3 ms·
In my opinion you don’t. Rely on the authentication provider to handle that responsibility. Services like duo/Okta perform this risk assessment and may opt to r
by josho 5y ago
In my opinion you don’t. Rely on the authentication provider to handle that responsibility. Services like duo/Okta perform this risk assessment and may opt to request a mfa request.
- hu3 5y agoThat's not always an option.
- hu3 5y agoYou can downvote all you want. Some projects are sensitive enough to not allow third party authentication (military systems anyone). Besides, if you're large enough it makes business sense to do it yourself anyway.
- bradleydwyer 5y agoI've never wanted to completely hand over authentication to a third-party. Instead what I'd think I'd like is just the risk assessment to be be performed by a third-party when I'm handling authentication (i.e. a third-party that has a broader view of what's happening across multiple services over time). I just send the pieces of information that I'm willing to share as an API call and they make the best risk assessment they can. Then I can take that risk assessment result and make a final decision if authentication succeeds or not.
- jsmeaton 5y agoThere are risk services out there. https://sift.com/ https://sift.com/ Is one you call out to that gives you a risk score. https://datadome.co/ https://datadome.co/ can sit within your cdn layer that does risk assessment.