4 ms·

Thanks for your comment! Well, obviously we want to prevent stealing the HTTP session. But maybe someone steals the user's password - we can't protect the user

Thanks for your comment! Well, obviously we want to prevent stealing the HTTP session. But maybe someone steals the user's password - we can't protect the user's password for him. So when someone from the US suddenly logs in on another continent we want to detect that. Sure they could use a proxy, but maybe. Since it's a B2B app people rarely use it out of the office. I read eCommerce shops do it, payment providers as well. So there seems to be something to it...

chrisfarms 13y ago
This is where you want 2FA really. Each time the user logs in from a new "client" ask for a 2FA code from something like their phone. Things like Authy and Google Authenticator make this relatively painless to implement.
- stephanos2k 13y ago
  We already implemented 2FA, but it's not yet forced for everyone. You don't want to patronize your customers ;)