Building a Resilient MFA Framework: Strategies and Best Practices
summary
Proposes a concrete Rails design that separates credentials into factor and identity tables, letting login vs verification be distinct phases and adding new methods without conditional hell. Implements strategies for email (magic link or OTP), SMS (OTP or voice), and authenticator apps using the Ruby OTP library, and experiments with webauthn/FIDO limitations for device-bound factors. Costs: three tables and extra complexity, gains: easy addition of third+ factors and per-factor UX; device-bound biometrics remain tricky to reuse across machines.
AI-written summary · about
chapters (11)
- 0:00Introduction and speaker intro
- 1:07What is MFA and why it matters
- 3:12Problems with traditional MFA
- 6:26Designing a flexible MFA framework
- 9:17Authentication flow implementation
- 11:01Triggering MFA conditions
- 12:46Advantages of the new approach
- 13:30Limitations and edge cases
- 14:33Extending verification strategies
- 16:17Key takeaways and summary
- 17:00Q&A session
related talks
17mImplementing Multi-factor Authentication
26mMFA for All
19mAdvanced Authentication Framework
29mRubyGems.org MFA: The Past, Present and Future
50mOne Does Not Simply Add MFA
26mMake MFA More Resilient
24mUnraveling the black box: past, present and future of authentication in Rails
45mMFA: Stories that make you go 'Huh?'