or a face ID or something like that.
296740	299040	And all of the factors that we're going to be talking about today
299040	302660	are channels that fall into this possession category.
303200	306740	And I just kind of wanted to go over what the different pros and cons of
307280	310620	a lot of these different common channels for two-factor authentication are,
310620	315740	so we can think about why we would or would not enable some of these types of channels.
315740	321040	And starting with second-factor authentication, using SMS 2FA codes.
321040	324840	And so one of the big reasons that people still like SMS-based 2FA
324840	327740	is that onboarding is so easy.
327740	332820	So about 99% of Americans have a phone capable of receiving text messages.
333200	336120	And that makes a big difference, right?
336120	340740	Like if you can't get people to turn on 2FA or opt into 2FA,
340740	345620	then you're not going to have any of the benefits of having the second factor offered to them.
345620	349680	And because of this easy onboarding, because it's a familiar experience now,
349680	353100	this is something that a lot of companies still like to offer,
353100	356900	because it's offering that additional security without that additional friction.
357160	362380	Unfortunately, as a lot of people know, SMS-based 2FA is not that secure.
362380	367700	So one of the main reasons that we say this is because of something called SIM swapping.
367700	371400	So this is where an attacker could use either social engineering or bribery
371400	374280	to get my SIM card sent to you.
374280	378660	And then you could basically take over control of my phone number.
378660	383680	And so it's not device control, so SIM swapping allows you to take control of a phone number.
384020	388460	And that can give you a lot of access to things that are being sent to me,
388460	390560	like two-factor authentication codes.
391960	396700	So SMS one-time passwords are really convenient, but they are an insecure channel.
397460	402080	The next thing that I wanted to talk about was TOTP, or time-based one-time passwords.
402080	405140	And this is a way to generate tokens based on an algorithm.
405140	408660	So the inputs here are a secret key and your system time.
408660	412580	And those get put through a one-way function that pops out the truncated token.
413120	416940	So this is what Google Authenticator, Authy, apps like that use.
416940	418800	It's an open standard.
419120	423340	And symmetric key cryptography offers increased security compared to SMS.
423480	427820	But if somebody gets access to that shared secret, then the method is easy to compromise.
427820	430540	And you might be saying, well, don't leak that secret.
430560	434900	But one of the ways that we'd share that secret is by scanning a QR code.
434900	437400	There's ways that that QR code can get leaked.
437400	447140	At a previous job, we used to keep a copy of a QR code for TOTP in the shared one-password file that we used for engineering onboarding.
447140	451560	Because we wanted to enable 2FA, but we needed multiple people to have access to it.
451560	455980	So that's one example of how a TOTP secret could get leaked.
456240	458760	It offers also some distinct advantages.
458760	461480	Like I mentioned, it's an open standard, which is pretty cool.
461480	464800	So you can use the app of your choice to do this.
464800	470240	And also, because the inputs are offline inputs, this method is also available offline.
470240	481660	So not that anybody's doing a ton of traveling right now, but this is really useful for people when they're on a plane or in a foreign country where they might not have good cell service or cell service of any kind.
481840	484580	But unfortunately, this does require an app download.
484860	491820	And so this is something that you want to keep in mind, because that's going to add additional friction to get people to sign up for this method.
491820	494880	And then I do want to mention the expiration user experience.
494880	506920	Because in a study on the usability of different factors, researchers found that two-thirds of participants using TOTP via Google Authenticator had problems entering the six-digit code before it timed out.
506920	510900	And so that could be a problem, depending on the types of users that might be using this.
510900	515580	That expiration logic helps keep it secure, but it also could make it harder to use.
516340	518220	Overall, this is a pretty good option.
518220	523620	We see a lot of security-conscious companies adding TOTP as a 2FA option.
523620	533300	And it's a really good next step of a way to add an open-source, open-standard option on top of SMSVite 2FA if you want to add additional security.
534780	538040	So I also wanted to talk about pre-generated codes.
538040	542240	And so these are something called, you know, like we might know these as backup codes.
542240	545360	You don't see these used a lot for ongoing login.
545860	551080	But I wanted to mention these because a study that I'm going to reference talks about using pre-generated codes.
