9-B-7 結局どれが一番なの？あなたのユーザーに最適な二要素認証の方法を考える

6.6K Views

February 09, 23

#twilio #2fa #verify

スライド概要

2023年2月9-10日に開催されたDeveloper Summit 2023で登壇した際に使用したセッション資料です。

Twilio Verifyについては下記のページをご覧ください。
https://www.twilio.com/ja/verify

Daizen Ikehara

@Neri78

スライド一覧

Developer Advocate for Auth0 by Okta

またはPlayer版

埋め込む »CMSなどでJSが使えない場合

ダウンロード

ダウンロード(pdf - 3.23MB)

関連スライド

Phaserで始めるゲーム開発入門

phaser ゲーム

Daizen Ikehara 161.8K

ReBAC入門「関係性」によるアクセス制御とは？

fga openfga authorization authz

Daizen Ikehara 24.6K

WebRTCのAPIでビデオアプリケーションをつくってみるレクチャー＆ハンズオン

twilio video webrtc api

Daizen Ikehara 11.2K

Twilio Programmable Messagingを用いたSMS送信入門

twilio messaging sms api

Daizen Ikehara 10.5K

ASP.NET Core に追加された Minimal API を使って webhook エンドポイントを構築

aspnet asp.net asp.net core minimal api twilio c

Daizen Ikehara 9.1K

OpenAPI Specificationを使ったTwilio APIテスト用モッキングサーバーの構築

twilio openapi prism node node.js

Daizen Ikehara 6.5K

各ページのテキスト

Legal disclaimer This presentation and the accompanying oral presentation contain forward-looking statements. All statements other than statements of historical fact contained in this presentation, including statements as to future results of operations and ﬁnancial position, planned products and services, business strategy and plans, objectives of management for future operations of Twilio Inc. and its subsidiaries (“Twilio” or the “Company”), market size and growth opportunities, competitive position and technological and market trends, are forward-looking statements. In some cases, you can identify forward-looking statements by terms such as “expect,” “plan,” “anticipate,” “intend,” “target,” “project,” “predict,” “potential,” “explore” or “continue” or the negative of these terms or other similar words. Twilio has based these forward-looking statements largely on its current expectations and assumptions and on information available as of the date of this presentation. The Company assumes no obligation to update any forward-looking statements after the date of this presentation, except as required by law. The forward-looking statements contained in this presentation and the accompanying oral presentation are subject to known and unknown risks, uncertainties, assumptions and other factors that may cause actual results or outcomes to be materially diﬀerent from any future results or outcomes expressed or implied by the forward-looking statements. These risks, uncertainties, assumptions and other factors include, but are not limited to, those related to the Company’s business and ﬁnancial performance, the Company’s ability to attract and retain customers, the Company’s ability to develop new products and services and enhance existing products and services, the Company’s ability to respond rapidly to emerging technology trends and adapt to adverse changes in general economic or market conditions, the Company’s ability to comply with modiﬁed or new industry standards, laws and regulations applying to its business, the Company’s ability to execute on its business strategy, the Company’s ability to compete eﬀectively and the Company’s ability to manage growth. Moreover, the Company operates in a very competitive and rapidly changing environment, and new risks may emerge from time to time. It is not possible for the Company to predict all risks, nor can the Company assess the impact of all factors on its business or the extent to which any factor, or combination of factors, may cause actual results or outcomes to diﬀer materially from those contained in any forward-looking statements the Company may make. This presentation also contains estimates and other statistical data made by independent parties and by the Company relating to market size and growth and other industry data. These data involve a number of assumptions and limitations, and you are cautioned not to give undue weight to such estimates. The Company has not independently veriﬁed the statistical and other industry data generated by independent parties and contained in this presentation and, accordingly, it cannot guarantee their accuracy or completeness. In addition, projections, assumptions and estimates of its future performance and the future performance of the markets in which the Company competes are necessarily subject to a high degree of uncertainty and risk due to a variety of factors. These and other factors could cause results or outcomes to diﬀer materially from those expressed in the estimates made by the independent parties and by Twilio. This presentation also includes certain non-GAAP ﬁnancial measures. These non-GAAP ﬁnancial measures are in addition to, and not as a substitute for or superior to measures of ﬁnancial performance prepared in accordance with GAAP. There are a number of limitations related to the use of these non-GAAP ﬁnancial measures versus their nearest GAAP equivalents. For example, other companies may calculate non-GAAP ﬁnancial measures diﬀerently or may use other measures to evaluate their performance, all of which could reduce the usefulness of the Company’s non-GAAP ﬁnancial measures as tools for comparison. The Company has provided a reconciliation of those measures to the most directly comparable GAAP measures, which is available in the appendix. For further information with respect to Twilio, we refer you to our most recent quarterly report on Form 10-Q ﬁled with the SEC. In addition, we are subject to the information and reporting requirements of the Securities Exchange Act of 1934 and, accordingly, ﬁle periodic reports, current reports, proxy statements and other information with the SEC. The ﬁnal prospectus and these periodic reports, current reports, proxy statements and other information are available for review at the SEC’s website at http://www.sec.gov.

