December 2022 Summaries

Time-based One-time Password (TOTP) is a secure authentication method that generates a temporary passcode using a shared secret and the current time, making it a robust second factor in multi-factor or two-factor authentication. TOTP can be implemented through hardware tokens, like security fobs, or software tokens, such as mobile authenticator apps like Google Authenticator, which provide a changing code at regular intervals, typically every 30 to 90 seconds. Compared to SMS-based 2FA, TOTP is considered more secure, as it is less susceptible to SIM swapping and man-in-the-middle attacks, and does not require internet connectivity or the collection of personal information like phone numbers. However, it involves the use of shared secrets, which must be stored securely to prevent unauthorized access, and relies on user devices that, if lost or broken, can disrupt authentication. Despite these challenges, TOTP remains popular due to its security advantages over static passwords and its offline usability. Descope offers a simplified integration of TOTP into applications through a drag-and-drop workflow editor, allowing developers to add this authentication method with minimal effort.

Virtual WebAuthn is an open-source tool developed to enable developers to test WebAuthn authentication flows without the need for a browser or an actual authenticator, specifically designed for those working with Go. WebAuthn, a component of the FIDO2 specifications, allows for passwordless authentication by leveraging possession and biometric-based methods, significantly enhancing security and user experience by eliminating the vulnerabilities associated with passwords. With its adoption now covering approximately 95% of global user devices, WebAuthn offers improved interoperability, privacy, and a seamless login experience, benefiting both users and application builders. Recognizing the absence of effective tools for validating WebAuthn flows, Descope created Virtual WebAuthn to assist in testing registration and authentication processes and decided to share it with the community to aid in the integration of FIDO-based authentication solutions. Additionally, Descope encourages developers and product owners to engage with their user community, AuthTown, to learn and collaborate on authentication best practices.

In an interview from the "Meet a Descoper" series, Yael Tauman, a product manager at Descope, discusses her journey from serving in Unit 8200 of the Israeli military to becoming a product manager at Palo Alto Networks and eventually joining Descope. Yael highlights the diverse and dynamic nature of her role, which involves tasks ranging from analytical research to hands-on problem-solving with development teams. She emphasizes the importance of customer interaction, mentorship, and the human aspects of product management. Yael shares her pride in driving critical features for Palo Alto Networks' Cortex XSOAR and enjoys activities like aerobics, yoga, music, and studying psychology and philosophy to unwind. She advises new product managers to embrace learning by doing and to seek mentors who believe in their potential.