551080	553160	And then the benefit is that these are really easy to use.
553160	557800	These are basically like passcodes or passwords that are generated for you.
557820	559940	So they're less likely to be reused.
560280	562800	They're more likely to be more secure.
563060	566160	They're not going to be 1, 2, 3, 4, 5, 6.
566160	572860	But, you know, because of that, 25% of participants in the study noted that these pre-generated codes didn't really feel secure, though.
572860	575080	Because they're just kind of written down on a piece of paper.
575080	585720	And the other problem with this is if you've ever been somebody that has been asked to store backup codes or implemented a system that has this kind of system, like, how do you store those?
585720	589220	A lot of companies don't give you real guidance on that.
589640	592540	And this is something that might not just, like, feel that secure.
592620	595700	So this is something that I think is an option for backups.
595700	599380	But the ongoing usability of it might not be super practical.
600760	602980	Finally, I want to talk about push authentication.
602980	606660	And this was really popularized by apps like Dual Authenticator.
606660	609540	And users love this because it's so low friction.
609540	613460	So you can approve or deny a login request directly from your smartwatch.
613500	617400	And it uses asymmetric key cryptography, which means that you have two keys.
617400	621100	The private key is only ever going to be stored on your device.
621100	629740	And so that really keeps you more secure and prevents you from leaking a shared secret like you might be able to with TOTP.
629740	634900	And this is the only form of 2FA that adds the option to explicitly deny a login.
635120	640700	But unfortunately, it's so low friction that you could easily approve an authorization request just to get rid of it.
640900	645580	And so if somebody is attempting to attack your accounts in the middle of the night,
645580	650500	you might be able to unintentionally approve a request just to make it go away.
650800	652800	And this also is a proprietary solution.
652800	655080	So it's going to require a special app.
655080	656740	So you could do this with something like Authy.
656740	658180	You could do this with something like Duo.
658180	661080	And you could also bake this into your own application.
661360	666940	But like with TOTP, getting users to download another app is always going to be a challenge.
667160	674680	I think the way that we'll see this become more common is with companies that have a lot of mobile users that already have their apps,
674680	678120	baking this into the existing apps that are already on their phone.
678120	680580	So you've seen this with something like Google Prompt.
680580	686160	If you enable Google Prompt and try to log in on the browser, what Google will do is say,
686160	690620	hey, check your phone, open up any Google app on your phone, and it will pop up this type of,
690620	695700	is this you trying to log in message without requiring that the user downloads an additional app.
695700	703780	And so that is one of the ways that you can kind of get around that user experience hurdle of having users opt into a more secure solution.
704380	707140	This seems great. It's really cryptographically secure.
707140	714360	But I think the onboarding logic is going to be something that we're going to struggle with for the next few years
714360	719120	until this becomes more common. And there's always this problem that it might be too convenient.
720120	722400	And then lastly, we'll talk about WebAuthn.
722400	724380	And this is the new hotness for good reason.
724380	729780	It offers a really high level of security with asymmetric key cryptography like push authentication.
730120	733020	So the private key is only ever going to be stored on the device.
733020	736180	But it's also an open standard like TOTP.
736220	742660	So the biggest drawbacks with WebAuthn right now is that it's still relatively new and setup can be a little bit clunky.
742660	748320	Some of the new devices are starting to bake this into the actual device itself.
748420	753900	And so Android phones can now be used as a WebAuthn authenticator for Google products.
753900	757700	But this is not something that you're seeing as widespread yet.
757700	762200	Hopefully this will be something that will be rolling out more widespread with devices that we already have.
762200	771320	But for something kind of third party that you can use to do this like a YubiKey, you need that additional authenticator right now to do this in a lot of places.
772220	775040	An authenticator that's compatible with the standard.
775040	778440	And, you know, YubiKeys, Titan keys, they're not exactly cheap.
778440	783380	And you can't also reasonably expect that every user of your application will have one.
783380	791520	So until something like this becomes a standard available on every mobile phone, it's going to be harder to implement this across the board.
792100	800240	So like I said, as more devices like we already have, like our phones and our laptops, start to adopt the standard and become those kind of compatible authenticators,
800240	802380	we will see an uptake in this factor.
