11–20 of 31 posts
How is it easier than TOTP, which is an IETF standard, and implemented by Google Authenticator (amongst others)?
It's easier because you only need to tap the app to verify. No need for OTP codes, though OTP is a fallback if your device is offline.
Users are going to essentially ignore ip address. OS, web browser, and location are easy to spoof. If a half competent attacker makes a request, how is the user to know if they should authorize a request.
I understand that using OTP codes can be annoying to some users, but it is MUCH harder for a user to hand that code over to someone in order to login.
What methods are you using to make sure that an authorization comes from an authorized phone?
Earlier quoted context omitted.
It's easier because you only need to tap the app to verify. No need for OTP codes, though OTP is a fallback if your device is offline.
Are you concerned that it is a lot easier to trick users into clicking a button to authorize the login?
From your home website, it looks like you are relying on users deciding if they should authorize a request based on OS, web browser, ip address, and location. Users are going to essentially ignore ip address. OS, web browser, and location are easy to spoof. If a half competent attacker makes a request, how is the user to know if they should authorize a request. I understand that using OTP codes can be annoying to som…
Authorization requests can only be initiated at the back-end by authorized service providers and only for users who have linked their MePIN app with that specific provider. Though of course login verification could be initiated with stolen username/password, which would then alert the user for verification.
Now the added benefit here is that with MePIN the user would immediately know that her username and password is at wrong hands if she receives a login verification request while not actually performing a login.
So obviously the user should not authorize unexpected requests. You would not authorize a login if you are not actually performing a login, etc. Concerned users can additionally set up a personal PIN code in the app.
Lack of good usability is currently hampering 2FA adoption, we are working hard to fix that.
What's with those url changes? After a while about a dozen url anchors is cycled through which effectively kills the "back" functionality. If you go past them, you can't stay on the "main" page because another ones are added.
How is it easier than TOTP, which is an IETF standard, and implemented by Google Authenticator (amongst others)?
It's easier because you only need to tap the app to verify. No need for OTP codes, though OTP is a fallback if your device is offline.
It's pretty easy to implement your own TOTP client if you don't like any of those. Here's a JS reference in 250 lines of code and HTML: https://code.google.com/p/google-authenticator/source/browse...
In MePIN's defense, DuoSecurity also has their own push notification for a single-tap login, so users are willing to trade interoperability for convenience.