Category: Single Sign-On

Posted on

All About 2FA: What is OTP, TOTP, and HOTP?

Offering reliable and safe access to cloud-based applications is an ongoing problem for organizations across all industries. Therefore, providing users with simple and dependable security measures is vital for securing sensitive company data and user info. But with many two-factor authentication (2FA) options, which one is suitable for you–OTP, TOTP, or HOTP?

Today, it’s essential for companies to offer 2FA (Two-factor authentication) to their users to protect their activities on the internet. There’re multiple types of 2FA out there. In this post, we’ll discuss the three most common methods: one-time password (OTP), a time-based one-time password (TOTP), and a hash-based one-time password (HOTP).

We’ll discuss each, give out their differences, their pros and cons, as well as how they work. Read on to find out more!

Defining Terms

What is 2FA?

Simply put, 2FA (Two-factor authentication) is an additional step incorporated in the sign-in process, such as a fingerprint scan or a code sent to your phone. The extra step helps to verify your identity and deter cybercriminals from gaining access to your private info.

Two-factor authentication is a form of multiple-factor authentication that provides an additional security level that cybercriminals cannot effortlessly access. The reason for this is that hackers will require more than just your sign-in credentials (username and password) to gain access.

What is MFA?

MFA (multiple-factor authentication) is an authentication technique that demands users to give two or more factors to access software, an online account, or even a VPN (Virtual Private Network). Instead of asking for login credentials only, MFA demands one or more extra verification factors limiting the probability of a successful cyber-attack. Check out our blog post here as we discuss MFA in detail.

Types of Two-Factor Authentication (2FA)

Now that we’ve defined what 2FA is and how it works, below are three methods of two-factor authentication.

One-time Password

OTP or a one-time password is a unique code sent to a user via phone or email. Typically, it comes with four to six characters and users need to input the characters to authenticate their identity.

Generally, organizations use a one-time password as a complementary factor in MFA processes, but businesses can also use it to authenticate users.

Time-based One-time Password (TOTP)

TOTP (time-based one-time password) is merely a one-time password based on time. OTPs usually base their functioning on the time sequences known as timesteps. In most cases, a timestep duration lasts for roughly 30 to 180 seconds, but it’s possible to customize this time duration. Well, this means that the OTP code is invalid if used after the stipulated time’s elapse.

We’ve discussed in detail how TOTP works in this blog post.

Hash-based One-time Password (HOTP)

HOTP (hash-based one-time password) is an OTP based on events. Basically, HOTP comes with a token generation that’s only known to the server and the user. Since the OTP is sent to the user and founded on a hash algorithm, the OTP gets the name ‘hash-based one-time passwords.’

Why Use 2FA/MFA?

Two-factor authentication or MFA can assist in deterring some of the leading types of cyberattacks, such as:

Spear phishing – the act of sending emails to precise and well-researched targets while alleging to be a trustworthy sender.
Phishing – a technique of attempting to gather personal info via deceptive websites and emails.
Keyloggers – it’s a type of software or malware made to record keystrokes that users make.
Brute force & reverse brute force attacks – it’s a type of hack that depends on guessing potential combinations of a targeted password until discovering the right password.
Credential stuffing – it’s the automated use of collected credentials to gain deceitful access to user accounts.
MITM (Man-in-the-middle) attacks – it’s the act when an attacker or intruder interrupts communications between two or more parties either to adjust or secretly eavesdrop traffic between the parties.

Top Industries that need Two-Factor Authentication

2FA is a fantastic tool for businesses to protect themselves and their consumers. The extra security makes it easy to prevent over 80% of the security breaches. Here are the industries that benefit most from Two-factor authentication.

Internet

Two-factor authentication makes online accounts much more secure means the internet industry is a good home for Two-factor authentication. For internet companies, such as Facebook, Instagram and Google, two-factor authentication has incredible value. Indeed, users want to secure their email and social accounts.

Finance

For all users, securing financial data is a substantial concern. With this, it would be wise for banks to provide extra security since they’re a top target.

eCommerce

When it comes to the eCommerce industry, two-factor authentication solves credit card fraud problems.

Government Organizations

Cybercriminals always target government organizations. With a 2FA process in place, it will be easy to prevent both cyber and physical attacks in government bodies.

Healthcare

Transmitting electronic data can pose a threat to both providers and patients. Two-factor authentication in the health industry ensures patients’ data stays private and confidential.

How 2FA Works

It is crucial to have know-how regarding factors to understand how two-factor authentication works. Ideally, you’ll need to have a 2FA factor to gain access to an account. Here’s a breakdown of what to expect:

Knowledge – the factors need you to know something, such as security questions, a code sent to your phone or even a particular keystroke.
Biology – the system gives users access to proving their identity via biological makers, such as voice or fingerprint.
Possession – a user needs to have a physical factor, such as a USB drive or debit card and then insert it into a device to gain access.

