Ask HN: Two-factor authentication and other extended security measures
YubiKey is nice, but has an acquisition and processing cost (get hardware from Sweden, reprogram with a new private key, collect postal addresses, send out to customers, deal with customers losing keys). SMS messages can be almost universally sent, but require some third party provider or modem to send worldwide (is there a good third party service to send out a SMS message to any cell phone reliably?)
We don't store e.g. PCI (payment) data or other highly sensitive data where there are some laws requiring additional protection, but still have somewhat sensitive data. If you look at the questionnaire from http://www.sharedassessments.org/ (warning: annoying registration required) how does your security stack up? This may not be something you run into if you do B2C or B2B for small companies, but a large company may have a vendor assessment programme which will require you to go through this. That happened to me and just going through that questionnaire may leave you rather concerned.
Here are my security discussion topics -- while security occasionally comes up as a topic, I think a practical discussion might be useful:
1) What do you do for account security of your web app? There are the obvious issues: XSS, CRSF, sql injection, hashed (bcrypt or similar) passwords. Do you require SSL? Do you train users in understanding MITM attacks and not accepting invalid certificates? Require strong passwords, require password changes? Do you apply different standards to staff users (using SSH or some higher-powered web app login) vs client users?
2) Do you use two-factor authentication? Do you have an open SSH port or restrict SSH access to only certain hosts or even only terminated VPN connections? Do you allow users to restrict their logins only from certain IPs or perhaps use client-side certificates?
3) What do you do with potentially sensitive data of your web app? Disk encryption and other symmetric encryption seems to protect only against the unlikely case of hardware theft; if you're collecting some data you need to access later encryption does not seem useful.
4) How do you sell higher security to your users? Unless your audience is technically savvy or has a good IT department how do you convince them to e.g. buy a hardware token or start using SMS one-time passwords to login? They might ask "So you want me to buy this hardware token, are you saying my data is insecure now without it?"
5) Do you use any other security measures? E.g. mod_audit to try to stop some XSS attacks; tools like snort or tripwire to analyze traffic and server integrity?
6) How do you get to higher security? Following some good checklist? Hire tptacek or a similar well-reputed security company to go over your code and practices? In-house scans with Nessus?