802380	806020	And I think this is where you can kind of set your sights where things will be going.
806680	809600	But it is more currently more popular with companies.
809600	812700	So like your IT department can get you the YubiKey right now.
812700	814680	It can hand you the physical token.
814980	817500	So that's something where you might also be seeing this.
817500	822800	But a lot of these factors we're kind of focusing on as a consumer application channel.
824280	829580	But I did want to back up these kind of qualitative examples with some more quantitative data.
829580	833980	And to do that, I wanted to think about more granularly how we're measuring the effectiveness of 2FA.
833980	839300	And so separating this into three categories, kind of thinking about this in the life cycle of 2FA.
839300	843300	So there is this onboarding consideration, right, that I've mentioned a couple of times already.
843300	851800	There's also a user experience, ongoing user experience for how you're going to work with these different channels as you're using them on an ongoing basis.
851800	857320	And then also the account recovery side of things, like what happens when you lose one of these factors?
857320	858840	What do you do at that point?
858840	861340	Is there a path to recovery there?
862580	865720	And so the research that I'm talking about is from Brigham Young University.
865720	868480	It was presented at the Supes conference last August.
868800	871800	And so it was a study focused on setting up five factors.
871800	874920	And so the factors that they talked about are the ones that we kind of already walked through,
874920	881500	which were SMS, TOTP, pre-generated codes, push authentication, and U2F security keys.
881500	890020	So a couple of important caveats is the study didn't take into account how to store pre-generated codes.
890360	895120	And so that's something that I think is pretty important for this type of channel.
895220	899640	But 25% of participants noted that the pre-generated codes just didn't feel secure.
899640	903120	But when it comes to factor setup, this is the winner from the study.
903540	907540	But like I said, the code storage wasn't considered for timing.
907540	911460	So I don't know exactly what that would be like on an ongoing basis.
911880	915580	From a different study in 2018 that focused just on Yubikeys,
915580	921360	I think this study is really interesting because the success varied a lot depending on the platform that they were setting it up on.
921360	927060	Even though the channel, the thing that they were using to set up the U2F was always a Yubikey.
927060	930900	It was always the same Yubikey that they were using across channels.
930900	937320	So 83% of people were successful on Google, where only 32% of people were successful on Facebook.
937320	941940	And if you've been following U2F and WebAuthn, you know a lot has changed since 2018.
942040	948360	But I do think this is a really interesting look at how onboarding user experience impacts user success.
948360	952160	And so you can guide people towards a successful solution here.
952300	958900	But you don't want to guide people in a way like Microsoft Authenticator or Windows Logon Authorization Tool did,
958900	966540	where more people locked themselves out of their computer than were able to successfully set it up for that particular platform.
967560	973200	So moving on to usability, one measure of usability was the amount of time that it took to authenticate.
973200	977080	And in that metric, U2F and Push were the winners there.
977080	979960	So they have the fastest median authentication times.
979960	986240	So compared to SMS, some Duo research from last year said that this can save people 13 to 18 minutes annually
986240	991220	in terms of ongoing authentications, if time is something that you're concerned about.
991220	993620	And this is a measure of usability ongoing.
993620	1001600	But the system usability scale, or SUS, this is something that's a standard measurement used by researchers for this type of thing.
1001720	1007200	So actually all of the methods had a pretty good usability score, but TOTP came out on top.
1007200	1009940	Again, this is like ignoring just passwords.
1009940	1017520	So turns out people don't like adding a second factor to a lot of their authentication, because that's additional friction.
1017520	1022440	But if you're going to be using a second factor, then TOTP was what they considered most usable.
1022440	1027720	And this actually surprised me, because this was the same study that said that two-thirds of users had issues with the timeout,
1027720	1032320	but that didn't affect their rating here, so maybe that's something that we don't need to be as concerned about.
1033240	1036900	I do want to point out that there was somewhat of an inverse relationship here,
1036900	1040940	because U2F and Push had some of the lower usability scores,
1040940	1047420	so the researchers observed that faster authentication does not necessarily mean higher usability.
1048560	1053740	So this is something that we were looking at, and you might notice that SMS does not come out on top on any of these.
1053740	1059200	People didn't really like it as a factor. It was one of the lower factors for the authentication score.
1059200	1063900	But I do think that even though there's a lot of tradeoffs to the level of security in these options,
1063900	1069000	it's important to note that SMS-based 2FA is still better than no 2FA at all.
1069000	1072800	And this is really easy for me to say, like, you know, I work for a company that does this,
1072800	1075500	but there's research here to back me up.
1075500	1081160	So a 2019 Google study found that an SMS code sent to a recovery phone number
1081160	1089280	helped block 100% of automated bots, 96% of bulk phishing attacks, and 76% of targeted attacks.
1089280	1093220	So it's still really good coverage, especially for something that's really easy to set up
1093220	1098320	that might have high likelihood that users are actually going to turn on a second factor.
1098760	1103540	But when you start looking at push authentication, there is increased protection.
1103540	1112560	So this gets bulk phishing attack protection up to 99%, and it has a 90% effectiveness for targeted attacks as well.
1112560	1118920	So you have different options for 2FA, but you also do need to get your users to enable the extra security.
1119440	1123800	And adoption of 2FA is pretty abysmal. There's a few reasons for that.
1124400	1127520	This is especially abysmal for opt-in 2FA.
1127520	1138840	Last month, DHH on Twitter, who works for Basecamp, I think, and is behind the new email platform, Hey,
1138840	1145880	was asking about how the opt-in rate for different companies was for consumer 2FA.
1146160	1150700	And companies willing to share this data say that it's usually somewhere between 1% and 2%.
1150700	1155760	Depending on the type of platform, depending on how you're getting users to turn it on,
1155760	1161580	you probably are going to have a pretty low rate of adoption here.
1161580	1164760	So he mentions that Basecamp was at a paltry 1%.
1165920	1171380	And one of the observations behind this is that there is technology like this.
1171380	1178580	Technology is available to help mitigate the risk and improve the consumer experience, but it often goes unused.
1178580	1189760	And so I think this is one of the things that we as security professionals and people that have the ability to encourage people to opt into these more secure measures,
1189760	1195180	need to be considering how we can push people in that direction without increasing too much paranoia.
1195800	1205780	So in terms of 2FA adoption, a 2019 BYU study found that people were willing to add 2FA to their accounts if they saw the value in the account.
1205780	1211000	But 13% of participants just thought that the inconvenience was too high, no matter what.
1211460	1214780	And that's because a lot of people just believe they're not a target.
1214920	1219700	And so this research participant said, I just don't think I have anything that people would want to take from me.
1219700	1222620	So I think that's why I haven't been very worried about it.
1222620	1224860	And you can see this with a lot of people in your own life.
1224860	1228460	They don't understand the risk that's associated with all of their accounts.
1228540	1235140	And maybe that's okay. Maybe you don't need to be adding two-factor authentication to the pizza delivery app that you're using.
1235140	1248420	But how do we encourage people to add stronger authentication methods beyond passwords to things like their emails and like their bank accounts and other places where that level of paranoia is perhaps justified?
1249240	1254420	So hope is not lost here. Awareness and adoption have almost doubled in the last two years.
1254420	1258500	There's reasons for this. Bitcoin has spiked a couple of times within there.
1258500	1262080	But there's other things that we might be able to attribute this to.
1262080	1266500	And so one of these is how we drive adoption of multi-factor authentication.
1266500	1271440	And websites are getting more savvy about how they're getting people to turn on 2FA.
1271720	1277720	But unless you're somebody like Coinbase, you're probably not going to make two-factor authentication mandatory.
1277980	1284040	But you do have other options than just hiding it in profile settings where people aren't going to think to go get it.
1284040	1286540	And so you can prompt people when they log in.
1286540	1288480	You can offer product incentives.
1288480	1296780	You can have a really annoying and persistent login prompt that is telling people they need to turn on additional factors for authentication every time they log in.
1296780	1302040	The more annoying you are about it, the more likely that people are going to be to turn it on.
1302040	1306460	But that's also going to increase the friction and you don't want to annoy your customers too much.
1306900	1313500	So we do know that strategies like product incentives work from looking at the Google Trends for 2FA searches.