Never compromise security
for convenience, choose both!

Try Teamstack Now

Advantages of 2FA

  • It adds an extra security layer
  • It adds variation
  • It’s quite cost-effective
  • It remembers users’ accounts
  • Lightweight

Disadvantages of 2FA

  • Increased sign-in time
  • Integration cost
  • It’s not foolproof
  • Downtime can be disruptive

How OTP Works

If activated, OTP is sent to users that need to sign into their digital accounts. Merely put, it assists in authenticating users’ identity and it needs to be used within a stipulated time. Upon OTPs allowing users to log into their accounts, their validity vanishes. Since it’s only usable once, an OTP is safer than a static password.

Pros

  • It’s secure from replay attacks
  • It lets you keep your emails secure
  • It’s convenient to use

Cons

  • It may get out of sync
  • You may get locked out of your account
  • It’s relatively expensive for the providers

TOTP VS HOTP: What is the Difference?

Since it incorporates additional factors to meet the algorithm security requirements, TOTP is regarded as a newer version of HOTP. The fact that time-based one-time password is valid within a specific period means it offers more security than HOTP. Here, incorporating a new factor that needs to be met enhances the code’s security.

Additionally, sending a one-time password comes down to other external factors, like internet connectivity for the emails and broadband coverage for calls and SMS. If users lack any of these, the one-time code will not arrive at the user’s device and they’ll be unable to input the code to authenticate their identity. In such a scenario, users will have to request another code. Besides, even if users meet all the criteria, failure to use the OTP fast will be useless.

When it comes to this, HOTPs perhaps provide friendlier ways of authenticating users because timesteps don’t restrict them. Instead, users can enter their codes whenever they deem it fit. Unluckily, compared to time-based OTPs, HOTPs are less secure.

Final Words

Irrespective of the kind of One-time based password you use, selecting a one-time based password generator is a much secure way to use MFA. Today, hackers have invented techniques to interrupt the OTPs code, whether via SIM card fraud or other hacks. Whatever the case, the time for implementing two-factor authentication in any industry is now!

If you’ve problems deploying MFA in your company, Teamstack is the team to get in touch with. Teamstack is unmatched in multiple-factor authentication as it supports popular methods, such as TOTP (Google Authenticator), WebAuthn (Windows Hellow on Win, Touchld on Mac and FIDO2), SMS codes, etc.

Posted on

Form-Based Authentication vs. Single Sign-On Solution

The internet is filled with data. A lot of it is names, addresses, and financial account numbers. Hackers tend to gather personally identifiable information (PII). For some, it’s much easier to obtain your password to steal the information.

It’s the reason password protection is critical these days. When people set up a strong one, it minimizes the chances of a hacker breaking through. These passcodes are created either through a form-based application or a single sign-on, or SSO solution.

Which one is better to use: form-based authentication or SSO solution? Here’s a breakdown of the two processes to find out.

Form-Based Authentication

Form-based authentication is still the most accepted method across the internet. A website developer creates a password page or login page.

Once the user submits the login form, the information goes to the authentication server. If the information matches records in the database, the users can normally continue. Conversely, if authentication fails, the user is redirected to an error page. Or, they have to re-enter the correct information.

Form-Based Protection

The password is protected through two methods: cookies and secure socket layer (SSL) certificates. Cookies are added to a user’s computer to remember various pieces of information, two being the username and password. The SSL provides a secure link between the user’s computer and the destination servers.

Single Sign-On

An SSO solution looks similar to a form-based version. A user is taken to a page that asks them to create a new username and password. However, SSO isn’t based on this information being stored on individual sites.

Rather, it allows a user to access multiple locations with the same credentials once it’s properly verified via a third-party.

This form of identity and access management (IAM) relies on the establishment of trust between two domains along with data verification. Furthermore, SSO solutions take the form of tokens instead of information stored in cookies.

Once the user provides the appropriate information, the SSO solution authenticates the user. If authentication failed, the user needs to sign back on the single sign-on page.

From there, the SSO solution asks the third-party provider to validate the information. When it gives the go-ahead, it allows the user to enter the site. In addition, it passes the information through connected sites to show the user has access.

Forms Of SSO Authentication

There is one form of an SSO solution that is called Kerberos authentication. There are others that use the same protocols. For instance, a smart card solution allows authentication via a physical card or token with strong encryption.

Another version involves authentication through a form of system directory similar to what Windows uses. At the point of confirmation through the directory, the user can access various websites and applications without logging in.

