Super User is a question and answer site for computer enthusiasts and power users. Join them; it only takes a minute:

Sign up
Here's how it works:
  1. Anybody can ask a question
  2. Anybody can answer
  3. The best answers are voted up and rise to the top

I have a webapp that requires security beyond that of a normal web application. When any user visits the domain name, they are presented with two text fields, a username field, and a password field. If they enter a valid user/pass, they get access to the web application. Standard stuff.

However, I'm looking for additional security beyond this standard setup. Ideally it would be a software solution, but I'm also open for hardware solution as well (hardware=key fobs), or even procedural changes (one time use passwords on a password pad for example).

The webapp is unique in that we know all our users ahead of time, and we create their username and password and give it to them. In this sense, we can be assured that the username and password are "strong".

However, our clients have requested additional security beyond this. Anyone have any ideas on how to add another layer of complexity to the security?

share|improve this question
To everyone voting to close for WebApps. Not every question referring to WebApps needs to be migrated, some questions, like this one, is 100% valid for SuperUser. – BinaryMisfit Oct 11 '10 at 18:04
@Diago - I think you're right that this isn't really WebApps material. But I'm not sure this belongs on SuperUser, either. I think Stack Overflow is probably the best fit, as he's actually building his own web site. – Joel Coehoorn Oct 11 '10 at 19:20
@Joel I am tempted to move it, but not convinced due to the lack of language etc, and since it could potentially be done at server level. – BinaryMisfit Oct 11 '10 at 19:22
up vote 10 down vote accepted

Building on Dan has said, you won't get any additional security by adding complexity. You need to additional factors of authentication. Check out Two-Factor Authentication for a list of various solutions and a general description on the practice. Autentication breaks down into 3 main categories:

  • Have something (keyfob, smartcard, cell phone)
  • Know something (Password, digital certificate (It's just a really long password!))
  • Be someone (Fingerprint, Retina print)

The general consensus is that you need at least two of the former to have reliable security. Duplicates are useless (two passwords are no better than one. Two keyfobs are no better than one). You can phish a password, but a rolling-number keyfob limits the usability. You can knock someone out and steal a fingerprint (yay hollywood movies), but then you can't get their password.

Note, keyfobs need not be another device on the user's keychain, simply a separate device from their computer, and somewhere that their password is never stored. Smartphones usually fit this bill, and if you can develop an application that runs on user's smartphones, you might be able to reduce costs some. It depends on how big of a deployment the company needs.

Also, for the love of whatever deity that you worship do not enforce a maximum password length.

share|improve this answer

Since mobile phones are prevalent in most locations with Internet access these days,
it makes a lot of sense to see a two-factor authentication mechanism which will use the mobile phone as the second point.

Even Google has recently entered that circle.

There are cases when the phone is not reachable or you do not want the customer to wait through the time lag of mobile second factor sequence.
Here is a trick that might already be patented and/or in wide use :-)
I recall seeing in a tech-presentation a scheme that used a one-time code which was sent to the customer ahead of time. When they used the one available to them, the new one was dispatched to their cell-phones -- the previous one would expire when this dispatch happened. It was a very simple and interesting scheme.

It is important to know that two or multi-factor authentications do not reduce the importance of a good password which the user learns to protect better.

As an aside, I have heard of people misplacing their hardware fobs which ticked away the 8 digit authentication sequences while they left their now-not-so-critical passwords out in the open (or in their wallets). So, with the second-factor, people may sometimes feel false safety in the thought that they have spread their proverbial eggs in different baskets.

share|improve this answer
The introduction of seatbelts caused people to drive more recklessly which caused a greater number of accidents... but I would still advocate for them. Luckily the fob by itself is useless, the person who found it would have to know who you are, where you work, what your username is... and they would also have to stumble upon your poorly stored password. All before you report the fob lost. But your point is still valid that people may get sloppier with their passwords. – Jarvin Oct 11 '10 at 17:21
@Dan, I agree with that. Security is a tricky coin. Two factor auth is a useful and important technique. The user must however protect all the 'factors' equally -- least, one becomes a weak-link; as they over-estimate the other. (ps: a fob should be considered mis-placed even when it is left unguarded on the owner's desk). – nik Oct 11 '10 at 19:11

Apart from hardware, most additional security measures amount to just telling the users to have 2 passwords instead of 1. As long as they have a strong password, this adds no value. There are other specific security measures for other purposes. Like for my bank, I first type in my username, and then a picture I selected pops up "proving" to me that I'm at the right website. But this is easily defeated with a illegitimate website that retrieves my picture from the legit website.

Ultimately I don't think there is anything you can do from a software side to add security (apart from the normal procedures like never storing plaintext passwords, using https, etc) better than just forcing a stronger password.

That said, there is plenty you can do to add to the appearance of security. Like some banks do by making your answer a security question as well as typing in your password. There are a couple of ways to add real security using software, like IP filtering, but this is not practical for most web applications.

As you stated there are several hardware solutions like key fobs. If you want to add a real extra layer of security, I believe this is your best option.

share|improve this answer

There is also two-factor authentication where 2nd factor is "TAN table" (transaction authentication number table). Consider it as extremely low-tech variant of digital TAN tokens or equally low-tech variant of using mobile phone as 2nd factor.

It's something like crosswords - you combine 2nd factor code with combo of finding it in a table by horitzontal and vertical challenge numbers. :-) One Croatian bank (Erste & Steiermarkische) uses that, others here use smartcards and tokens authentication (not as 2nd but the ony factor though).

share|improve this answer
Wait a second, Croatian banks do not use PINs with smartcards? – AndrejaKo Oct 11 '10 at 19:35
They do. Sorry for misunderstanding. They don't use combo token + smartcard, but each as separate mechanism. Tokens are mostly used for "civil" banking (for citizens, persons) and smartcards with PINs mostly for businesses. And sometimes opposite and sometimes both. But Erste differs, they use solely TAN table. – Vedran Krivokuća Oct 11 '10 at 19:58

I found PhoneFactor a while back, but it can only be used for customers in a limited number of countries.

share|improve this answer

This sounds like you have business clients that will always connect from behind a business network... a network that is likely to have a static IP. Therefore you could additionally limit username/password combinations to only work when tried from that IP address. It won't stop someone within the company from gaining access, but it would stop a random Joe on the internet who might happen to find a password.

Whatever you do, my usual advice for this situation is don't implement it yourself. Security systems are incredibly easy to implement incorrectly, such that they pass all your tests and you don't even know anything is wrong until six months after you were hacked. Leave this to a company that builds this kind of system as their primary product. In other words: you're in a "buy, not build" situation.

share|improve this answer


Require users to have a camera... and use Ear Biometrics

share|improve this answer

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .