This article explains on a conceptual level how Airlock 2FA One-Touch authentication works. It also provides important detail information for correct use and configuration.

• Understand One-Touch authentication in general.
• Understand the interaction between involved components.
• Learn details about prerequisites and limitations of One-Touch.

All following procedures are exemplary and will vary according to your setup or needs.

One-Touch authentication combines excellent usability with high security. It relies on pushing information to the user's smartphone and signing it using cryptographic key material stored in the mobile phone's secure storage.

The user confirms the authentication by opening the Airlock 2FA app from the push notification and then pressing the Approve button. This step may be combined with additional fingerprint scanning, face recognition, or a PIN, depending on the capabilities, and setup of the smartphone and the authenticator app.

Airlock 2FA also supports other types of authentication. Please inform yourself about the authentication capabilities and compare them with respect to your requirements. For further information, see Authentication factors.

• User account exists in IAM.

• The user has Airlock 2FA enabled as a possible authentication method.

• One-Touch is enabled in the Airlock 2FA configuration.

• The user has installed the Airlock 2FA app on the smartphone.

• The user's smartphone is connected to the internet and is able to connect to the Futurae cloud.

The following flow chart shows how One-Touch authentication works in general:

The One-Touch login ID is an additional authentication element of the One-Touch authentication factor. The login ID is a random ID generated during the One-Touch authentication procedure. The ID is shown to the authenticating user both on the application login page and on the Airlock 2FA app screen (see the next screenshot). This allows the user to verify that the push message in the app corresponds with their login session to the application.

This feature is enabled by default.

To enhance the security of the One-Touch authentication, you can extend it with the multi-numbered challenge solution. In this case, the user must not only approve the push message on their Airlock 2FA app but also choose the correct number from the list of numbers shown on the app screen. The correct number is the one corresponding with the number shown on the application login page. See also the next screenshot:

Ensure that the SDK or white-label app supports the multi-numbered challenge feature. The Airlock 2FA app supports the feature as of version 1.4.2 (Android)/1.3.0(iOS). If you work with a custom or white-label app, the Futurae SDK version used must be 3.0 or higher.

Note that the feature requires an advanced Airlock 2FA subscription.

Why use the multi-numbered challenge feature?

The multi-numbered challenge feature helps protect against multi-factor authentication (MFA) fatigue attacks. This is a cyberattack where attackers possessing the victim's login credentials for an application repeatedly trigger authentication notifications to the victim’s second-factor device. The goal is to confuse and annoy the victim into approving at least one notification, thereby granting the attacker access to the victim's application account.

By adding a multi-numbered challenge step to the authentication based on push notifications, the user must actively select a number on the authenticator app. This prevents users from instinctively approving a push notification during an MFA attack.

The multi-numbered challenge feature replaces the login ID authentication element described previously. The login ID allows passive behavior: The user can still authenticate even if they do not check the ID. This is not possible with the multi-numbered challenge feature: Here, the user must select the correct number to complete the authentication successfully. This feature therefore provides a higher level of security.

Multi-numbered challenge-based authentication flow

The following flow chart shows how One-Touch authentication with multi-numbered challenge works. This flow equals the One-Touch authentication flow described earlier in this article, with a few additional steps. These additional steps are green in the flow chart below:

Configuring One-Touch authentication with multi-numbered challenge

The multi-numbered challenge feature is provided by Futurae. If you want to extend the One-Touch authentication with the multi-numbered challenge solution, contact the Airlock staff (order@airlock.com). They will then initiate the corresponding process at Futurae.

Additionally, disable the login ID property (for a description of this property, see further above). Otherwise, the login ID will still be visible in the Airlock 2FA app. On the browser login page, however, only the multi-numbered challenge value is shown. This may confuse the user and impact usability.

0. To disable the login ID property, proceed as follows:
1. The login ID property is a feature of the Airlock 2FA Authentication Step. To disable the property, open the Airlock 2FA Authentication Step plugin dialog.
   For this, go to
   Loginapp >> Applications and Authentication >> <the relevant application> >> Authentication Flow >> Steps
   Navigate to the Airlock 2FA Authentication Step plugin. It depends on the configuration of your authentication flow where to find the Airlock 2FA Authentication Step in the flow.
2. In the Airlock 2FA Authentication Step plugin dialog, disable the Generate One-Touch Login ID property (which is enabled by default).
3. Activate your configuration.
4. You have now disabled the login ID property. The login ID is no longer generated when a user authenticates using One-Touch on the Airlock 2FA app.

• Internal links:
• Airlock 2FA One-Touch login - REST flow example
• This Airlock 2FA factor may also be used for transaction approval (requires an advanced license) and to verify user self-services.