Form-Based Authentication For Smaller Businesses

Not all types of organizations may need SSO. A form-based solution might be fine for smaller businesses with fewer access points.

Though not as powerful as SSO, this version of authentication is still secure as long as users follow the rules to create a strong password. This reduces the risk of obtaining information for malicious purposes.

Yet, there are two sticking points connected with this authentication type. One is randomness. Users tend to apply the same password to different pages or sites. While it helps to remember the code, it also allowed those with malicious intent to discover a pattern. In turn, they can grab the user’s data from multiple locations.

The other issue is recall. The user might create a strong password or have the computer create one for them. It works the first time, then the user forgets it and has to reset again. Each time they create an advanced password they can’t recall it. In the end, the next reset is a simpler one that hackers can access.

Advantages of Having an SSO Solution

SSO Solution Prevents Password Fatigue

On the other side, single sign-on prevents password fatigue. Instead of remembering so many passwords, the user has to recall a single one during the first access. They can perform their tasks afterward without another request for verification.

Doing this helps a number of departments. For example, it reduces the workload of a company’s help desk as a result of the fewer requests for a password reset. Furthermore, the IT team doesn’t have to maintain an enormous database that can easily get corrupted.

A Longer Period For SSO Implementation

Implementation of an identity and access management tool like single sign-on is more involved than form-based operations. Once the business’ needs are determined, user requirements and capabilities need to be reviewed.

Next, architecture has to be designed to support the SSO solution.

From there, the access control requirements are established and the third-party verifier must be chosen. Once installed, there will be testings to ensure there are no gaps in the verification process.

However, the length of time it takes to implement the SSO solution doesn’t mean it’s not worth it. There must be assurances that users can get in without trouble. Plus, the verification tools must work to secure not only their information but that of the company.

Best Practice in SSO Solution

There are some actual cons to an SSO solution that relates to passwords and productivity. An SSO password shouldn’t stay the same forever. Even with stronger security, it is best practice to change SSO password once in a while. At that point, the password has to be extra strong. Like form-based authentication, that leads to issues with recall.

Then there’s the matter of authentication outages. Should the SSO site go down without proper continuity of business (COB) plans, users and employees won’t be able to access the material. SSO doesn’t use cookies to maintain login information. Thus, if the authentication domain can’t be reached, users will either be denied access or get an HTTP error.

Never compromise security
for convenience, choose both!

Try Teamstack Now

The Bottom Line

Despite those disadvantages, SSO is still a more viable and secure solution that companies should consider to secure their user data and prevent hacks. Teamstack SSO solution can help those who want to set this up and automate their identity management.

Their subject matter experts (SMEs) will develop a single, intuitive way for users to access all their applications from the Teamstack dashboard or browser extension. In turn, people can securely connect to technology.

In addition, companies can take advantage of Teamstack’s variety of pre-built integrations, Single Sign-On solutions, and one-click user provisioning. These allow people to conveniently sign into any application through multi-factor authentication.

Posted on

The Importance Of Single Sign-on To Business Security

Single sign-on tool

Single Sign-on (SSO) has been around for quite a while, but only gained widespread acceptance in recent years. In fact, this technology is spreading quite fast, as more organizations move into the cloud. With SSO, employees can log in once with a single set of credentials and access multiple apps from anywhere, and on any device.

If you haven’t implemented SSO in your organization, we have put together this piece to get you warmed up on this promising technology.

What is SSO?

Single Sign-On is an enterprise user authentication technology that allows users to log into a host of internet applications, websites, and data with a single set of credentials (password and username). It is particularly used by enterprises that not only want to minimize security risks on user data, but also streamline IT login processes and improve user experience.

Large corporations usually have several touchpoints that fall under different brands, so their IT teams can be strained while trying to keep track of all these. Securely managing hundreds or thousands of applications is equally challenging for users.

That is where single sign-on solutions come in to streamline access management systems tailored for their IT teams and customers.

Let’s simplify things using this example. Without SSO, a user of Google, which owns YouTube, Hangout, Gmail, Google Drive, and Google Docs, would need to have a separate key to access these applications.

How Does SSO Work?

We can simplify how SSO technology works in a few steps:

  1. The end-user requests access to an application or platform.
  2. Before granting access, the site checks user identity has been verified with the relevant SSO provider. If it is not authenticated, he/she will be redirected to the SSO login page to enter their credentials.
  3. The user enters the login info. From here, the SSO solution sends authentication requests from the identity provider.
  4. Once the identity provider confirms the user’s identity, the SSO solution will then confirm the user identity to the original site and transfer him/her to the site.
  5. If the user visits another related site or application, the app will check their identity with the SSO solution. Given that the user had already logged in, their identity will be automatically approved on the new site or app.

