Two Factor Frenzy

Inspiration

One of this year's National Challenges for the National Day of Civic Hacking, Two Factor Frenzy aims to educate users about multi-factor authentication (MFA). We were tasked with creating tools and resources to show users what MFA is and which websites use it. The challenge description referred us to a website, www.twofactorauth.org, to serve as a guide. This website contains a list of other websites and provides information about whether they offer multi-factor authentication. However, it's essentially only a list -- there was no easy way for users to access the information.

How it works

The first step was to create a way to use the data on the twofactorauth.org website. To this end, we designed and built a public API that can be used to quickly learn about whether a given site uses MFA. The API is live and available at https://young-castle-3686.herokuapp.com

For example, to get information about Gmail and YouTube in JSON format:

Gmail: /api/organization/?search=Gmail.com&format=json
YouTube: /api/organization/?search=YouTube&format=json

Once the API was in place, we decided to expand the data set to include even more information about websites' security. We currently only include information about the encryption they use to protect user data, but more metrics are on the way.

We then turned our attention to making the data more accessible and meaningful for users. We built a browser extension (currently for the Chrome browser) that instantly checks any webpage that a user visits and provides the user with information about whether the site uses MFA and strong encryption.