3 ms·
I'm sure there are ways to use 2FA or OTP without externalising access management to Facebook, Google or another SSO provoder, unless you want to pick convenien
by petre 6y ago
I'm sure there are ways to use 2FA or OTP without externalising access management to Facebook, Google or another SSO provoder, unless you want to pick convenience over privacy and security.
- cratermoon 6y agoThere are, but writing your own authn/authz is about as wise as writing your own cipher. https://www.schneier.com/crypto-gram/archives/1998/1015.html#cipherdesign https://www.schneier.com/crypto-gram/archives/1998/1015.html...
- petre 6y agoI'm talking about using a library like privacyID3A or something else, not writing your own.
- lordlimecat 6y agoHow do you centralized your authn, your 2fa provisioning? How do you ensure that your cloud native apps have access to the auth backend without risking exposing the wrong ports on the wrong vpc?
- cratermoon 6y agoJust adding a library to application code is not sufficient. What I mean is that organizations should not roll their own SSO provider. At the very least, work with one of the many companies that offer it as a product or service. If your threat model requires it, you can host the product on premises.
- SilverRed 6y agoHow do you enforce it over a bunch of 3rd party software which either doesn't support 2FA or doesn't support enforcing it? If they support SSO which they usually do, its a non issue.