Now that we know what it is and how it works, let’s now focus on the benefits of single sign-on solutions.

Benefits of SSO

The goal of single sign-on is to simplify the login and authentication process, especially for enterprise users. But there are other single sign-on benefits for both users and enterprises. Here are the main ones:

Reduce Help Desk Requests and IT Costs

Benefit to Enterprises

One of the advantages of SSO is that it saves on help desk costs. But how?

Most of the help desk requests are related to passwords resets. Gartner estimates that up to 50% of employees reach out to help desk for this reason. What this means is that enterprises could be wasting a lot of valuable IT time, which could be invested in other priorities and projects. The more users an organization has, the higher the IT cost. To put it into perspective, each password reset could cost an enterprise $70. If we can be sincere with you, that is too expensive for such a dull task.

Benefit to Users

SSO can also save users from having to remember different passwords for each application. In organizations that implement strict password policy, employees have to scan through their password lists to key in different characters. And if these passwords change more frequently, they will have a hard time memorizing them each time.

SSO therefore will help them save some precious minutes they would have used to reach out to IT departments for login related issues. Using only one password will reduce the login time and chances of failed logins, which in turn, boost the productivity of employees.

Increase Efficiency and User Satisfaction

Benefit to Enterprises

Enhanced user experience is one of the top single sign-on benefits. That is why most web 2.0 sites, such as social media sites, offer SSO to improve their end-user experience. The login screen is the first interaction with users for most of these sites, so a user-friendly login process will improve customer satisfaction. Besides this, SSO tightened collaborations between partnering businesses.

Benefit to Users

With just a single login, users will spend less time visiting several applications. Without repeated logins, end-users will be happier and spend more time on meaningful work.

Improve Security

This is perhaps one of the most misunderstood single sign-on benefits. A common misconception is that using a single password for multiple applications weakens security. But we will soon learn that SSO improves security capabilities and compliance.

Benefit to Enterprises

As enterprise computing grows, so does the security risks. Most businesses today host a number of cloud and on-premise tools. Navigating and keeping track of data across these environments can get dicey quickly. Single sign-on solutions minimize these risks, as organizations can offload user identity data to their more secure third-party SSO platform.

Apart from improving enterprise security, SSO can also help with regulatory compliance. Most regulations, such as HIPAA (Health Insurance Portability and Accountability Act of 1996), require that organizations put in place adequate measures to protect user data.

In this chase, we can set up SSO as part of your IAM or identity and access management solutions, thus meeting requirements regarding data access. With SSO, businesses can manage user access at a more granular level.

Benefit to Users

Usernames and passwords are usually a target of fraudsters. Each time a user logs into a system, it is an opportunity for cybercriminals to hijack that information. In this case, SSO cuts down on the number of attractive surfaces, as users only have to log in once.

It is a sad reality that about 25% of employees in the US use the same password for all their accounts. So, if an attacker gets access to their credentials through a poorly secured app or websites, these criminals will be able to access other user accounts and wreak havoc. Such security lapses can be sealed by reducing logins to one set of username and password.

Actually, there are more advantages of SSO than we have listed here. Other notable benefits of single sign-on solutions are:

  • They prevent shadow IT
  • Improve software adoption rates
  • Minimize password fatigue

Disadvantages of SSO

SSO Creates a Single Point of Failure

If SSO is down, it might break down access to all connected applications. That is why we emphasize on implementing a robust SSO system. Choose an SSO provider with contingency plans to address unstable connections.

SSO Can be Difficult to Implement

Implementing SSO might take a longer time to set up, as each environment is unique. It is important to consult all stakeholders to understand their different needs. It can also be challenging and even risky for multi-user environments. What happens when a specific user wants to use a machine that another user has already logged into?

Reliability Issues

Though rare, some SSO-linked sites might share user data with other unauthorized third-party entities. Besides this, all your linked accounts could be vulnerable to attack if an attacker breaches your identity.

Never compromise security
for convenience, choose both!

Try Teamstack Now

Bottom Line – Is SSO the End-all of Online Security Measures?

SSO is one of the best access management tools enterprises can use to limit security threats, tighten B2B collaboration, improve data compliance, reduce help desk costs, and boost productivity.

However, it is not a silver security bullet. As we touched on above, it is open to vulnerabilities. Thankfully, none of the above concerns is insurmountable.

Conclusion

Technology should make your life better. Simplifying logins with SSO will, therefore, improve user experience and relieve IT staff of mundane tasks. If you are considering implementing a new or upgraded SSO capability, be sure to engage Teamstack to help you weigh your options.