Notes from meeting with Arlene

[Arnav210]

• assess password
• outsource to OIDC (social logins, involves trusting another source to verify an identity) or OAUTH
  • could and should integrate with business sign up
• if it becomes a mobile app, go passwordless and use biometric type things
• need 2FA
• ideally, shouldn't be storing data ourselves but should be encrypting it; however, store in a directory server or something close and should be secured
• have cloud provider turn on security features for route data
• Daily Routine backend cloud
• use ip from browser header to add delay between creating accounts
• make website/app not depend on browser speed because it is slow
• penetration test development
• protect production and testing environment
• protect directory
• think about cross-site scripting and injection
• use the web application firewall
• protect admin accounts, potentially move them to a separate database, definitely need multiple factor authentication
• don't need to worry about the open traffic data
• consider using amazon cognito for data storage
• amazon also has multifactor authentication services, so definitely use them

[Ahaanv19]

For Arlene July meeting, Arlene please look over security tasks

• Go over name change and changes to team as well as the work with Lawrence Berkeley National Laboratory.

• Go over the expansion into the Bay Area and reasoning

• 95% of security tasks done, please checkout 2FA system and the security block.

• App development going well with LBNL. Prototype attached below fully functional. Rio will work through getting it on android and on Google play store, I will take care of Apple Store but prototype is finished and works good.