A Secure User Authentication Method – Planning is More Important than Ever

Jan 16, 2023The Hacker NewsIdentity Management / MFA

When considering authentication providers, many organizations
consider the ease of configuration, ubiquity of usage, and
technical stability. Organizations cannot always be judged on those
metrics alone. There is an increasing need to evaluate company
ownership, policies and the stability, or instability, that it
brings.

How Leadership Change Affects Stability

In recent months, a salient example is that of Twitter. The
Twitter platform has been around since 2006 and is used by millions
worldwide. With many users and a seemingly robust authentication
system, organizations used Twitter as a primary or secondary
authentication service.

Inconsistent leadership and policies mean the stability of a
platform is subject to change, which is especially true with
Twitter as of late. The ownership change to Elon Musk precipitated
widespread changes to staffing and policies. Due to those changes,
a large portion of staff was let
go^[1], but this included many
individuals responsible for the technical stability of the
platform.

This culminated in an outage of Twitter’s SMS two-factor
authentication^[2]. With delayed or
non-existent texts, many users could not log in to Twitter. This
affected systems that relied on Twitter as their primary and
secondary authentication provider.

Not limited to authentication issues, with the changes come a
renewed concern over the safety and privacy of user data. Twitter
has been under an FTC consent decree from past problems surrounding
user data, and a good portion of the staff^[3] responsible for
compliance has been let go. Even if the authentication provider
stays up, it may leave an organization in an uncomfortable position
regarding the state of their stored on Twitter’s servers.

Strategies for Authentication Service Stability

Using a platform’s well-established and robust authentication
service can save organizations time and money over implementing
their own. Cutting out third-party platforms is typically not
feasible or even recommended. Instead, proactive planning is
essential if an organization needs to maintain stability and
security with its authentication platforms.

It’s crucial to ask and answer the following questions when
considering how your organization’s authentication service would
handle potential disruptions in authentication providers.

• Does the organization’s authentication service support multiple
  identity providers?
• If a provider is unavailable, is there a backup provider, and
  how quickly can providers be switched?
• What is the disruption to users? Will they be logged out of
  current sessions, or will it be seamless and take effect on the
  next login?
• If MFA is configured, what are the available options? Are there
  multiple methods to verify the user, and if one is removed, does
  that degrade authentication services?

If an organization chose Twitter as a source of two-factor
authentication, it might find that recent events indicate a
necessary change. If so, the switch could be made easier if
multiple MFA platforms were already available and configured.

If an organization can choose the active authentication system
based on current needs, then even the problems shown with a major
platform such as Twitter would be mitigated, and the organization’s
users would see little change.

Offering Multiple MFA Options

To understand how this works in practice, one can look to
Microsoft. With Azure, once MFA is configured, you can offer
several options or limit the available verification methods.
Instead of an SMS, you could receive a phone call or use a hardware
token. If you offer all 3, you won’t be locked out of your account
if a specific service is unavailable.

Nearly identical is Google Workspace, where you can offer one or
more authentication options. If you enable more than one, you will
not lose the ability to authenticate your users in the event of a
service failure. Both Microsoft and Google could be more flexible.
Neither offers the full range of options to integrate with services
like Twitter.

An example of a system that offers a myriad of options is Okta.
By enabling Social Logins, you can allow users to log in via
popular services such as Facebook or Twitter. But it’s recommended
that you back that social login with an MFA configuration that
could include such options as SMS, authenticator applications, or a
hardware device such as a Yubikey.

Mitigating Authentication Instability with Specops uReset

An organization may find itself uncomfortable with changes to
its authentication provider. If so, implementing a product, such as
Specops uReset^[4], takes the reliance on a
problematic authentication platform off the table, at least for
password resets.

The flexibility to choose from multiple weighted authentication
providers makes a problematic provider easy to remove while leaving
the ability for users and service desk workers to reset a password.
Change the weighting to offset the loss of the previously used
provider, and your users can quickly get back to work!

Since multiple providers are in use, you can have end-users
utilize a combination of trusted identification services to perform
self-service password resets without worrying about losing access
to a previously critical authentication service.

Manage Platform Instability with Planning

Platform changes are hard to predict and react to, but your
organization can be ready for any change with foresight and
planning. Even the most mercurial leaders can be planned around by
architecting flexible authentication services.

With products such as Specops uReset^[5], users will not be
locked out when an authentication service goes down. Using various
password reset options, they can quickly get back to work.