1313500	1320980	So if you can guess what the spike in August 2018 was, it's only gone up from there.
1320980	1324820	But it was pretty flat for many, many years leading up to that.
1324820	1331600	That was when Fortnite decided to offer in-game incentives for its users to turn on two-factor authentication.
1331640	1336340	And so if you're not familiar with Fortnite, it's an incredibly popular video game.
1336360	1341880	And video games are some of the people that have gotten most creative with the incentives that they're offering people.
1341880	1347960	One, because there's in-game trading that has real monetary consequences to their users.
1347960	1352560	But two, because some of the incentives that they can offer don't actually cost them a lot of money.
1353460	1359440	And so now even two years later, three of the top five related search queries to 2FA have to do with Fortnite.
1359440	1366520	Three of the top five related topics to 2FA have to do with video games. Epic Games is the company that owns Fortnite.
1366640	1369800	But they aren't the only ones that are offering incentives.
1369800	1375120	Lots of gaming companies are offering incentives around that. You can see lots of examples there.
1375120	1378240	But there's other companies that are offering product incentives as well.
1378240	1385240	So a good example of this is MailChimp will offer you a 10% discount for three months for users that turn on 2FA.
1385620	1391800	And so you can understand kind of the trade-off here of what it would be valuable to your company.
1391800	1397100	Like, what is the account takeover risk? What is the loss that you're experiencing from something like this?
1397100	1405460	And does it make sense for you to offer some product incentives or discounts to your customers that might get them to opt into additional security?
1407320	1412580	And so like anything, you want to make sure that you're going to measure how effective this was.
1413020	1417080	So ideally you would be setting these measures before you embark on this kind of journey.
1417080	1424140	But some of the things that I encourage people to think about as they're measuring the effectiveness of their authentication strategies,
1424140	1428700	like this is going to depend on your business, but here are some of the options that you might have.
1428700	1433740	Just total losses due to account takeover. You probably want to see that number go down.
1433940	1438020	You might want to care about the total number of compromised accounts too.
1438560	1442740	Decreasing the number of customers that are actually having their accounts taken over.
1442960	1448700	One thing that I do think is really important to look at is just the support costs related to the losses.
1448800	1454120	So if you're somebody that's starting to require or encourage a lot more two-factor authentication,
1454120	1457980	there are going to be additional support hurdles that you're going to come across.
1457980	1463860	So especially when it comes to the account recovery side of things, people are going to get locked out of their accounts more often.
1463860	1467620	And you want to have a smooth path. Hopefully self-service.
1467620	1475900	Hopefully you've enabled three or four factors so that they can gain access to their accounts again if they lose access to any one of their factors.
1475900	1485200	But you want to make sure that you've also equipped support with the tools to make sure that they can securely and safely get people back into their accounts.
1485500	1490700	Even if this is going to take more time on the support team, it might be worth it overall.
1490700	1495740	And finally, you just want to make sure that user satisfaction is at least staying the same if not going up.
1495740	1501580	If you're doing something like having really persistent login prompts for turning on 2FA,
1501580	1506380	you might want to make sure that you're not annoying your customers too much overall.
1507480	1510900	So there's definitely no one-size-fits-all solution here.
1510900	1514580	But the advice that I end up giving a lot of folks boils down to something like this,
1514580	1517440	which is to delight your most security-conscious users.
1517440	1525060	You don't want people that are paranoid with good reason, have higher security needs and concerns,
1525060	1528000	to be upset at the lack of options that you're providing.
1528000	1530300	But you do want to provide options for the rest.
1530300	1538320	You don't necessarily need to force everybody on your consumer website to have TOTP or YubiKey or anything like that.
1538320	1544740	But you want to make sure that it's usable for people, depending on the risk that they're willing to accept.
1545240	1553800	Because, like the security researcher Cormac Hurley says, when we exaggerate all dangers, we simply train users to ignore us.
1553820	1558760	So I hope I've given you some inspiration for how to think about your authentication systems.
1558760	1564360	I'll be around. You can find me on Discord, you can find me on Twitter if you have any questions.
1564360	1568700	Once again, my name is Kelly Robinson, and thank you for listening.