2FA via whatsapp | Voters | Citrus-Lime Ltd

2FA via whatsapp

Richard T

Using 2FA via whatsapp would greatly reduce the cost for CitrusLiome and its customers, this would be a great option to save costs all round and future proof citruslime e.g. whatsapp customers instead of SMS

2 days ago

Neil McQuillan - CEO Citrus-Lime

We've got it all working but we are stuck in Apples approval processes for Tap2Pay authorisation once that is sorted it will be available in the app store.

Good luck with the AuthApp role out, it shows what a bubble I live in, I'd not considered that anyone wouldn't have an auth app on their phones - I have 33 websites/auth providers registered in mine!

Richard T

Neil McQuillan - CEO Citrus-Lime Thanks, i think the problem is, the CitrusLime 2FA pages really highlight the SMS option e.g. this page with the send SMS in blue and the authenticator app seems like an after thought in small light grey italic text that no-one reads! this lovely ai generated image (sorry!) could make it clearer to the users that there's 2 options

Neil McQuillan - CEO Citrus-Lime

From a security point of view message based 2FA codes are not ideal, its not as secure as Auth Apps like Google Authenticator. As such I'm not sure we'd want to scale out the blast radius here. I like WhatsApp but you can login it from PC's so its far more risky in terms of malware infections to steal 2FA codes. 
One option we are considering is adding 2FA push notifications to our upcoming iPhone App for POS, mind you, you do need to use 2FA itself on first login on this app, so you need a backup route. 
Out of interest why do you prefer SMS over the auth app route, I find that faster, far more reliable and it removes any cost element entirely.

Richard T

Neil McQuillan - CEO Citrus-Lime we are slowly migrating to the app, its not mentioned anywhere the customer takes the cost of the 2fa sms, so wasn't as much of a rush as it is now. thanks

Neil McQuillan - CEO Citrus-Lime

Richard T: Yes I sadly don't think we gave it enough thought when we implemented on the cost side but from a security POV of SMS is now deemed fairly weak for 2FA due to the possibility of them say being redirected to other devices removing the certainty of 'thing that I know and thing that I have' which is best practice for 2FA.

We'll keep everyone posted on the app side if we can implement that as push 2FA is lovely and saves copying codes. I use it with Github and its a really nice flow.

Richard T

Neil McQuillan - CEO Citrus-Lime thanks, we can't enforce everyone to install the app on their phones and rolling out 150+ iphones is probably out of the question, (why not android as well, looks like about 50/50 in uk and 60/40 US and 35/65 in EU), so we'll be sticking with migrating to auth app based instead.

Neil McQuillan - CEO Citrus-Lime

Richard T: If the IOS app is a success we'd look at Android as well :-)

Just wanted to pick one to try first, see if usage was good. It provides Dashboards, Tap2Pay and C&C notifications. We're considering adding 2FA and scanning items to get prices.

Richard T

Neil McQuillan - CEO Citrus-Lime tap2pay on iphones is pretty impressive i agree, avoids 3rd party devices and apps etc.!

Photo Viewer