Excellent! Unless I'm missing it, it would be nice if there were a way to enforce a policy that members of an organizational team must have two-factor authentication enabled on their accounts.
Two-factor Authentication
31–40 of 94 posts
Re: Two-factor Authentication
#32Cool, I enabled it but had forgotten to download the recovery codes, next time I visited the site it bothered me to download them just in case, nice touch!
Re: Two-factor Authentication
#33Earlier quoted context omitted.
How is twitter's 2fa completely new? I use it and it behaves exactly like Google's does.
Since they don't use TOTP it's not possible to use their two-factor authentication with applications such as Google Authenticator or Authy. What's more, I don't think it even works with third-party Twitter clients (Correct me if I'm wrong), so you have to use Twitter's own apps.
It does indeed work with third-party apps using Google-style "app specific passwords". But I didn't know that it didn't support TOTP since I only use SMS authentication. I can see that as being a lame move, though.
Re: Two-factor Authentication
#34Earlier quoted context omitted.
How is twitter's 2fa completely new? I use it and it behaves exactly like Google's does.
When they rolled it out, it was SMS-only. It still doesn't use TOTP - they've baked something into their mobile app that allows it to function as the second factor, rather than just supporting the same 2FA scheme that everyone else does.
Ah, I wasn't aware they didn't support TOTP; I only ever use sms based 2fa.
Re: Two-factor Authentication
#35Earlier quoted context omitted.
Use Google Voice or some other similar service that'll let you receive SMS via the web.
Wow thanks for that. I have Google voice account for forever and never thought about this. Edit: This also connects every other account to my Google account, so I should only worry the Google account.
Bear in mind that if one login and password lets you get to both the password reset email and your SMS 2nd factor, you've turned two factor auth back into one factor auth. (So, then, turn two factor auth on your Google account...)
Re: Two-factor Authentication
#36Earlier quoted context omitted.
Wow thanks for that. I have Google voice account for forever and never thought about this. Edit: This also connects every other account to my Google account, so I should only worry the Google account.
Bear in mind that if one login and password lets you get to both the password reset email and your SMS 2nd factor, you've turned two factor auth back into one factor auth. (So, then, turn two factor auth on your Google account...)
You are definitely right, but even though other accounts 2nd factor auth can be passed via password reset email, that would require a login to my gmail, but my Google account also has a two factor auth.
Edit: sorry for repeating you, I just show your footnote parentesis
Re: Two-factor Authentication
#37Nice. Wish it integrated with Authy though
I added it to Authy with no issues. The only downside is that they don't have a github icon currently.
Re: Two-factor Authentication
#38I cannot use an Indian fallback SMS number. Wonder, what is behind that.
Re: Two-factor Authentication
#39Does anyone have a good way of storing recovery codes? I currently keep them on paper, in my wallet, but with more and more sites using 2fa I'm having to carry more and more recovery codes around.
Re: Two-factor Authentication
#40The issue I have with third-party token applications like the Duo Security one that the github guys are recommending is that due to the way how TOTP works (shared secret), I'm practically giving away my second factor to whoever produces the app.
Google Authenticator has the advantage that it's Open Source, but I can't really control whether the thing I downloaded in the app store is actually built from the public sources. But at least I can build my own if I have a developer account. Apparently people are having issues with GA on iOS7 though (it tends to forget the keys), so now I'm kinda out of luck.
Authy is both closed source and wants my cell phone number, Duo Security is just closed source.
I know it's crazy inconvenient in the long run, but I'd much rather install a github official authenticator app than to trust a third-party app with the github token.