Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Authy: Faster Two-Factor Authentication

authy.com

Post reply on HN
Print view View original

51–60 of 99 posts

Re: Authy: Faster Two-Factor Authentication

#51

Post by pilif »

canthonytucci wrote: post #8
danielpal wrote: post #2

Hi, I'm Daniel, Authy Founder. We've worked almost 18 months on this product, it's surreal to finally see it out. Anyway, you can read more about why we did this here: http://blog.authy.com/thefuture

Quite handsome and useful looking. Good job! Just a quick question, under security it says: >>". Authy Bluetooth will only talk to pre-approved computers and all messages are encrypted." Just wondering if you can speak to what sort of encryption and safeguards you've got going on here. The docs cover how the tokens are created, but not the communication between phone and mac. Seems like an awesome thing but I wouldn'…

I don't know about the internals of Authy, but Bluetooth encrypts by default and so far it has not been shown to be terrible (if you use a sufficiently random key while pairing).

So even if Authy does nothing special to send the data encrypted, BT itself will ensure that it's safe. Minus, of course, some malware that's running and inspecting the application in-memory or just watching the clipboard, but no encryption on earth will help you there.

Re: Authy: Faster Two-Factor Authentication

#52

Post by cyphersanctus »

pilif wrote: post #34

I really don't like giving out my phone number to a small company with no apparent revenue model, no matter what they are saying they are going to do or not do with that number. Sorry for being cynical, but judging from all these services coming and going all over the place, any of the following is going to happen within a year: 1) authy gets bought by $COMPANY. With some likelihood it's not a company I want to have…

They already answered on these comments with regards to their already functioning revenue model. Banks pay them for securing their sites. They're a YC startup. You're on HN and you're afraid of trying out new technologies because they're offered by new startups?

Re: Authy: Faster Two-Factor Authentication

#53

Post by harshreality »

sehrope wrote: post #24
krrrh wrote: post #15

I've been using authy for months since it handles 2-factor auth for dnsimple. Just saw the update that supports bluetooth come in on the App Store this morning. Congrats to the team on this big release! One thing that's nice about seeing a modern two-factor auth app with a solid business model behind it, is that Google seems to have abondoned their Authenticator app - no releases since 2011, doesn't yet work properly…

> ... Google seems to have abondoned their Authenticator app What exactly would you like improved in Google Authenticator? It's not like it does anything special, it just scans TOTP QR codes and generates TOTP codes, and it does both of those pretty well. I actually like the fact that it has no additional functionality. Everything stays on the device itself and is not sent to Google or saved "to the cloud"[1]. The on…

Re-arranging the damned accounts, that's what. It's the highest starred bug on the google code issues page, and they're ignoring it.

Re: Authy: Faster Two-Factor Authentication

#54

Post by pilif »

cyphersanctus wrote: post #52
pilif wrote: post #34

I really don't like giving out my phone number to a small company with no apparent revenue model, no matter what they are saying they are going to do or not do with that number. Sorry for being cynical, but judging from all these services coming and going all over the place, any of the following is going to happen within a year: 1) authy gets bought by $COMPANY. With some likelihood it's not a company I want to have…

They already answered on these comments with regards to their already functioning revenue model. Banks pay them for securing their sites. They're a YC startup. You're on HN and you're afraid of trying out new technologies because they're offered by new startups?

No. I'm not afraid at all. Indeed I have accounts with most of the projects that are being shown off here. Some paid, some just trials. Some I still use, some I don't. However, I'm very cautious with entrusting my phone number or authentication related applications to a startup.

That's all I said. I'm not saying nobody should trust them. I'm not saying they aren't trustworthy in general.

I just said that I don't trust them with my phone number (or gmail HOTP secret for that matter).

Especially in matters of authentication services that require more private information than what's strictly needed leave a bad taste in my mouth.

Re: Authy: Faster Two-Factor Authentication

#55

Post by jamesjyu »

danielpal wrote: post #2

Hi, I'm Daniel, Authy Founder. We've worked almost 18 months on this product, it's surreal to finally see it out. Anyway, you can read more about why we did this here: http://blog.authy.com/thefuture

Congrats Daniel! You guys are working on an important problem.

