Prevent account sharing
summary
A straightforward experiment enables email-based MFA only for accounts that show suspicious activity and records each session in a login_sessions table (session UID in a cookie) using PaperTrail and custom SQL, visualized in Metabase. MFA is implemented with devise-two-factor and remembered for 30 days; CloudFront headers are logged. Result: logins per user drop and overall signups rise about 27% after rollout, with caveats about organic growth and imperfect detection methods.
AI-written summary · about
chapters (7)
- 0:00Introduction and problem
- 2:17Analyzing solutions for sharing
- 6:16Testing multiactor notification
- 12:35Results and data analysis
- 18:54Implementation details
- 27:18Key takeaways and future plans
- 28:00Q&A session
related talks
20mBuilding a Resilient MFA Framework: Strategies and Best Practices
24mUnraveling the black box: past, present and future of authentication in Rails
46mPasswords are not Enough
31mEnterprise Identity Management on Rails
59mGoing Auth The Rails On A Crazy Train
23mSquash Production Defects Quickly - The Power of Structured Logging in Rails
36mService Oriented Authenication
36mAdventures in Federating Authorization and Authentication with OAuth