Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Two Factor Auth List of Websites

twofactorauth.org

Post reply on HN
Print view View original

31–40 of 65 posts

Re: Two Factor Auth List of Websites

#31

Post by smholloway »

jve wrote: post #9

I wonder about those banking sites.. my bank only lists hardware token. However, that internet bank is by default 2FA, because I need a password and code card which I possess and which they give out to every user. Not only for login I need some code from that card but also for each payment via internet bank.

If I'm understanding you correctly you're confused why only the hardware column is checked--is that right? That's, unfortunately, a common complaint. The columns _should_ correspond to only the second factor, with an assumption that username/password (a "knowledge" factor) is likely the first factor.

Some backstory on that decision: the site originally had columns for each 2fa company/product you could use; e.g., Google Authenticator, Authy, etc. Listing all the options was not scalable as the number of options grew, so twofactorauth.org went with a more abstract classification based on the second factor interaction. A few examples where that matters: * If you refuse to use an easily misplaced fob then you might avoid sites that only offer hardware 2fa. * Not everyone can receive SMS, but maybe they can download an app (software) or reuse their hardware token. * Some people prefer a voice call, so they might choose a bank that allows for 2fa-over-voice.

Hope this helps.

Re: Two Factor Auth List of Websites

#33

Post by Moeancurly »

chelmertz wrote: post #22

OT: Just in case webdevs reads this: you might want to markup clickable things as clickable ( ). If you need a datapoint: I'm using Vimium for Chrome.

I agree with your sentiment, but a minor nitpick: [Stop using anchors as buttons!][1]

An anchor would be good here if the clicking the icons also triggered a URL change, but as it stands a button would be semantically most appropriate

[1]: (http://blogs.ancestry.com/techroots/buttons-vs-anchors/)

Re: Two Factor Auth List of Websites

#34

Post by scrollaway »

jdeibele wrote: post #30
DiabloD3 wrote: post #18

2FA is trivial to add. https://www.authy.com/ Just do it.

Thanks for the reference. For end-users, they claim that their app will work on multiple devices whereas Google Authenticator only works on one. That would be a big advantage - I'm worried about losing my phone even with backup codes in my wallet. Worst case situation is that I'm robbed and have to hand over phone and wallet! Also, I'm not aware of Google Authenticator being updated. Which makes me concerned that it'…

Google Authenticator is a TOTP client. TOTP is an open spec.

If you use a different client, you can probably find one that will let you back up codes (I'm sure Authy supports TOTP). Also note that all you need for that backup is a "seed", which is a hash. IIRC Google Authenticator uses SQLite to store its data, I bet it's not hard to get the seeds out and back them up manually.

Re: Two Factor Auth List of Websites

#36

Post by solarkennedy »

scrollaway wrote: post #34
jdeibele wrote: post #30

Earlier quoted context omitted.

Thanks for the reference. For end-users, they claim that their app will work on multiple devices whereas Google Authenticator only works on one. That would be a big advantage - I'm worried about losing my phone even with backup codes in my wallet. Worst case situation is that I'm robbed and have to hand over phone and wallet! Also, I'm not aware of Google Authenticator being updated. Which makes me concerned that it'…

Google Authenticator is a TOTP client. TOTP is an open spec. If you use a different client, you can probably find one that will let you back up codes (I'm sure Authy supports TOTP). Also note that all you need for that backup is a "seed", which is a hash. IIRC Google Authenticator uses SQLite to store its data, I bet it's not hard to get the seeds out and back them up manually.

I wrote a program to extract the seeds out of the sqlite and back into QR codes for easy transfer. You are right it wasn't that hard: https://github.com/solarkennedy/tfa_auth_dump

Re: Two Factor Auth List of Websites

#38

Post by throwanem »

jdeibele wrote: post #30
DiabloD3 wrote: post #18

2FA is trivial to add. https://www.authy.com/ Just do it.

Thanks for the reference. For end-users, they claim that their app will work on multiple devices whereas Google Authenticator only works on one. That would be a big advantage - I'm worried about losing my phone even with backup codes in my wallet. Worst case situation is that I'm robbed and have to hand over phone and wallet! Also, I'm not aware of Google Authenticator being updated. Which makes me concerned that it'…

I replaced Google Authenticator with Authy precisely because Google Authenticator doesn't back up correctly. I've found Authy an excellent replacement, and definitely worth the purchase price. Hope that helps.

Re: Two Factor Auth List of Websites

#39

Post by peterwwillis »

akerro wrote: post #21

It always wondered me why my bank can't offer my 2FA with SMS code, but Steam or Github can?

Why do you want the place that keeps all your money to support an unencrypted, unauthenticated, over-the-air token delivered by an insecure provider over an insecure protocol?
Post reply on HN