Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Authy: Faster Two-Factor Authentication

authy.com

Post reply on HN
Print view View original

71–80 of 99 posts

Re: Authy: Faster Two-Factor Authentication

#71

Post by lifeisstillgood »

pilif wrote: post #34

I really don't like giving out my phone number to a small company with no apparent revenue model, no matter what they are saying they are going to do or not do with that number. Sorry for being cynical, but judging from all these services coming and going all over the place, any of the following is going to happen within a year: 1) authy gets bought by $COMPANY. With some likelihood it's not a company I want to have…

This is a fair point - not the flakiness or otherwise of Authy, but giving out a phone number. I hand it out like confetti, it being, well a phone number. But now it is the key to my google account.

It's not hard to pluck SMS out of the air and sooner rather than later that's going to be a new attack.

Great one more thing to worry about.

Re: Authy: Faster Two-Factor Authentication

#72

Post by sneak »

Worth noting: The Google Authenticator app lets _anyone_ generate a shared secret seed that can be added to the app (which, afaict, does not communicate with the network at all).

I'm confused as to why you'd need a third-party for this.

Example of how to generate a seed and share it with an ssh server: https://scottlinux.com/2013/06/02/use-google-authenticator-f...

Re: Authy: Faster Two-Factor Authentication

#73

Post by jlgreco »

sneak wrote: post #72

Worth noting: The Google Authenticator app lets _anyone_ generate a shared secret seed that can be added to the app (which, afaict, does not communicate with the network at all). I'm confused as to why you'd need a third-party for this. Example of how to generate a seed and share it with an ssh server: https://scottlinux.com/2013/06/02/use-google-authenticator-f...

The Google Authenticator app is great. I recently got (TOTP) 2-factor auth for an IRC bot going with Google Authenticator; took about 5 minutes to code it up and set it up. It doesn't use any sort of 3rd party service, just the application running locally on my phone.

TOTP/HOTP is dead simple and, with the open source Google Authenticator app, great for the end user.

Re: Authy: Faster Two-Factor Authentication

#74

Post by cheald »

danielpal wrote: post #19
nodata wrote: post #10

Earlier quoted context omitted.

A lot of us are familiar with two factor authentication with Google Authenticator. Could you give us a run through of the differences between GA and Authy? What are the advantages of Authy over GA? Edit: suggestions - do not ask for cellphone number twice. Sending SMS PIN as a link is a bit weird.

You can see: http://blog.authy.com/authenticator But in general terms: 1. Authy tokens automatically sync even if you lose, change or upgrade phone. 2. Ability to do encrypted backups of Google Auth tokens. Same as above, they will sync if you lose, change or upgrade phone. 3. Bluetooth: Takes the hassle out of Two-Factor Auth. 4. Automatic time sync: Always makes sure your tokens work no matter what. 5. Key Rotation…

My tokens being sent to an external server that I don't control is a dealbreaker for me, sorry.

I get the convenience factor, but my security relies on the absolute secrecy and control of those tokens; I'm not willing to trust those to anyone else. Any company that requires 2FA is likely to have a similar policy; leaking the keys to the kingdom to a third party which is not subject to security audits is going to be a non-starter.

Bluetooth integration is a compelling feature, though.

Re: Authy: Faster Two-Factor Authentication

#75

Post by cheald »

xxdesmus wrote: post #70
porker wrote: post #69

The Android app is over 9MB and can't be moved to the SD card. Too large for me, uninstalled.

You really have problem with 9MB? OK then, might be time to upgrade to a new phone my friend.

HOTP is really simple. My own open-source authenticator app[1] is 70kb.

[1] https://github.com/cheald/FlexAuth

Re: Authy: Faster Two-Factor Authentication

#76

Post by FuzzyDunlop »

sneak wrote: post #72

Worth noting: The Google Authenticator app lets _anyone_ generate a shared secret seed that can be added to the app (which, afaict, does not communicate with the network at all). I'm confused as to why you'd need a third-party for this. Example of how to generate a seed and share it with an ssh server: https://scottlinux.com/2013/06/02/use-google-authenticator-f...

