Authy: Faster Two-Factor Authentication • Hacker News Board

Re: Authy: Faster Two-Factor Authentication

#91

Post by jcoder » Thu, Aug 01, 2013, 2:47 AM UTC

porges wrote: post #87

jlgreco wrote: post #73

Earlier quoted context omitted.

The Google Authenticator app is great. I recently got (TOTP) 2-factor auth for an IRC bot going with Google Authenticator; took about 5 minutes to code it up and set it up. It doesn't use any sort of 3rd party service, just the application running locally on my phone. TOTP/HOTP is dead simple and, with the open source Google Authenticator app, great for the end user.

There is one terrible thing which is that adding an account for a different service but with the same email will overwrite any account with the same email without prompting you. e.g. setting up 2-factor with MS with the same email you use for Google will overwrite the Google one unless you rename it.

There must be more to it. I have accounts for Google and Dropbox, using the same email, in Google Authenticator.

Re: Authy: Faster Two-Factor Authentication

#92

Post by pbreit » Thu, Aug 01, 2013, 4:07 AM UTC

pilif wrote: post #34

I really don't like giving out my phone number to a small company with no apparent revenue model, no matter what they are saying they are going to do or not do with that number. Sorry for being cynical, but judging from all these services coming and going all over the place, any of the following is going to happen within a year: 1) authy gets bought by $COMPANY. With some likelihood it's not a company I want to have…

Only one of your reasons has to do wih your inability to see a revenue stream.

Re: Authy: Faster Two-Factor Authentication

#93

Post by bonzoesc » Thu, Aug 01, 2013, 4:22 AM UTC

sneak wrote: post #72

Worth noting: The Google Authenticator app lets _anyone_ generate a shared secret seed that can be added to the app (which, afaict, does not communicate with the network at all). I'm confused as to why you'd need a third-party for this. Example of how to generate a seed and share it with an ssh server: https://scottlinux.com/2013/06/02/use-google-authenticator-f...

I'm confused as to why you'd need a third-party for this.

The Authy app is better.

Look at the screenshots at https://itunes.apple.com/us/app/google-authenticator/id38849... . The buttons are ugly, labels are misaligned, and the colors are ghastly.

Re-ordering tokens in the Google Authenticator app is janky as hell too, and the only way you'll know if it's going to work is if the regular view switches to one with subtly different font sizes.

Authy's not without its rough edges, but it never looks that bad.

From down-thread, regarding Google Authenticator: e.g. setting up 2-factor with MS with the same email you use for Google will overwrite the Google one unless you rename it.

Authy does this correctly.

Re: Authy: Faster Two-Factor Authentication

#94

Post by pbreit » Thu, Aug 01, 2013, 4:28 AM UTC

CanSpice wrote: post #64

hillbillyjack wrote: post #57

Earlier quoted context omitted.

It is ridiculous to think that your number is private and even moreso to think that someone can steal money with just your cellphone number. Of course you could be phished or tricked by SMS but to expect your number to be private is to expect everyone ever who you give the number to go to extreme to keep it private as well. If you ever gave your number to someone who downloaded an app which has permission to contacts…

I think it's not so much "stealing money" as it is "I get charged per SMS and those bastards just texted me a dozen times and cost me three bucks."

Do any services charge for receiving SMSs?

Re: Authy: Faster Two-Factor Authentication

#95

Post by kondro » Thu, Aug 01, 2013, 4:36 AM UTC

pilif wrote: post #34

I really don't like giving out my phone number to a small company with no apparent revenue model, no matter what they are saying they are going to do or not do with that number. Sorry for being cynical, but judging from all these services coming and going all over the place, any of the following is going to happen within a year: 1) authy gets bought by $COMPANY. With some likelihood it's not a company I want to have…

This doesn't seem to be a lack of a revenue model to me: https://www.authy.com/developer/pricing

Re: Authy: Faster Two-Factor Authentication

#96

Post by [deleted] » Thu, Aug 01, 2013, 10:30 AM UTC

[deleted]

Re: Authy: Faster Two-Factor Authentication

#97

Post by P3KLb82AhB » Fri, Aug 02, 2013, 2:35 PM UTC

it's not "something you have" if you know the seed to seed it yourself, it's just an obfuscated "something you know".

A real "something you have" in a 2 factor auth. would be a real token that has provisions to wipe itself on detecting it's being opened.

Re: Authy: Faster Two-Factor Authentication

#98

Post by CanSpice » Fri, Aug 02, 2013, 6:06 PM UTC

pbreit wrote: post #94

CanSpice wrote: post #64

Earlier quoted context omitted.

I think it's not so much "stealing money" as it is "I get charged per SMS and those bastards just texted me a dozen times and cost me three bucks."

Do any services charge for receiving SMSs?

I get charged 15 cents for incoming SMSs. I'm with Telus in Canada.

Re: Authy: Faster Two-Factor Authentication

#99

Post by pbreit » Fri, Aug 02, 2013, 9:19 PM UTC

CanSpice wrote: post #98

pbreit wrote: post #94

Earlier quoted context omitted.

Do any services charge for receiving SMSs?

I get charged 15 cents for incoming SMSs. I'm with Telus in Canada.

Holy cow, that's crazy. I guess they're really trying to encourage you to sign up for $6/month messaging plan that includes unlimited receiving.