1. Fear and Loathing of 2fa
Igor Bulatenko

2. How they steal your pass
Social engineering
Online-bruteforce
Server compromise
Client compromise

3. How to choose
(Use web.archive.org)
Auth methods
Flexibility
System cover
API (auth + admin)

4. Auth methods Interactive Non-interactive SMS code Token code
Phone call code
App code
Non-interactive
Mobile app push
Phone call confirmation

5. System coverage
*nix
Windows
Databases
Web apps
All others

6. *nix auth
Native 2fa since OpenSSH 6.2 (
Password/keyboard interactive
Force command
Non native support via pam_radius
Bulk actions
Server-level switch

7. Windows Authentication provider Protected methods (local/RDP/winrm/…)
Server-level switch

8. Databases Oracle DB Postgresql Radius auth DB Links
IDE multiple sessions
Bulk actions
User-level switch
Postgresql
pam_auth

9. Auth proxy LDAP/Radius Interactive/non-interactive
Splitter in password

10. Common cases Non android/iOS devices Non smartphone devices
Bulk actions

11. Tokens
RSA SecureID like
HOTP
Yubikey

12. Q&A