In order to protect data from unauthorized access, Movere utilizes two factor authentication and short-lived tokens that are issued upon logon. The actual authentication and token management is performed by specialized APIs and industry standard providers such as Identity Server. Once the user’s identity is validated, the identity is stored in a token that has a lifespan of 1 day. This means that if a logged on user closes the browser without logging out, opening the browser and navigating to the Movere site will allow access for up to 1 day after the original logon. In addition to using short lived tokens, the user’s identity is protected from impersonation and man-in-the-middle attacks.
In order to ensure that a user’s account has not been compromised, Movere employs several validation techniques. Firstly, it records system-specific information such as IP address, internet browser version, display resolution and several others upon logon. Collectively, they are referred to as the user’s accessing system fingerprint. If the user’s system fingerprint changes, then the user is prompted to enter a new 7-digit code that is sent over SMS or voice call. Secondly, if the user enters the wrong password three (3) times consecutively, their account will be temporarily locked for 30 minutes. This is designed to prevent bots or other types of unauthorized users from brute-forcing their way into Movere.