21–30 of 176 posts
Earlier quoted context omitted.
Edited: Authy requires a mobile number and a remote server to store your tokens though.
> Both require your mobile number and for a remote service to store all of your tokens though.. Duo does not, for the record. Download and go.
Earlier quoted context omitted.
Edited: Authy requires a mobile number and a remote server to store your tokens though.
This is not at all true. Both are generating your tokens clientside with no internet connection. Try disabling internet access, it should work. As for the mobile number, I didn't have to type that into Duo Mobile when I installed?
If they had released this two weeks later, iOS 7's auto-update feature would have bricked everyone's accounts. Google Auth 2.0 redefines two-factor auth: something you know + something you DON'T have. Their entire purpose in life is this second part and they completely and absolutely botched it. I can't believe this passed testing at both Google and Apple. There wasn't even a warning in the release notes.
Do you think they would have released it if they knew about it?
Man, someone is going to have a really really bad day tomorrow.
For those looking for Google Authenticator alternatives, I recommend either Duo Mobile from Duo Security or Authy. I ditched Google Authenticator a while ago and haven't missed it one bit -- having a single app manage my two-factor tokens / keys is much more convenient.
Edited: Authy requires a mobile number and a remote server to store your tokens though.
Thankfully, backing up is entirely optional, and turned off by default. While they claim backups are encrypted with PBKDF2 [3], I still would never ever use something that sends my tokens to a remote server, as it'd defeat the purpose of 2FA in the first place.
Still, I can see the use for casual users that care enough to have 2FA, but not that much to worry about tokens being stolen and decrypted from Authy..
Past discussions on HN here [2], [3], [4].
[1] https://www.authy.com/thefuture [2] https://news.ycombinator.com/item?id=6133648 [3] https://news.ycombinator.com/item?id=4916983 [4] https://news.ycombinator.com/item?id=4330050
otpauth://totp/KeyNameHere?secret=SECRECTKEYSTRINGHERE
You can save it in some passworded zip archive somewhere or print it out. If you print them I suggest printing them with QR codes to aid in recovery speed. You can easily generate QR codes by putting the text URLs into a QR code generator. If you just have a QR code, use a general QR code scanning app to extract the string.
Also the new google authenticator version has a %100 repo crash bug when you scan two QR codes in a row on iOS 7 phones.
