Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

How to add Two-Factor Authentication to your website with Google Authenticator

twilio.com

Post reply on HN
Print view View original

11–18 of 18 posts

Re: How to add Two-Factor Authentication to your website with Google Authenticator

#11

Post by jf »

fusiongyro wrote: post #9
philsnow wrote: post #8

Earlier quoted context omitted.

Specifically, if you set things up as in the linked article, no traffic or other information is going to Google (unless you think that the Google Authenticator app is leaking info to Google for whatever reason). Specifically, Google doesn't see how many logins your app gets. If you're trying to sneak up on a market, or if for some reason you're trying to hide from Google the number of active users you have, you might…

I might consider it an advantage if Google isn't able to snuff out my user's accounts/access with impunity. I don't understand the technology enough to know whether that is the case, but I wouldn't rely on Google for authentication at this point for this reason.

TOTP is surprisingly easy to understand and implement. I do my best to explain how it works in the "Understanding TOTP" section of this article. Take a look at that section and let me know if it makes sense.

Re: How to add Two-Factor Authentication to your website with Google Authenticator

#12

Post by stock_toaster »

harshreality wrote: post #3

Note: Duo Security's app (for android) is better. It supports TOTP and lets you rearrange accounts. With more websites adopting TOTP 2-factor, rearranging accounts is a mandatory feature. Google Authenticator's bug on this issue (android specific) has made no progress. The iOS Google Authenticator app rearranges accounts just fine. https://code.google.com/p/google-authenticator/issues/detail... Disclaimer: I don't wo…

On the ios version of GA you have to hit the "legal information" button, before the "edit" button will work and you are able to rename/rearrange things.

No clue why, and you have to do it any time you restart the app (I think it works across backgrounding, but I can't remember). Pretty weird bug.

Re: How to add Two-Factor Authentication to your website with Google Authenticator

#13

Post by fusiongyro »

jf wrote: post #11
fusiongyro wrote: post #9

Earlier quoted context omitted.

I might consider it an advantage if Google isn't able to snuff out my user's accounts/access with impunity. I don't understand the technology enough to know whether that is the case, but I wouldn't rely on Google for authentication at this point for this reason.

TOTP is surprisingly easy to understand and implement. I do my best to explain how it works in the "Understanding TOTP" section of this article. Take a look at that section and let me know if it makes sense.

What's ambiguous about it is whether or not I need a Google account (and whether Google having taken away that account, I can still log into your service). The "Understanding TOTP" section seems to be saying that you don't and they can't, in which case there's nothing to object to.

Re: How to add Two-Factor Authentication to your website with Google Authenticator

#14

Post by jf »

fusiongyro wrote: post #13
jf wrote: post #11

Earlier quoted context omitted.

TOTP is surprisingly easy to understand and implement. I do my best to explain how it works in the "Understanding TOTP" section of this article. Take a look at that section and let me know if it makes sense.

What's ambiguous about it is whether or not I need a Google account (and whether Google having taken away that account, I can still log into your service). The "Understanding TOTP" section seems to be saying that you don't and they can't, in which case there's nothing to object to.

Great feedback, thanks. I've updated the "Adding Google Authenticator" section with a note that should make that less ambiguous.

Re: How to add Two-Factor Authentication to your website with Google Authenticator

#16

Post by Goopplesoft »

I created a service here: https://www.gauthify.com , although its production ready I haven't really announced it anywhere (100% uptime between the servers the last 4 months with heavy testing going on 24x7) . Anyway, it essentially Google Authenticator as a service paired with SMS and Email as alternative authentication methods. Plus it has libraries in python, ruby and PHP.

The best part? Read the docs, you can implement email, sms & Google Authenticator OTP/2FA it in as little as 4 lines of code.

Re: How to add Two-Factor Authentication to your website with Google Authenticator

#18

Post by js4all »

philsnow wrote: post #8
js4all wrote: post #6

TFA is great. But it seems like a lot of work doing it that way. Just use Google as a login provider and get all that stuff on top.

Specifically, if you set things up as in the linked article, no traffic or other information is going to Google (unless you think that the Google Authenticator app is leaking info to Google for whatever reason). Specifically, Google doesn't see how many logins your app gets. If you're trying to sneak up on a market, or if for some reason you're trying to hide from Google the number of active users you have, you might…

That's a valid point, if you don't rely on Webmaster tools and analytics. If you do, they can extract this information anyway.
Post reply on HN