Live data from Hacker News

Please turn on two-factor authentication

mattcutts.com

71–80 of 262 posts

Re: Please turn on two-factor authentication

#71
Like the second class citizens of the web we are, Nigeria does not have 2 factor authentication.

Ghana, Pakistan, Iran, North Korea, Russia, all have 2 factor authentication. Why not Nigeria? This is just another example why being Nigerian is kinda hard on the internet.

https://accounts.google.com/b/0/SmsAuthConfig

http://oonwoye.com/2011/01/23/life-as-a-second-class-citizen...

Re: Please turn on two-factor authentication

#72
It seems to work well with Firefox and Safari, but I've found that two-factor auth doesn't work well with Chrome if you've set it to clear cached files (not cookies) on exit. For some reason, that setting causes Chrome to lose the 30-day permission, so every time Chrome crashed or I rebooted my machine, I'd have to go through the SMS dance. Doesn't happen with the similar setting in Firefox.

Re: Please turn on two-factor authentication

#73
post #17

Two-factor auth gets old really fast when you have to use public computers in a setting like a college library. I had turned it on for a while, but turned it off when I had 5 minutes to print out a paper that I had emailed myself (yes, I still do that) and was fiddling with my phone to get the damn PIN. Never again.

How much "fiddling" do you have to do to get your PIN? Unlock code or symbol, select authenticator app, read PIN? On top of loading Gmail and entering your user/pass?

The authenticator app might be the game changer for me - in the depths of mordor (aka library), I hardly ever get a cell signal.

Re: Please turn on two-factor authentication

#74
post #33
post #18

Something Google could to do drastically improve the security of their two-factor authentication system is to add the ability to give more granular permissions with the application-specific passwords. I have an application that only needs to send E-Mail through my GMail account (git-send-email), another that only needs to write to one specific GMail label (Android SMS Backup), and Google Chrome surely doesn't need ac…

I didn't think Chrome any longer required an ASP?

I was glad it does when I revoked the password for the chrome install on my old work computer when I changed jobs.

Re: Please turn on two-factor authentication

#75
post #45

Earlier quoted context omitted.

You don't need to enter your phone number to use Google's two factor. You can use their smartphone application to generate codes. If you don't want to do that, the algorithm is free and open-source so you can probably find an alternate implementation that works fine.

Unless I am mistaken, they won't let you do two-factor auth at all unless you put a phone number first.

I don't think they need a phone number if you use the Google Authenticator app on your phone. The pin for that is generated based on an initial random seed and the current date/time, not your cell number.

Re: Please turn on two-factor authentication

#76
post #31

I was worried this would be a major pain when I enabled it, but I have to say, it has been much more painless than I thought it would be. Most of the time, I don't even think about it. Most of my consumption of google mail is through clients on my laptops, iPhone, or iPad. So in that sense, it's not much different from a regular password. The difference is that someone else has a much harder time cracking my account.…

If you've spent your career with RSA SecurIDs hanging from your keys, this isn't much of a hassle. I didn't realize that LastPass and others can use the Google Authenticator.

Re: Please turn on two-factor authentication

#77
post #32

Earlier quoted context omitted.

Yeah, that would be great if the damn wireless printing worked in school. Sometimes you just have to log into a public machine.

You couldn't use a USB key instead?

Sure I could. Not denying that there are other ways to get access to the files I need, just that this has become a part of my workflow that two-factor auth disrupts.

Re: Please turn on two-factor authentication

#78

Earlier quoted context omitted.

You pay for incoming SMS? How does that even work?

It is standard to pay for receiving as well as sending SMS in the US. Everybody knows this is insane.

It's not at all standard on smartphones though. Almost all data plans include at least several hundred texts per month.

Re: Please turn on two-factor authentication

#79
post #37

I've been avoiding doing this, and I'm not certain the reason is valid - I don't want Google to have my mobile phone number. Perhaps I'm being overly cautious, but the fact Google already collects such a huge amount of data on me, coupled with the increasing insistent requests to enable two-factor with my mobile phone number, has made me not do it. I got so sick of being pestered about it that I stopped using Gmail a…

This is the same reason I avoid it. They were insistent about getting my phone number when it was just to verify after a lockout. They've been extremely insistent about it lately regarding 2-factor authentication, which leads me to believe there's a motive here beyond just getting everyone more secure. Until someone can alleviate me of that concern I think I'll have to pass.

Re: Please turn on two-factor authentication

#80

Like the second class citizens of the web we are, Nigeria does not have 2 factor authentication. Ghana, Pakistan, Iran, North Korea, Russia, all have 2 factor authentication. Why not Nigeria? This is just another example why being Nigerian is kinda hard on the internet. https://accounts.google.com/b/0/SmsAuthConfig http://oonwoye.com/2011/01/23/life-as-a-second-class-citizen...

> Why not Nigeria?

Can Nigerians use the Google Authenticator app?

If yes, then the answer is probably high SMS costs.

Post reply on HN