A 3 step Authorization System for Small Business to prevent phishing and ransomeware.This system eliminates the need for company emails or websites, focusing on a multi-layered defense strategy for email-first environments.
- Credential Layer (bcrypt)
Implementation: Password hashing using bcrypt with 12 salt rounds. Policy: Enforced 12-character minimum passphrase policy. Protection: Generic error messages to prevent user enumeration. 2. Email MFA Layer (Gmail SMTP)
Service: Gmail SMTP for secure 6-digit OTP delivery via email. Logic: 3-strike lockout policy (is_locked = 1). Expiring 6-digit codes (default 5 minutes). Exponential backoff on failed attempts to mitigate brute-force. 3. Physical Biometric Layer (PyFingerprint)
Hardware Interface: Serial communication (typically /dev/ttyUSB0) for fingerprint sensors. Simulation Mode: Includes a keyboard-based trigger (Type 's') for environments without physical hardware. Role-Based: Mandatory for 'Admin' accounts to prevent unauthorized lateral movement. 4. Audit & Session Management
Audit Logging: Every success, failure, and lockout is logged in a local SQLite audit_logs table. Session Security: Signed JWT tokens for session state management. Rate Limiting: 2-second forced delay on all failed login attempts.
- Prerequisites
Python 3.8+ Gmail account with app password (for email OTP) (Optional) Fingerprint Sensor for hardware verification. 2. Installation
pip install -r auth_app/requirements.txt 3. Configuration (Dual-Source Support)
The app reads configuration from either .streamlit/secrets.toml (Streamlit Secrets, primary) or .env file (fallback). Both config methods are supported.
Option A: Streamlit Secrets (Recommended for Production)
Create .streamlit/secrets.toml at the project root:
GMAIL_USER = "your.gmail@gmail.com" GMAIL_APP_PASSWORD = "your_16_char_app_password" JWT_SECRET = "your_random_secret_key_here" FINGERPRINT_SERIAL_PORT = "/dev/ttyUSB0" OTP_EXPIRY_MINUTES = "5" TWILIO_ACCOUNT_SID = "your_sid_here" TWILIO_AUTH_TOKEN = "your_token_here" TWILIO_VERIFY_SERVICE_SID = "your_service_sid_here" Option B: .env File (Development/Local Override)
Create auth_app/.env for local development (will override secrets if set):
GMAIL_USER=your.gmail@gmail.com GMAIL_APP_PASSWORD=your_16_char_app_password JWT_SECRET=your_random_secret_key_here FINGERPRINT_SERIAL_PORT=/dev/ttyUSB0 OTP_EXPIRY_MINUTES=5 TWILIO_ACCOUNT_SID=your_sid_here TWILIO_AUTH_TOKEN=your_token_here TWILIO_VERIFY_SERVICE_SID=your_service_sid_here Gmail Setup (Required for Email OTP)
Enable 2-Factor Authentication on your Gmail account
Generate an App Password:
Go to Google Account Settings Under "Signing in to Google", click "App passwords" Select "Mail" and "Other (custom name)" Enter "Guardian Auth" as the name Copy the 16-character password Add to .streamlit/secrets.toml or auth_app/.env
Note: If Gmail credentials are missing, the app runs in Mock Mode (OTP logged to console and shown in the sidebar inbox).
This Was A Hackathon Project made by Team "Nexus" *Team Members
- Aishwarya Kumar Singh
- Anupam Kanoongo
- Khushvardhan Johari