Duo Security Blog

Senior Windows Software Engineer | Duo Security | Ann Arbor, Michigan (Relocation strongly preferred)

(https://www.duosecurity.com/company/jobs)

Duo Security's hosted two-factor authentication service brings strong, scalable security to organizations of any size. Duo's unique, high-availability architecture provides centralized management, self-service enrollment, and interactive secondary login through an intuitive web interface, eliminating the high costs, complexity, and confusion associated with traditional two-factor systems. Every day, over 1,000 organizations in 80+ countries around the world rely on Duo for their security.

Duo Security is based in Ann Arbor, Michigan, and is a privately held company whose investors include Google Ventures, True Ventures, Resonant Venture Partners, and Radar Partners. Read more about Duo's investors.

About Duo / Co-Founder Bios: https://www.duosecurity.com/company/about

-----------------------------------

Our ideal candidate is an experienced Windows developer. Experience with security products a big plus, as is experience working on B2B and SaaS products.

Job duties:

* Integrate Duo with all things Windows including Active Directory, ADFS, Exchange Server, IIS, and Remote Desktop Services.

* Help us build and deliver cloud-based 2FA services for two-factor authentication as part of a high performance development team.

* Handle field escalations, related to Windows integrations, when fronttline support escalates support…

Here's a few more to add to your list (not all SaaS)...

--ANALYTICS

Snowplow (https://github.com/snowplow/snowplow)

Segment.io (http://segment.io)

--CRM

Close.io (http://close.io),

Streak (http://www.streak.com/)

Base (http://getbase.com)

--SALES

ElasticSales (https://elasticsales.com/)

--CUSTOMER SERVICE

Metaverse Mod Squad (http://metaversemodsquad.com/)

--DATA

Factual (http://www.factual.com/)

--DATABASE

Titan (http://thinkaurelius.com/)

Tinkerpop (http://www.tinkerpop.com/)

Bulbs (http://bulbflow.com)

Datomic (http://datomic.com)

--LOG MONITORING

Logstash (http://logstash.net)

Lumberjack (https://github.com/jordansissel/lumberjack)

Fluentd (http://fluentd.org),

Flume (https://github.com/cloudera/flume)

Kafka (http://sna-projects.com/kafka/)

Scribe (https://github.com/facebook/scribe/)

--ACCOUNTING/INVOICING

Harvest (http://www.getharvest.com/)

Ballpark (http://www.getballpark.com/)

PaySimple (http://paysimple.com/)

AcceptPay (http://acceptpay.com)

FreshBooks (http://www.freshbooks.com/)

FreeAgent (http://www.freeagent.com/)

Blinksale (http://www.blinksale.com/)

--PAYMENTS

Balanced Payements (https://www.balancedpayments.com/)

Dwolla (https://www.dwolla.com/)

-- BANKING

Simple (http://simple.com)

--PHONE/PBX/SMS

Plivo (http://plivo.com/)

Tropo (https://www.tropo.com/)

Twillo (http://www.twilio.com/)

PhoneBooth (http://www.phonebooth.com/)

-- PROJECT MANAGEMENT

Orchestra (http://www.orchestra.com/)

-- RECOMMENDATION…

I'm not affiliated with Dashlane in any manner but I thought I'd chime in with my experience as a user. I used to use LastPass but lost a bit of confidence in them when they asked users to reset their master password [1] when an anomaly was found present in network traffic from one of their DBs. Prior to this I was looking at open source alternatives but the syncing and add-ons for each browser (which made logging in and generating passwords easier offered by Dashlane) really caught my attention. These features aren't unique to Dashlane, I'm sure. New sign-ups reap the benefits of premium features for a month or so, then you could send an invite to a friend and accrue 6 free months of premium service when they sign up (which is what I did) for free. They also offer a public password generator [2] page. They support the major browsers (Safari, Chrome, Firefox). Dashlane also has a "security dashboard" which keeps track of password expiration, reuse, and weak password usage, with a base analysis score that gets presented to you when action on a site is required. If you want something for offline use and that is hardware based, I'd recommend checking out the Mooltipass [3]. I hope this helps.

[1] - https://www.duosecurity.com/blog/breaking-down-the-probable-lastpass-breach
[2] - https://www.dashlane.com/password-generator
[3] - http://www.themooltipass.com/

Lots of options.

* You can buy a hardware token. https://www.duosecurity.com/product/methods/hardware-tokens

* You can have Duo call/text you every time you want to log in.

* You can use some other device you have that runs a mobile OS. I had Duo set up on my wifi-only iPad while I was using a feature phone for a few months a year ago. (I eventually gave up on that and got a smartphone, though.)

* You can buy a used/cheap smartphone, iPod Touch, or similar, install either the Google Authenticator or Duo app, and not use mobile service at all. You just need a bit of wifi to enroll.

* You can write an OATH client as a J2ME MIDlet. When I was using a feature phone, I spent some time figuring out how to compile J2ME apps in 2015, by piecing together ten-year-old tutorials. It works fine; if you want me to dig up details let me know. (Alternatively, someone may have written one already, but I didn't search very hard.)

* You can, technically, run an OATH client on your computer. But at that point, you take responsibility for your two-factor auth being slightly less than two-factor.

Why not read Nate Lawson's blog post? This will be the second time I've recommended it to you. One of the reasons I'm not going into too much depth is, why would I recap all of Nate Lawson? You're doing crypto dev, you should be reading him already.

Your invocation of SJCL is also a bit of a straw-man. SJCL doesn't do straight-up number-theoretic crypto; even the AE cipher modes it offers avoids it. You're doing SRP in Javascript. You also keep calling it "Tom Wu's SJCL". You're saying that because "Tom Wu" is the name on SRP. Tom Wu didn't write SJCL. The SJCL authors, for what it's worth, claim "the best security which is practically available in Javascript", follow by a parenthesis, followed by the word "Unfortunately", followed by more words you should read.

The two factor stuff, by the way? News to me as of this post. Twilio and 2-factor auth is a good idea (note though that I'm biased, as my friend Dug is doing something very similar --- http://www.duosecurity.com).

Google, Paypal, World of Warcraft, Mailchimp, etc. have all implemented user-facing two-factor auth also. It's the easiest way for them to protect against endpoint insecurity when attackers are going after user credentials en masse.

For any other site looking to implement this, check out our open-source web SDKs and service at Duo Security:

http://www.duosecurity.com
https://github.com/duosecurity

At the very least, we highly recommend folks use it to protect their own cloud/datacenter infrastructure, and have made it free to do so (assuming you have 10 or less admins):

http://blog.duosecurity.com/2011/04/ssh-keys-that-call-you-back/

We support callback, SMS, mobile apps for 7 platforms, as well as traditional hardware tokens for online and offline use...