Adding two-factor authentication to ASP.NET - Revision history

Lachlan-barclay: /* Adding the NuGet package */

2016-04-03T23:29:10Z

‎Adding the NuGet package

Lachlan-barclay: /* Database Configuration */

2016-04-03T23:22:42Z

‎Database Configuration

Lachlan-barclay: minor code fix

2016-03-24T00:04:13Z

minor code fix

Bill Sempf: Promoted to prod, added edits from Brice.

2016-03-23T03:04:25Z

Promoted to prod, added edits from Brice.

Lachlan-barclay at 04:14, 4 March 2016

2016-03-04T04:14:19Z

Lachlan-barclay at 04:07, 4 March 2016

2016-03-04T04:07:50Z

Lachlan-barclay: /* Description */

2016-03-04T03:55:15Z

‎Description

Lachlan-barclay at 03:11, 4 March 2016

2016-03-04T03:11:51Z

Bill Sempf: Initial layout

2016-02-22T13:26:15Z

Initial layout

New page

= DRAFT DOCUMENT - WORK IN PROGRESS =

==Description==

==Risk Factors==

==Related [[Attacks]]==

==Related [[Vulnerabilities]]==

==Related [[Controls]]==

==Related [[Technical Impacts]]==

==References==

[[Category:OWASP .NET Project]][[Category:Stub]]

@@ Line 32: / Line 32: @@
 ==Adding the NuGet package==
-You can now add the NuGet package “AddTwoFactorToMvc” by running the following command:
+You can now add the NuGet package “AddTwoFactorToMvc” which will install all of the code that you need. Note that this package contains no DLL files, just code.
   install-package AddTwoFactorToMvc

@@ Line 121: / Line 121: @@
   CREATE USER [moviemanageruser] FOR LOGIN [moviemanageruser]
   GO
-  ALTER ROLE [db_owner] ADD MEMBER [moviemanager]
+  ALTER ROLE [db_owner] ADD MEMBER [moviemanageruser]
   GO

@@ Line 162: / Line 162: @@
          public void sendEmail(string email, string subject, string body)
+         {
-              MailMessage mail = new MailMessage(
+              using (MailMessage mail = new MailMessage(
                   replyToEmail,
                   email,
                   subject,
-                  body);
+                  body))
-             mail.IsBodyHtml = true;
+                 using (SmtpClient client = new SmtpClient())
-             SmtpClient client = new SmtpClient();
+                     client.Send(mail);
-−
+                 }
-             client.Port = 25;
+          }
+      }

@@ Line 3: / Line 3: @@
 ==Description==
-If you wish to add two factor authentication to your site you can use [http://lachlanbarclay.net Lachlan Barclay's] [https://www.nuget.org/packages/AddTwoFactorToMvc/ NuGet Package] which contains all the code you need.
+If you wish to add two factor authentication to your ASP.NET site you can use [http://www.asp.net/identity ASP.NET's Microsoft's Identity Framework] and [https://en.wikipedia.org/wiki/Google_Authenticator Google's "Authenticator"] app. A pre-prepared [https://www.nuget.org/packages/AddTwoFactorToMvc NuGet Package] by [http://lachlanbarclay.net Lachlan Barclay] is available which contains all the code you need.
 If you are adding two-factor authentication to an existing site or codebase, start by creating a brand new project and adding the already-prepared NuGet package. This will add all of the necessary code, web pages, references and dependencies. Once you have that working you can go ahead and add the code to your existing codebase.
@@ Line 15: / Line 13: @@
 [[File:Auth2.png|New Project]]
 From this screen you can click “Ok” – and then on the next screen turn off authentication by clicking “Change Authentication” and selecting “No Authentication”:
 [[File:dotnet-2fa-auth3.png|change authentication]]
 [[File:dotnet-2fa-auth4.png|change authentication 2]]
@@ Line 27: / Line 28: @@
 [[File:dotnet-2fa-auth5.png|basic MVC app]]
 ==Adding the NuGet package==
@@ Line 33: / Line 35: @@
   install-package AddTwoFactorToMvc
 ===Files Added by NuGet Package===
@@ Line 251: / Line 259: @@
 enter the verification code shown on your mobile and you have successfully logged in!
-==Risk Factors==
+==Points To Note==
 # Your database user still has '''db_owner''' permission. You need to lower this.
 # You need to encourage your users to use a complex password. You can add a “password strength meter”, using something like [https://github.com/ablanco/jquery.pwstrength.bootstrap JQuery Password Strength Meter], or you can add links to KeePass &amp; LastPass.
 # At no point is any data (password or otherwise) transferred to or from google’s servers. The joy of the authenticator app is that you are (essentially) storing a password on your mobile, and your application knows how to work out if the one-time 30 second code is currently valid. There is no need to transmit the password over the wire.
 # Calling it "two factor authentication" is bad. Why? Most users see that phrase and go “I don’t know what that is, I’m not interested”. Calling it something like [https://www.facebook.com/notes/facebook-engineering/introducing-login-approvals/10150172618258920 Login Approvals] like facebook have is a much friendlier approach, and you will probably see much higher adoption!
@@ Line 265: / Line 270: @@