Twilioが提供する顧客エンゲージメントプラットフォームソリューションプラットフォーム管理 & ガバナンス Flex Marketing Campaigns Frontline コンタクトセンター Eメールキャンペーンフィールドサービス開発者向けツール SDK サービス (ビルディング・ブロック) 洞察・知見データチャネル API CLI Trsuted ローコード & Activation ノーコードサービス AI/ML 復元力 Debugger アクセスコア・インフラストラクチャ制御各種リソースや Super Network CDP 通信インフラ顧客データインフラプログラム ©2023 TWILIO INC. ALL RIGHTS RESERVED

10.

11.

12.

13.

14.

15.

https://haveibeenpwned.com/

16.

https://haveibeenpwned.com/

17.

「知る要素」「持つ要素」「備える要素」

18.

19.

20.

21.

22.

「電話番号」を利用したワンタイムパスワードの通知多くのユーザーが電話番号を保持している（日本におけるスマートフォンの世帯保有率は88%*）追加のソフトウェアを必要としない電話番号は乗っ取りがむずかしい（SIMハイジャックという手段は存在する） SMSフィッシングの脅威が存在する * スマートフォンの世帯保有率の推移 : https://www.soumu.go.jp/johotsusintokei/whitepaper/ja/r04/html/nf104000.html#n1402020 ©2023 TWILIO INC. ALL RIGHTS RESERVED

https://www.soumu.go.jp/johotsusintokei/whitepaper/ja/r04/html/nf104000.html#n1402020

23.

24.

25.

26.

27.

28.

29.

30.

いれなきゃいけないの？「わずらわしい」

31.

「わずらわしい」をどう超えるか？ ● 導入しないと機能そのもののが使えない、あるいは制限がかかる ⇨ 機能を制限することで入れざるを得ない状態にする ● 導入することでユーザーにメリットがある（推奨する） ⇨ いれるとイイことがある！ ● （理想）無意識に利用している / 利用のハードルが低い ⇨ 意識させないようにするか、そもそも別の方式を選択する ©2023 TWILIO INC. ALL RIGHTS RESERVED

32.

導入することでイイことがある ● ゲームやソーシャルサイトで使われている ○ ファイナルファンタジーXIVにおけるワンタイムパスワードの導入特典 ■ 通常はゲーム内通貨が必要となるテレポ（場所移動）が一箇所無料に ○ Twitchにおける2FAの設定 ■ チャットで利用できる限定のスタンプを提供 ○ Epic Gamesアカウントにおける2FAの設定 ■ エモート（表現）のアンロックとアイテムの付与出典: 「ワンタイムパスワード」のトークンに、各種認証アプリを利用可能に！ https://jp.finalfantasyxiv.com/lodestone/topics/detail/168a78f2b094f6265d2a392a2aec32a3a0794de4 出典: 2段階認証（2FA）の設定 https://help.twitch.tv/s/article/two-factor-authentication?language=ja 出典: Epic Gamesアカウントで2段階認証(2FA)を有効化するとどのような特典がもらえますか？ https://www.epicgames.com/help/ja/epic-games-c5719341124379/epic-c5719350930075/epic-games2-2fa-a5720233583259 ©2023 TWILIO INC. ALL RIGHTS RESERVED

33.

別の方式 - WebAuthn / Passkeysがもたらすパスワードレスな世界 https://webauthn.io/

https://webauthn.io/

34.

https://www.twilio.com/ja/blog/silent-network-authentication-sna-overview-jp

35.

36.

37.

Twilio Verifyが提供する多彩な認証チャンネル SMS Email Voice Push Device 認証認証将来的には.. Silent Network 認証 WhatsApp ユーザー登録＆ログイン用途 WebAuthn (FIDO2) TOTP ログイン用途認証済みのテンプレート詐欺的な SMSトラフィックの検知レート制限認証番号、ショートコード、英数字送信者ID ルーティングの最適化、冗長化、フェールオーバーローカリゼーションモニタリングレポーティンググローバルカスタマーサポート https://www.twilio.com/ja/verify ©2023 TWILIO INC. ALL RIGHTS RESERVED

https://www.twilio.com/ja/verify

38.

複数の認証チャネルを一つのサービスで // 指定の連絡先、チャネルにワンタイムコードを送信 // ワンタイムコードの認証 let verificationRequest = await let verificationResult = await twilio.verify.v2.services(TWILIO_VERIFICATION_SID) twilio.verify.v2.services(TWILIO_VERIFICATION_SID) .verifications .verificationChecks .create({ .create({ to: contact_to, // 認証する電話番号やEmail code: code, channel: channel // 認証チャネル（sms, call, email） verificationSid: sid }); }); // TOTPの認証 let verificationResult = await twilio.verify.v2.services(TWILIO_VERIFICATION_SID) .entities(TestUser.entitiy_sid) .challenges.create({ authPayload: code, factorSid: TestUser.factor_sid }); ©2023 TWILIO INC. ALL RIGHTS RESERVED

39.

https://www.twilio.com/ja/events

40.

9-B-7 結局どれが一番なの？ あなたのユーザーに最適な二要素認証の方法を考える