UFP Identity

Description

UFP Identity is the only dynamic security platform created for e-commerce sites, design agencies and developers that simplifies login authentication.

If there is a token, we support it. UFP Identity supports a wide variety of secure tokens enabling faster, more streamlined access to your websites all the while protecting user accounts from being compromised and preventing spam enrollments to your website.

Our challenge

UFP Identity set out to solve a huge technical challenge: To protect (I mean really, really make private!) online user’s personal info, make the process to access any number of websites at once really easy, and stop bad guys from hacking your stuff.

Our technology platform includes:

• Strongest level of password authentication and encryption!
• Spam protection preventing unwanted user account creation
• Account-compromise protection
• Threat level adjustment to heighten login protection for your users
• Seamless token integration (password, Yubico, OTP, various OATH tokens, one-time codes to phone/email/irc)
• Quicker logins for your users. By the way we’re building a mobile app for that.
• Universal password support for websites that use UFP Identity. This means login credentials can work on multiple websites.
• Real-time monitoring of every login ensures your users are your users
• Reporting tool for website administrators details every login transaction and outcome (coming soon!)
• Multiple tokens to single account
• Multiple accounts to single account

Certificate Signing Request

The Certificate Signing Request requires a private/public key
pair and the private key is encrypted with a secret key. In order to
create a good secret key the plugin attempts to get good random data
from /dev/urandom. If this fails, the plugin makes an attempt to
securely retrieve random data from https://www.random.org

Enrolling users

Activating this plugin by installing the certificate will upload
information about your users to our servers. We only enroll the
username, email and hashed password over a private SSL connection
using 2048 bit keys. We will never use any information about your
users for any purpose other than authentication and verification. We
will never use the email for any purpose other than resetting
credentials or authentication. We will never sell or give up any of
the information about your users.

Telemetry

We send telemetry data to our servers over an SSL connection with 2048 bit keys. This telemetry data only contains data that we
would otherwise get with a successful install of the UFP Identity plugin. The telemetry can be turned off by adding an option
‘identity_telemetry_enabled’ => ‘no’.

Location Information

We make a call to http://freegeoip.net/json/ to get location information for the Certificate Signing Request. This
is to help pre-populate the required fields and minimize the amount of work you need to do. We only do this once, upon install.