Re: Authy: Faster Two-Factor Authentication

#56

Post by chimeracoder »

mseebach wrote: post #38
danielpal wrote: post #19

Earlier quoted context omitted.

You can see: http://blog.authy.com/authenticator But in general terms: 1. Authy tokens automatically sync even if you lose, change or upgrade phone. 2. Ability to do encrypted backups of Google Auth tokens. Same as above, they will sync if you lose, change or upgrade phone. 3. Bluetooth: Takes the hassle out of Two-Factor Auth. 4. Automatic time sync: Always makes sure your tokens work no matter what. 5. Key Rotation…

> 1. Authy tokens automatically sync even if you lose, change or upgrade phone. So the tokens are stored on Authy's servers? Doesn't that defeat the purpose of two-factor? How do I (or an attacker) recover my tokens if I loose my phone?

You're correct - there are serious security concerns with Authy's product, which were pointed out on an earlier HN thread: https://news.ycombinator.com/item?id=4916983

Personally, I'd be concerned with trusting my credentials with any company unless all members of the leadership team (yes, including "nontech" people) are incredibly familiar with basic security terminology and practices.

(Note that the founder is unclear when PBKDF2 and AES are being used in the product, which is concerning, because they have very different use cases and should be hard to confuse).

Re: Authy: Faster Two-Factor Authentication

#57

Post by hillbillyjack »

pilif wrote: post #48
grimtrigger wrote: post #46

Earlier quoted context omitted.

Maybe its just me, but I never pick up numbers I don't have in my phone book. I just let them leave a voice mail or assume its not important. Never quite understood the HN fetishism about keeping emails and phone numbers private. I hand them out like candy and haven't felt a price for it.

Cellphone numbers can very easily be abused to steal money (premium SMS), to steal my identity, to spam me in the middle of the night, to pull me out of the "zone" by calling me/messaging me during work hours, to track my location while roaming and probably a lot more stuff that's not currently apparent to me. Also, my phone number is known to some identity providers I trust. If they sent me an SMS asking me to click…

It is ridiculous to think that your number is private and even moreso to think that someone can steal money with just your cellphone number.

Of course you could be phished or tricked by SMS but to expect your number to be private is to expect everyone ever who you give the number to go to extreme to keep it private as well.

If you ever gave your number to someone who downloaded an app which has permission to contacts your number is no longer private (Facebook has taken big advantage of this, I'm sure there are less than reliable apps that took bigger advantage).

Re: Authy: Faster Two-Factor Authentication

#58

Post by Osmium »

nathas wrote: post #47

As a dev I love the idea that there's 3rd party to handle the finer points of my 2-factor auth. As an end user, I don't want to touch your app with a 10ft pole since you're an untrusted/unvetted source holding on to some very important tokens.

As long as they don't hold onto your passwords too, then it's not too bad right? A compromise for the sake of convenience, to be sure, but even in the worst case – if all Authy tokens are compromised – people still shouldn't have access to your accounts.

For me at least (personal use, not company use) that's a worthwhile compromise: I doubt any attacker could get my main password in the time it'd take for me to change it in the unlikely event that Authy be compromised.

Re: Authy: Faster Two-Factor Authentication

#59

Post by brown9-2 »

danielpal wrote: post #2

Hi, I'm Daniel, Authy Founder. We've worked almost 18 months on this product, it's surreal to finally see it out. Anyway, you can read more about why we did this here: http://blog.authy.com/thefuture

You have a typo in this sentence:

We believe that the future of Two-Factor Auth is one were our devices will do the work for us in order to provide us a greater and simpler security.

Re: Authy: Faster Two-Factor Authentication

#60

Post by peterwwillis »

Their API URL gets an "F" rating from Qualys' SSL Server Test, due to insecure cipher suites. https://www.ssllabs.com/ssltest/analyze.html?d=api.authy.com

Specifically, an anonymous unsigned cipher is being allowed, and a victim browser can probably be forced to use it by an attacker. From http://www.ietf.org/rfc/rfc4492.txt:

   Note that the anonymous key exchange algorithm does not provide
   authentication of the server or the client.  Like other anonymous TLS
   key exchanges, it is subject to man-in-the-middle attacks.
   Implementations of this algorithm SHOULD provide authentication by
   other means.
Post reply on HN