Securing your Bubble platform with Smart MFA

Demo of project: Sample App

Fake account detection

We can use this plugin to detect fake accounts during sign-up.

Signup Page Scenario

In this scenario, we'll guide you through the signup process and demonstrate how you can use the CrossClassify plugin to enhance your user experience.

Step 1: Config sign-up page

In the initial step, you'll add and configure the signup page, and then establish a connection to the CrossClassify plugin.

On this page, you need to pass your email and password to the verify page which can used to sign up. To make everything more secure you need to make a hash a password and send it as a params to the verify page:

You can use any plugin you want to hash the password in this example we have used the “Encrypt & Decrypt Text” plugin

Step 2: Create a verification page

In this step, you'll create a verification page to facilitate the exchange of information with the CrossClassify backend (using a POST request followed by a GET request) to GET a decision on whether this account is considered fake or not.
After obtaining a result, proceed to sign up the new user and proceed to the MFA flow, or login page, or any other view depending on your target user journey.

Step 3: Create a verification workflow

Let's structure an example of the verification workflow after receiving the hashed user email and password from the signup page:

Step 4: Pass the user to login

In this scenario, you'll await the decision result before allowing user entry. Thus, if a user encounters a security issue during signup, access can be denied to prevent them from creating an account or accessing their existing one. After all actions, you need to send the user to the login page.
Alternatively, in another scenario, such as the login page, you can proceed without waiting for a decision result.

Account takeover prevention

We can use this plugin to detect account takeovers during login.

Login page scenario

In this scenario, we'll guide you through the login process without waiting to verify the user.

Step 1: Config login page

In the initial step, you'll need to add and configure the login page, and then establish connections with the CrossClassify plugin.

Step 2: Save post decision ID

In this step, it's crucial to save the post ID for future use. By doing so, you can retrieve it whenever necessary, such as during any page load, and use it as a parameter to retrieve the final decision status of the user. Therefore, after successfully logging in to the user on the login page, I ensured to execute this task.

Step 3: Using get decision on page loads

In this step, you have the option to utilise the "get decision" function to retrieve the user's risk level and whether they're blocked. Based on this information, you can determine whether to impose limitations or take any other necessary actions if the user is flagged as suspicious.
For example, in the index page, we sent the user to the block page if the user was suspicious: