I would argue that Namecheap shouldn't be on that list. They send out a 6 digit code and then immediately tell you what number it begins with, reducing the code to effectively 5 digits. Their continued refusal to support RFC 6238 shows they don't take this seriously in my opinion.
Two Factor Auth List of Websites
41–50 of 65 posts
Re: Two Factor Auth List of Websites
#42It's great that this exists. Many typical users are still befuddled by multifactor authentication, and the one thing that helps is practice. Unfortunately, by having all these islands of identity, the frequency of interaction for many of them ends up being low, resulting in users forgetting they enabled MFA and the associated recovery costs.
There have been technologies to try to bridge the identity islands -- social login (which previously created trust issues through OAuth abuse - many resolved, but trust is hard to win back), Mozilla persona and others. But, at the end, the hostility of end user identity is still a problem that needs to be solved in such a way that end users have good authentication choices (no more bad security questions, for example) with good security attributes (low replay, discoverability and guessability, for example) with good usability. Ideally, an end user should be able to choose an identity provider, trust them, and then use that identity provider across multiple services. I know that some companies are working on this, but it still tends to be in islands, rather than an industry group, for example, dedicated to making it work. At this point, a de facto standard may be the best thing.
I've been in meetings with IAM architects at large banks who scoff at social login because they don't want to trust social login security, yet their own end user security is marginal. Some honest conversations need to happen in this space to help move things forward.
Better identity infrastructure for end users will help service providers.
Re: Two Factor Auth List of Websites
#43I wish there was a service like this for IPv6. And I mean proper IPv6, and not the bullshit that for example Digital Ocean is peddling: 16 addresses per server my foot.
Also, proper HTTPS and HTTPS-only support. There are still way too many sites that offer HTTP as a valid option.
Re: Two Factor Auth List of Websites
#44Earlier quoted context omitted.
Google Authenticator is a TOTP client. TOTP is an open spec. If you use a different client, you can probably find one that will let you back up codes (I'm sure Authy supports TOTP). Also note that all you need for that backup is a "seed", which is a hash. IIRC Google Authenticator uses SQLite to store its data, I bet it's not hard to get the seeds out and back them up manually.
I wrote a program to extract the seeds out of the sqlite and back into QR codes for easy transfer. You are right it wasn't that hard: https://github.com/solarkennedy/tfa_auth_dump
Do you need to root your phone in order to extract the sqlite database?
Re: Two Factor Auth List of Websites
#45Earlier quoted context omitted.
Google Authenticator is a TOTP client. TOTP is an open spec. If you use a different client, you can probably find one that will let you back up codes (I'm sure Authy supports TOTP). Also note that all you need for that backup is a "seed", which is a hash. IIRC Google Authenticator uses SQLite to store its data, I bet it's not hard to get the seeds out and back them up manually.
I wrote a program to extract the seeds out of the sqlite and back into QR codes for easy transfer. You are right it wasn't that hard: https://github.com/solarkennedy/tfa_auth_dump
Neat!
Re: Two Factor Auth List of Websites
#46If you use Rails and want to integrate two factor auth into Devise, we built a gem / devise strategy for that: https://github.com/tinfoil/devise-two-factor
Re: Two Factor Auth List of Websites
#47The TOTP stuff will never be widly used. Its just a total pain to work with. SMS is also very suboptimal.
I have more hope for U2F as second factors go. That is at least easy to work with once you have bought the token. I find it a joy to use.
Re: Two Factor Auth List of Websites
#48I would argue that Namecheap shouldn't be on that list. They send out a 6 digit code and then immediately tell you what number it begins with, reducing the code to effectively 5 digits. Their continued refusal to support RFC 6238 shows they don't take this seriously in my opinion.
Does it matter whether it's 6 digits or five? Surely any rate limiting is going to make either effectively impossible to brute force before the code expires and a new one is generated.
Re: Two Factor Auth List of Websites
#49The TOTP stuff will never be widly used. Its just a total pain to work with. SMS is also very suboptimal. I have more hope for U2F as second factors go. That is at least easy to work with once you have bought the token. I find it a joy to use.
> The TOTP stuff will never be widly used. Its just a total pain to work with.
I'm not sure I agree with that.
Generating a code:
makeQRCode();
validateCode($_POST['2facode'])) {
// Login successful
}
}
Re: Two Factor Auth List of Websites
#50It always wondered me why my bank can't offer my 2FA with SMS code, but Steam or Github can?
Banks have rules and regulations to adhere to. You'll notice almost all banks have universally the same additional types of security (like the security image/security phrase) and such. Because those fit within the industry standards.