Facebook introduces Two Factor Authentication • Hacker News Board

Re: Facebook introduces Two Factor Authentication

#21

Post by naner » Thu, May 12, 2011, 8:08 PM UTC

reso wrote: post #16

hammock wrote: post #14

This seems to me like just another backdoor way of being able to build a more robust database of personal information on you. With your mobile number and the numbers of all your friends, in coordination with the cell carriers (or NSA, whichever you prefer) they can tie together data about who you call & how often with your friend activity on Facebook. Google has been doing it too, asking for a "mobile number backup"…

Bullshit conspiracy theories. How can something that is opt-in be an erosion of privacy? By default it is not enabled. Just don't use it and you're fine.

Bullshit conspiracy theories.

Hyperbole would be a more apt description.

How can something that is opt-in be an erosion of privacy?

Quite easily. You can choose to use a service without fully understanding the privacy implications. I don't think we can expect the general public to be infosec and personal rights experts.

Re: Facebook introduces Two Factor Authentication

#22

Post by raylu » Thu, May 12, 2011, 8:28 PM UTC

hammock wrote: post #19

reso wrote: post #17

Earlier quoted context omitted.

Firesheep is solved by enabling HTTPS on Facebook. This was released several months ago: https://www.facebook.com/blog.php?post=486790652130

Well yeah but that slows everything down a lot. This wouldn't slow it down at all.

Could you provide some numbers about this claim?

Re: Facebook introduces Two Factor Authentication

#23

Post by tuebor » Fri, May 13, 2011, 1:37 PM UTC

Google, Paypal, World of Warcraft, Mailchimp, etc. have all implemented user-facing two-factor auth also. It's the easiest way for them to protect against endpoint insecurity when attackers are going after user credentials en masse.

For any other site looking to implement this, check out our open-source web SDKs and service at Duo Security:

http://www.duosecurity.com https://github.com/duosecurity

At the very least, we highly recommend folks use it to protect their own cloud/datacenter infrastructure, and have made it free to do so (assuming you have 10 or less admins):

http://blog.duosecurity.com/2011/04/ssh-keys-that-call-you-b...

We support callback, SMS, mobile apps for 7 platforms, as well as traditional hardware tokens for online and offline use...

Re: Facebook introduces Two Factor Authentication

#24

Post by 2FA » Fri, May 13, 2011, 4:51 PM UTC

It’s great that Facebook is strengthening security by using two-factor authentication. People share so much personal information on Facebook that relying on a single layer of password protection is simply not enough. However, sending a code by SMS text message is not very secure because they are sent in clear text. If the user were to lose their phone or have it stolen, anybody could read that text message and fraudulently authenticate.

More websites need to use two-factor authentication like Facebook is doing, but a more secure and easier-to-use approach is to send an image-based authentication challenge to the user’s phone, like Confident Technologies provides: http://bit.ly/dMNzB5. A grid of pictures is displayed on the user’s smartphone and to authenticate, the user must correctly identify the pictures that fit their pre-chosen, secret categories. Even if someone else had possession of your phone, they wouldn’t be able to authenticate because they wouldn’t know your secret picture categories.