What is 2FA(two factor authentication)
Two-factor authentication (also known as 2FA) is a type (subset) of multi-factor authentication. It is a method of confirming a user's claimed identity by utilizing a combination of two different factors: 1) something they know, 2) something they have, or 3) something they are.
A good example of two-factor authentication is the withdrawing of money from a ATM; only the correct combination of a bank card (something that the user possesses) and a PIN (personal identification number, something that the user knows) allows the transaction to be carried out.
Two-step verification or two-step authentication is a method of confirming a user's claimed identity by utilizing something they know (password) and a second factor other than something they have or something they are. An example of a second step is the user repeating back something that was sent to them through an out-of-band mechanism. Or the second step might be a 6 digit number generated by an app that is common to the user and the authentication system.
HYDRO: Etymology - From Ancient Greek (hudor) "water"
Hydro enables new and existing private systems to seamlessly integrate and
leverage the immutable & transparent dynamics of a public blockchain to enhance
application and document security, identity management, transactions, and
artificial intelligence.
In this paper, a case will be made for private systems, such as APIs, to use
the Hydro public blockchain to enhance security through public authentication.
The proposed technology is called “Raindrop” - a transaction performed through
a smart contract that validates private system access publicly, and can
complement existing private authentication methods. The technology is intended
to provide additional security for sensitive financial data that is
increasingly at risk from hacking and breaches.
Initial implementation of the Hydro Raindrop is performed on the Hydrogen API
Platform. This modular set of APIs is available to enterprises and developers
globally to prototype, build, test, and deploy sophisticated financial
technology platforms and products.
The Hydro Raindrop will be made available to the world developer community as
open source software, to allow developers to integrate the Hydro Raindrop with
any REST API.
Hydrogen Raindrop
Built on top of this Hydro public ledger is a blockchain-based authentication
service, called “Raindrop.” This offers a distinct, immutable, globally
viewable layer of security that verifies an access request is coming from an
authorized source.
Private authentication protocols such as OAuth 2.0 offer varying levels of
robustness and usefulness for the spectrum of use cases that exist. There is
little need to compete with or attempt to replace these protocols - Hydro
offers a way to enhance them by incorporating blockchain mechanics as a
component of an authentication procedure. This can add a useful layer of
security to help thwart system breaches and data compromises.
Before examining technical aspects of Raindrop, let’s first take a look at the
problem it is trying to solve.
The State of Financial Security
The rise of the data age has brought with it a rise in vulnerability, and this
is particularly important for financial services. Financial platforms are often
gateways to large quantities of private and sensitive data such as government
ID numbers, account credentials, and transaction histories. Because of how
critically important this data is, unwarranted access is typically met with
catastrophic results.
Industry research firm Trend Micro published a report that found stolen line
items of Personally Identifiable Information (PII) is sold on the Deep Web for
as little as $1, scans of documents like passports are available for as little
as $10, and bank login credentials for as little $200, making the distribution
of stolen data increasingly fragmented and untraceable.
Unfortunately, the existing financial system does not have a spotless track
record when it comes to preventing, diagnosing, and communicating data breaches
with its stakeholders.
➢ According to a recent study by Javelin Strategy & Research - The 2017
Identity Fraud Study - $16 billion was stolen from 15.4 million U.S.
consumers in 2016 due to failures of the financial system to protect
Personally Identifiable Information (PII).
➢ In April 2017, Symantec published its Internet Security Threat Report,
which estimates 1.1 billion pieces of PII were compromised in various
capacities over the course of 2016.
➢ The 2016 Year End Data Breach Quickview by Risk Based Security, found
that 4,149 data breaches occurred in businesses globally in 2016,
exposing over 4.2 billion records.
➢ The 2017 Thales Data Threat Report – Financial Services Edition, a
survey of global IT professionals in professional services, found that
49% of financial services organizations have suffered a security breach
in the past, 78% are spending more to protect themselves, but 73% are
launching new initiatives related to AI, IoT, and cloud technologies
before preparing appropriate security solutions.
Adding a Blockchain Layer
It is clear that the integrity of financial data gateways can be improved.
Let’s examine how an additional layer of security is achieved via Hydro.
The fundamental consensus mechanisms of the Ethereum network ensure
transactional validity because participants collectively process transactions
that are properly signed. This reality leads to decentralization and
immutability, but, more importantly, it provides a vector for mitigating
unauthorized access to a gateway that handles sensitive data.
With Hydro, authentication can be predicated upon transactional operations on
the blockchain. An API, for example, can choose to validate developers and
applications by requiring them to initiate particular transactions, with
particular data payloads, between particular addresses on the blockchain, as a
precondition that kickstarts a standard authentication protocol.
The Hydro Raindrop
Rain contains packets of condensed water ranging from 0.0001 to 0.005
centimeters in diameter. In a typical rainstorm, there are billions of these
packets, each of random size, velocity, and shape. Because of that, one cannot
reliably predict the exact nature of rain. Similarly, every Hydro
authentication transaction is unique and virtually impossible to have occurred
by chance - that is why we call them Raindrops.
Financial services platforms commonly utilize micro-deposit verification to
validate client accounts. The concept is simple: the platform makes small
deposits of random amounts into a user's claimed bank accounts. In order to
prove the user indeed owns said account, he or she must relay the deposit
amounts back to the platform, which are then validated. The only way the user
can know the valid amounts (besides guessing) is by accessing the bank accounts
in question.
Raindrop-based verification with Hydro is analogous. Rather than sending the
user an amount and having it relayed back, we define a transaction and the user
must execute it from a known wallet. The only way the user can conduct a valid
transaction is by accessing the wallet in question.
By using Raindrops, both the system and the accessor can monitor authorization
attempts on an immutable public ledger. This blockchain-based transaction is
decoupled from the basic system operations, occurs on a distributed network,
and depends upon the ownership of private keys. Therefore, it serves as a
useful validation vector.
