2

We have a need to start rolling out two-factor authentication for our customers. I've looked at a bunch of vendors that provide different variations of 2FA, from Authy to Azure MFA to OpenOTP to Auth0. None of them are quite meeting my needs...

What I am after is something that:

  • Is suitable for large numbers of external users who authenticate infrequently --> cost per user is unlikely to be cost effective unless the cost is a few cents per user
  • Can "tack on" to the primary authentication platform rather than trying to provide a full authentication platform with login pages etc. (this would duplicate much of our current platform)
  • Supports multiple options including SMS code, OTP (e.g. Google Authenticator) voice call, push notification
  • Ideally has an SDK allowing us to embed the approval to a push notification into our own app
  • Doesn't require (or allow, for that matter) the user to maintain their own contact details; we want to be the source of truth for contact details, not have two different sources getting out of sync)
  • Doesn't require hardware tokens - not scalable for the number of users in question

OpenOTP looks fully featured but seems excessively complex for what we want - lots of moving parts to deploy and support. We're also more comfortable with Windows if possible but OpenOTP requires Linux.

Authy looks mostly pretty good except that users can update their contact details directly with Authy and we never hear about it, causing data sync issues for us.

Azure MFA looks pretty good but documentation is surprisingly sparse once you get past the basics. I'm finding it difficult to assess a few key areas like user provisioning (appears to be manual)...

The others I've looked at all have their own challenges: cost or cost model, missing features, complexity, etc. There are also numerous vendors that seem to target Enterprise MFA (staff access to internal and SaaS apps) and don't touch on customer MFA.

I'd really appreciate anyone's input into what products are out there that could address our needs in a cost effective way.

  • I've always personally been a fan of Authy. The ability to sync with multiple devices is always appreciated. – Stevoisiak May 14 '17 at 6:20
  • Yeah Authy looked good but as I said, you can change your contact details like mobile # directly with Authy which violates the whole "we are the system of record for contact details" constraint. I've actually left the company I was working at now but I believe they're going to just start with a hand-crafted SMS code solution and wait and watch the market. – ChrisC May 22 '17 at 0:32

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Browse other questions tagged or ask your own question.