← Older revision		Revision as of 04:07, 4 March 2016
Line 174:		Line 174:

	For development purposes you can simply comment out the client.send(mail), as you will be able to approve the registered email address manually.		For development purposes you can simply comment out the client.send(mail), as you will be able to approve the registered email address manually.
		+
		+	==Adding the Login Bar==
		+
		+	You will also need to add the “Register / Login / Manage My Account” links to your site:
		+
		+	[[File:dotnet-2fa-auth7.png\|Login Bar]]
		+
		+	these have been bundled into a partial view named:
		+
		+	Views\Shared\LoginPartial.cshtml
		+
		+	which has been added to your project by the NuGet package. You’ll need to add a call to @Html.Partial() to render it, which I suggest putting into your Views\Shared\_Layout.cshtml page:
		+
		+	<body>
		+	...
		+	@Html.Partial("_LoginPartial")
		+	...
		+	</body>
		+
		+	==Testing==
		+
		+	You can now go ahead and test your two factor authentication! Simply register on your site:
		+
		+
		+	[[File:dotnet-2fa-auth8.png\|Registering]]
		+
		+
		+	After you click “Register”, you will need to verify your email. If you are working on a Debug build, you can just click on the link provided which will verify your email automatically:
		+
		+
		+	[[File:dotnet-2fa-auth9.png\|Registering Ok]]
		+
		+
		+	Your email should now be confirmed:
		+
		+
		+	[[File:dotnet-2fa-auth10.png\|Confirming]]
		+
		+
		+	And you can now login:
		+
		+
		+	[[File:dotnet-2fa-auth11.png\|Logging back in]]
		+
		+
		+	voila!
		+
		+
		+	[[File:dotnet-2fa-auth12.png\|Login Bar]]
		+
		+
		+	Now you need to enable two factor authentication, just like an ordinary user would. Click on your user account:
		+
		+
		+	[[File:dotnet-2fa-auth13.png\|Clicking on username]]
		+
		+
		+	and click “Enable” for google’s authenticator:
		+
		+
		+	[[File:dotnet-2fa-auth14.png\|Enabling 2FA on account]]
		+
		+
		+	you will now need to scan the QR code using Google’s Authenticator app, and enter the 6 digits provided:
		+
		+
		+	[[File:dotnet-2fa-auth15.png\|Entering validation code]]
		+
		+
		+	now log out, and log back in again, this time you should see the following:
		+
		+
		+	[[File:dotnet-2fa-auth16.png\|Logging in with 2FA]]
		+
		+
		+	enter the verification code shown on your mobile and you have successfully logged in!

