Deploying Two-Factor Authentication to Millions of Users
summary
Built 2FA for Pinterest and ships it globally to millions, focusing first on login then on enable flows; implementation uses TOTP, push, and adds FIDO U2F security key support later. Backend pairs existing auth services with an external code provider (Twilio), forces password verification for enable, issues backup codes and enforces unique phone numbers. Rollout takes about six months end-to-end, a rushed Android experiment breaks Facebook login and costs a month, so deploy slowly and monitor every login endpoint.
AI-written summary · about
chapters (11)
- 0:00Introduction and motivation
- 2:16Two-factor authentication basics
- 5:09Design and architecture overview
- 7:19Login flow implementation
- 12:00Enable flow and user experience
- 16:18What to protect with 2FA
- 18:46Security keys and future
- 20:33Bugs and long-term maintenance
- 21:58Internal marketing and PR
- 23:46Conclusion and key takeaways
- 24:26Q&A session