Google Authenticator doesn't see much love on iOS, and anyone using it while testing iOS7 will struggle to actually use it properly.

Re: Authy: Faster Two-Factor Authentication

#77

Post by danielpal »

cheald wrote: post #74
danielpal wrote: post #19

Earlier quoted context omitted.

You can see: http://blog.authy.com/authenticator But in general terms: 1. Authy tokens automatically sync even if you lose, change or upgrade phone. 2. Ability to do encrypted backups of Google Auth tokens. Same as above, they will sync if you lose, change or upgrade phone. 3. Bluetooth: Takes the hassle out of Two-Factor Auth. 4. Automatic time sync: Always makes sure your tokens work no matter what. 5. Key Rotation…

My tokens being sent to an external server that I don't control is a dealbreaker for me, sorry. I get the convenience factor, but my security relies on the absolute secrecy and control of those tokens; I'm not willing to trust those to anyone else. Any company that requires 2FA is likely to have a similar policy; leaking the keys to the kingdom to a third party which is not subject to security audits is going to be a…

Your tokens are only backed-up if you choose to (it's completely optional) and only the encrypted version is backed-up. It's also off by default.

Re: Authy: Faster Two-Factor Authentication

#78

Post by danielpal »

zimbatm wrote: post #44
danielpal wrote: post #2

Hi, I'm Daniel, Authy Founder. We've worked almost 18 months on this product, it's surreal to finally see it out. Anyway, you can read more about why we did this here: http://blog.authy.com/thefuture

Hi Daniel, two questions: 1. What is your business model ? The app looks great and I wouldn't want to see it go away in a couple of months. 2. There is a registration process that ties the app to my phone and there seem to be a recovery process. Does it mean that the secrets are stored on your servers ? If yes, what prevents you or one of your employees to gain access to the secret keys ?

Business Model: We have an API that companies use to add two-factor auth to their sites/infrastructure. We charge for that. see www.authy.com/developer/pricing

2. The recovery process enables your phone. If you decided to enable backups(which is optional) encrypted versions of you accounts are stored in our servers (that's why it called backups). Authy employees can't gain access because only encrypted version is stored, you chose the encryption key and have to remember it.

Re: Authy: Faster Two-Factor Authentication

#79

Post by danielpal »

canthonytucci wrote: post #8
danielpal wrote: post #2

Hi, I'm Daniel, Authy Founder. We've worked almost 18 months on this product, it's surreal to finally see it out. Anyway, you can read more about why we did this here: http://blog.authy.com/thefuture

Quite handsome and useful looking. Good job! Just a quick question, under security it says: >>". Authy Bluetooth will only talk to pre-approved computers and all messages are encrypted." Just wondering if you can speak to what sort of encryption and safeguards you've got going on here. The docs cover how the tokens are created, but not the communication between phone and mac. Seems like an awesome thing but I wouldn'…

We use Elliptic Diffie Hellman when you are pairing your iPhone to your Mac. The key is stored on both iPhone and Mac KeyChains. Every message between them is encrypted/signed using that key.

Re: Authy: Faster Two-Factor Authentication

#80

Post by danielpal »

patio11 wrote: post #67
andreros wrote: post #11

Assuming an attacker has complete control over your computer, and your phone is within bluetooth range, can he make the phone generate a token without user interaction? I was assuming the user would have to click a button on the phone or something, but I couldn't see it in the video.

Assuming the attacker has complete control over your computer... ... the end user just lost, absent substantially more defense-in-depth on the provider side than just using TFA. TFA mostly helps you against "We lost credentials or a low-privilege session, let's prevent that from escalating to a high-privilege session." If your device is rooted, you'll eventually cough up a high-privilege session, either by passive mo…

Yeah exactly, if the attacker has complete control over the computer, the least of your worries is Bluetooth.

He can steal your cookies, keylog your password/token, poison your dns and compromise your SSL Keys or simply steal a session.

Post reply on HN