Well done. I wish more sites would move to using standard OTP protocols. I hate having to carry around and use a separate dongle for each company that provides two factor authentication.
Dropbox Introduces 2-Factor Authentication
11–20 of 78 posts
Re: Dropbox Introduces 2-Factor Authentication
#12Two-Factor authentication sucks. It's too hard for users. Most people will never us it. Dropbox should consider using Rublon (yes, that's my startup): https://rublon.com
7 reasons why you should add Rublon to your website: http://blog.rublon.com/2012/why-add-rublon/
Re: Dropbox Introduces 2-Factor Authentication
#13I'm glad they didn't invent their own mechanism but used standard OTP tokens, so you can just add them to apps like Google Authenticator.
This is very convenient, Google Accounts, Amazon AWS[1], SSH[2], and Dropbox, all from one simple app.
If Google Authenticator allowed to change the order of accounts without removing and readding them, I would have absolutely nothing to complain about.
[1] https://aws.amazon.com/mfa/faqs/
[2] http://askubuntu.com/questions/159727/how-can-i-use-a-passco...
Re: Dropbox Introduces 2-Factor Authentication
#14I don't see any mention of 2-factor auth on the linked page. Maybe they're rolling it out in stages?
Seems like it to me as well, I don't see any options to do 2-factor auth on my settings page either. Maybe it's a pro feature right now?
It's available to all users. But since it's experimental, you have to go here to enable it:
http://www.dropbox.com/try_twofactor
Then it will appear under Security.
Re: Dropbox Introduces 2-Factor Authentication
#15Two-Factor authentication sucks. It's too hard for users. Most people will never us it. Dropbox should consider using Rublon (yes, that's my startup): https://rublon.com 7 reasons why you should add Rublon to your website: http://blog.rublon.com/2012/why-add-rublon/
This is neat but only requires a phone, there's no second factor.
Re: Dropbox Introduces 2-Factor Authentication
#16Two-Factor authentication sucks. It's too hard for users. Most people will never us it. Dropbox should consider using Rublon (yes, that's my startup): https://rublon.com 7 reasons why you should add Rublon to your website: http://blog.rublon.com/2012/why-add-rublon/
How entering 6 digits hard for users?
Re: Dropbox Introduces 2-Factor Authentication
#17Two-Factor authentication sucks. It's too hard for users. Most people will never us it. Dropbox should consider using Rublon (yes, that's my startup): https://rublon.com 7 reasons why you should add Rublon to your website: http://blog.rublon.com/2012/why-add-rublon/
This is neat but only requires a phone, there's no second factor.
Right now the second factor can be the PIN code that you set up for your phone. Soon we'll add an optional intelligent PIN option for the app itself.
Re: Dropbox Introduces 2-Factor Authentication
#18Two-Factor authentication sucks. It's too hard for users. Most people will never us it. Dropbox should consider using Rublon (yes, that's my startup): https://rublon.com 7 reasons why you should add Rublon to your website: http://blog.rublon.com/2012/why-add-rublon/
How entering 6 digits hard for users?
You have to log in with your username and password first and then you have to enter another password (those digits that you're talking about). With Rublon you just scan a Rublon Code and that's it.
Re: Dropbox Introduces 2-Factor Authentication
#19Great, now only if they actually encrypted my files.
Put a truecrypt volume in your DropBox. Why rely on someone else to do the encryption?
Re: Dropbox Introduces 2-Factor Authentication
#20Great, now only if they actually encrypted my files.
Put a truecrypt volume in your DropBox. Why rely on someone else to do the encryption?
If Dropbox were designed to handle sequentially-numbered blobs of encrypted data, changing one file would require your other devices to download only that file (an encrypted blob of roughly the same size).
With a TrueCrypt volume or other encrypted file solution on top of Dropbox, you have to resync the entire multi-GB volume any time a single file in there changes, since to Dropbox it's just one big file. (Another option is to use something like an OS X sparsebundle -- encrypted data banded across many files -- but God help you if you have two computers reading/writing from that sparsebundle at once.)
I've started using SpiderOak and it is quite efficient even though the data is encrypted such that the server admins couldn't see your data even if they wanted too. https://spideroak.com/engineering_matters SpiderOak also offers two-factor auth. (The SpiderOak UI, however, is fairly atrocious.)