How to add Two-Factor Authentication to your website with Google Authenticator
1–10 of 18 posts
Re: How to add Two-Factor Authentication to your website with Google Authenticator
#2Wow. This is thorough. Well done!
Re: How to add Two-Factor Authentication to your website with Google Authenticator
#3Note: Duo Security's app (for android) is better. It supports TOTP and lets you rearrange accounts. With more websites adopting TOTP 2-factor, rearranging accounts is a mandatory feature.
Google Authenticator's bug on this issue (android specific) has made no progress. The iOS Google Authenticator app rearranges accounts just fine.
https://code.google.com/p/google-authenticator/issues/detail...
Disclaimer: I don't work for, or have any stake in, Duo Security. None of this implies a preference for Duo's service (I prefer TOTP wherever it makes sense).
Re: How to add Two-Factor Authentication to your website with Google Authenticator
#4Note: Duo Security's app (for android) is better. It supports TOTP and lets you rearrange accounts. With more websites adopting TOTP 2-factor, rearranging accounts is a mandatory feature. Google Authenticator's bug on this issue (android specific) has made no progress. The iOS Google Authenticator app rearranges accounts just fine. https://code.google.com/p/google-authenticator/issues/detail... Disclaimer: I don't wo…
Good to know, thanks. Duo Security's app will work just fine with this tutorial. I just decided to use Google Authenticator because it seemed to be the best known TOTP client implementation.
Re: How to add Two-Factor Authentication to your website with Google Authenticator
#5[deleted]
Re: How to add Two-Factor Authentication to your website with Google Authenticator
#6TFA is great. But it seems like a lot of work doing it that way. Just use Google as a login provider and get all that stuff on top.
Re: How to add Two-Factor Authentication to your website with Google Authenticator
#7Wow. This is thorough. Well done!
What else would you be expecting from joel? :)
Nice work.
Re: How to add Two-Factor Authentication to your website with Google Authenticator
#8TFA is great. But it seems like a lot of work doing it that way. Just use Google as a login provider and get all that stuff on top.
Specifically, if you set things up as in the linked article, no traffic or other information is going to Google (unless you think that the Google Authenticator app is leaking info to Google for whatever reason). Specifically, Google doesn't see how many logins your app gets.
If you're trying to sneak up on a market, or if for some reason you're trying to hide from Google the number of active users you have, you might see this as an advantage.
Re: How to add Two-Factor Authentication to your website with Google Authenticator
#9TFA is great. But it seems like a lot of work doing it that way. Just use Google as a login provider and get all that stuff on top.
Specifically, if you set things up as in the linked article, no traffic or other information is going to Google (unless you think that the Google Authenticator app is leaking info to Google for whatever reason). Specifically, Google doesn't see how many logins your app gets. If you're trying to sneak up on a market, or if for some reason you're trying to hide from Google the number of active users you have, you might…
I might consider it an advantage if Google isn't able to snuff out my user's accounts/access with impunity. I don't understand the technology enough to know whether that is the case, but I wouldn't rely on Google for authentication at this point for this reason.
Re: How to add Two-Factor Authentication to your website with Google Authenticator
#10I wrote some example Ruby code to do the same thing (we use Google Authenticator on the web and for our VPNs via the Perl hooks in FreeRADIUS) if anyone is interested: https://github.com/bithive/example-totp-vault