Hate to be one of these guys, but the site is totally unreadable on Android Chrome. The left bar covers everything and won't move. Maybe offer a close or collapse button for it?
This is now fixed. Thanks for the kick.
Show HN: The easiest 2-factor auth
21–30 of 31 posts
Re: Show HN: The easiest 2-factor auth
#22What's with those url changes? After a while about a dozen url anchors is cycled through which effectively kills the "back" functionality. If you go past them, you can't stay on the "main" page because another ones are added.
Am I correct to assume that you have logged in? An automated setup creates the user account and other objects you need to get started. I admit that actually posting the forms is not the most elegant solution, but a hack. We did it to let you read the full contents of the MePIN Dev Portal without having to fill in any personal information.
I just clicked on the link posted here, that is https://developer.mepin.com/.
Re: Show HN: The easiest 2-factor auth
#23From your home website, it looks like you are relying on users deciding if they should authorize a request based on OS, web browser, ip address, and location. Users are going to essentially ignore ip address. OS, web browser, and location are easy to spoof. If a half competent attacker makes a request, how is the user to know if they should authorize a request. I understand that using OTP codes can be annoying to som…
First; the user does not have to care about OS, browser, ip address or location. Though those can be shown to a user if the service provider wants. Authorization requests can only be initiated at the back-end by authorized service providers and only for users who have linked their MePIN app with that specific provider. Though of course login verification could be initiated with stolen username/password, which would t…
In this model, all you have to do is time the authorization request appropriately. If an attacker can time their authorization at the same time that the user is logging in, a large number of users are simply going to authorize both requests thinking that it is some sort of glitch.
With the standard OTP model, a user physically can not enter their code for another user.
Re: Show HN: The easiest 2-factor auth
#24Earlier quoted context omitted.
Are you concerned that it is a lot easier to trick users into clicking a button to authorize the login?
Of course user behavior has to be considered. The MePIN app does allow the user to set up a personal PIN code, so an authorization would then require the PIN code and a tap.
A PIN would do nothing to keep a user from being tricked into authorizing an attacker's login.
Re: Show HN: The easiest 2-factor auth
#25Earlier quoted context omitted.
Of course user behavior has to be considered. The MePIN app does allow the user to set up a personal PIN code, so an authorization would then require the PIN code and a tap.
A PIN would do nothing to keep a user from being tricked into authorizing an attacker's login.
Don't want to argue, but yes it would. It would stop the user for a second, giving time to the brain to process for a while what's going on.
Re: Show HN: The easiest 2-factor auth
#26Earlier quoted context omitted.
First; the user does not have to care about OS, browser, ip address or location. Though those can be shown to a user if the service provider wants. Authorization requests can only be initiated at the back-end by authorized service providers and only for users who have linked their MePIN app with that specific provider. Though of course login verification could be initiated with stolen username/password, which would t…
In this model, all you have to do is time the authorization request appropriately. If an attacker can time their authorization at the same time that the user is logging in, a large number of users are simply going to authorize both requests thinking that it is some sort of glitch. With the standard OTP model, a user physically can not enter their code for another user.
Unfortunately there are several cases where users have entered an OTP code for another user. The recent high profile case was with World of Warcraft's OTP.
Re: Show HN: The easiest 2-factor auth
#27While two-factor authentication is a good thing from a security standpoint from service providers, I can't help but worry that it's a worry from an individual's standpoint: It's nothing but serving an IP address+account mobile phone number relationship on a silver tablet. Do we really want that?
Re: Show HN: The easiest 2-factor auth
#28While two-factor authentication is a good thing from a security standpoint from service providers, I can't help but worry that it's a worry from an individual's standpoint: It's nothing but serving an IP address+account mobile phone number relationship on a silver tablet. Do we really want that?
Note that MePIN does not collect or need user's phone number, e-mail address or any other user information. You can use MePIN fully anonymously.
Re: Show HN: The easiest 2-factor auth
#29Earlier quoted context omitted.
A PIN would do nothing to keep a user from being tricked into authorizing an attacker's login.
Don't want to argue, but yes it would. It would stop the user for a second, giving time to the brain to process for a while what's going on.
If a user is willing to press the button, a PIN isn't going to stop them. Your app is decreasing security in favor of usability, which is not something look for when they are looking to implement two factor auth.
I think anyone who would blindly use your proprietary two factor solution that makes it easier for end users to authorize other people to log in would be silly.
Re: Show HN: The easiest 2-factor auth
#30Earlier quoted context omitted.
Don't want to argue, but yes it would. It would stop the user for a second, giving time to the brain to process for a while what's going on.
If a user is willing to press the button, a PIN isn't going to stop them. Your app is decreasing security in favor of usability, which is not something look for when they are looking to implement two factor auth. I think anyone who would blindly use your proprietary two factor solution that makes it easier for end users to authorize other people to log in would be silly.
I can use similar arguments; a user can be tricked to enter an OTP to a phishing site. For that the hacker does not need to time the attack to the same second, so it's much much easier attack for the hacker.
'No 2FA' is the real silly one here. Any 2FA is so much better than no 2FA, and usability has been a big issue so far in 2FA adoption.