81–90 of 99 posts
Is it just copying a totp auth token over bt to the desktop app (which would be most compatible on the backed) or doing something different than totp (hotp or some kind of PK thing)?
Earlier quoted context omitted.
My tokens being sent to an external server that I don't control is a dealbreaker for me, sorry. I get the convenience factor, but my security relies on the absolute secrecy and control of those tokens; I'm not willing to trust those to anyone else. Any company that requires 2FA is likely to have a similar policy; leaking the keys to the kingdom to a third party which is not subject to security audits is going to be a…
Your tokens are only backed-up if you choose to (it's completely optional) and only the encrypted version is backed-up. It's also off by default.
Earlier quoted context omitted.
Hi, we already do. We charge websites, banks and apps to enable two-factor auth on their sites. See https://www.authy.com/developer/pricing .
Ah, I see, thank you. Another question: If for some reason, your company shut down tomorrow morning, what would that mean for users of your app? Would it stop working?
To know if your mac is support before installing the app run this command: system_profiler -detailLevel full SPBluetoothDataType | grep "LMP Version" it should be >= 6
Sure would be nice if they mentioned that anywhere at all.
I've been using authy for months since it handles 2-factor auth for dnsimple. Just saw the update that supports bluetooth come in on the App Store this morning. Congrats to the team on this big release! One thing that's nice about seeing a modern two-factor auth app with a solid business model behind it, is that Google seems to have abondoned their Authenticator app - no releases since 2011, doesn't yet work properly…
> ... Google seems to have abondoned their Authenticator app What exactly would you like improved in Google Authenticator? It's not like it does anything special, it just scans TOTP QR codes and generates TOTP codes, and it does both of those pretty well. I actually like the fact that it has no additional functionality. Everything stays on the device itself and is not sent to Google or saved "to the cloud"[1]. The on…
Earlier quoted context omitted.
Cellphone numbers can very easily be abused to steal money (premium SMS), to steal my identity, to spam me in the middle of the night, to pull me out of the "zone" by calling me/messaging me during work hours, to track my location while roaming and probably a lot more stuff that's not currently apparent to me. Also, my phone number is known to some identity providers I trust. If they sent me an SMS asking me to click…
It is ridiculous to think that your number is private and even moreso to think that someone can steal money with just your cellphone number. Of course you could be phished or tricked by SMS but to expect your number to be private is to expect everyone ever who you give the number to go to extreme to keep it private as well. If you ever gave your number to someone who downloaded an app which has permission to contacts…
Worth noting: The Google Authenticator app lets _anyone_ generate a shared secret seed that can be added to the app (which, afaict, does not communicate with the network at all). I'm confused as to why you'd need a third-party for this. Example of how to generate a seed and share it with an ssh server: https://scottlinux.com/2013/06/02/use-google-authenticator-f...
The Google Authenticator app is great. I recently got (TOTP) 2-factor auth for an IRC bot going with Google Authenticator; took about 5 minutes to code it up and set it up. It doesn't use any sort of 3rd party service, just the application running locally on my phone. TOTP/HOTP is dead simple and, with the open source Google Authenticator app, great for the end user.
e.g. setting up 2-factor with MS with the same email you use for Google will overwrite the Google one unless you rename it.
Worth noting: The Google Authenticator app lets _anyone_ generate a shared secret seed that can be added to the app (which, afaict, does not communicate with the network at all). I'm confused as to why you'd need a third-party for this. Example of how to generate a seed and share it with an ssh server: https://scottlinux.com/2013/06/02/use-google-authenticator-f...
The Google Authenticator app is great. I recently got (TOTP) 2-factor auth for an IRC bot going with Google Authenticator; took about 5 minutes to code it up and set it up. It doesn't use any sort of 3rd party service, just the application running locally on my phone. TOTP/HOTP is dead simple and, with the open source Google Authenticator app, great for the end user.
Earlier quoted context omitted.
The Google Authenticator app is great. I recently got (TOTP) 2-factor auth for an IRC bot going with Google Authenticator; took about 5 minutes to code it up and set it up. It doesn't use any sort of 3rd party service, just the application running locally on my phone. TOTP/HOTP is dead simple and, with the open source Google Authenticator app, great for the end user.
There is one terrible thing which is that adding an account for a different service but with the same email will overwrite any account with the same email without prompting you. e.g. setting up 2-factor with MS with the same email you use for Google will overwrite the Google one unless you rename it.