	==Risk Factors==		==Risk Factors==
		+
		+	# Your database user still has '''db_owner''' permission. You need to lower this.
		+	# You need to encourage your users to use a complex password. You can add a “password strength meter”, using something like [https://github.com/ablanco/jquery.pwstrength.bootstrap JQuery Password Strength Meter], or you can add links to KeePass & LastPass.
		+
		+	==Points To Note==
		+
		+	# At no point is any data (password or otherwise) transferred to or from google’s servers. The joy of the authenticator app is that you are (essentially) storing a password on your mobile, and your application knows how to work out if the one-time 30 second code is currently valid. There is no need to transmit the password over the wire.
		+	# Calling it "two factor authentication" is bad. Why? Most users see that phrase and go “I don’t know what that is, I’m not interested”. Calling it something like [https://www.facebook.com/notes/facebook-engineering/introducing-login-approvals/10150172618258920 Login Approvals] like facebook have is a much friendlier approach, and you will probably see much higher adoption!
		+	# Adding functionality that says “you have recently logged in from a new/unknown device, if you don’t recognise it let us know” would be a great extra layer of security. A free system like [http://dev.maxmind.com/geoip/legacy/geolite MaxMind] might be useful, or a paid system like [http://ipinfo.io IpInfo] might help.
		+	# If you are developing an internal enterprise system, training your users on basic security principles is definitely necessary. No sharing of passwords, lock your computer when you leave your desk, don’t plug in random USB sticks, etc etc.
		+	# Protecting yourself from the [https://www.owasp.org/index.php/Top_10_2013-Top_10 top 10 most common security vulnerabilities] will go a long way to making your app more secure. No point in adding 2FA if your site is very easily hacked.
		+
		+

@@ Line 1: / Line 1: @@
-= DRAFT DOCUMENT - WORK IN PROGRESS =
+= Adding two-factor authentication to ASP.NET using Google Authenticator =
 ==Description==
@@ Line 270: / Line 270: @@
-==Risk Factors==
+==Other References==
 [[Category:OWASP .NET Project]]

@@ Line 5: / Line 5: @@
 If you wish to add two factor authentication to your site you can use [http://lachlanbarclay.net Lachlan Barclay's] [https://www.nuget.org/packages/AddTwoFactorToMvc/ NuGet Package] which contains all the code you need.
-This method is uses [http://www.asp.net/identity ASP.NET's Identity] and [https://en.wikipedia.org/wiki/Google_Authenticator Google's "Authenticator"] app. The authenticator app is simple, very widely used (GitHub and Slack, to name two) and works very well.
+This method is uses [http://www.asp.net/identity ASP.NET's Identity] and [https://en.wikipedia.org/wiki/Google_Authenticator Google's "Authenticator"] app. The authenticator app is simple & widely used.
-If you are adding two-factor authentication to an existing site or codebase, I start by creating a brand new project and adding the already-prepared NuGet package. This will add all of the necessary code, web pages, references and dependencies.
+If you are adding two-factor authentication to an existing site or codebase, start by creating a brand new project and adding the already-prepared NuGet package. This will add all of the necessary code, web pages, references and dependencies. Once you have that working you can go ahead and add the code to your existing codebase.
 ==Risk Factors==

← Older revision		Revision as of 03:11, 4 March 2016
Line 2:		Line 2:

	==Description==		==Description==
		+
		+	If you wish to add two factor authentication to your site you can use [http://lachlanbarclay.net Lachlan Barclay's] [https://www.nuget.org/packages/AddTwoFactorToMvc/ NuGet Package] which contains all the code you need.
		+
		+	This method is uses [http://www.asp.net/identity ASP.NET's Identity] and [https://en.wikipedia.org/wiki/Google_Authenticator Google's "Authenticator"] app. The authenticator app is simple, very widely used (GitHub and Slack, to name two) and works very well.
		+
		+	If you are adding two-factor authentication to an existing site or codebase, I start by creating a brand new project and adding the already-prepared NuGet package. This will add all of the necessary code, web pages, references and dependencies.