Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Authy is joining Twilio

authy.com

Post reply on HN
Print view View original

21–30 of 73 posts

Re: Authy is joining Twilio

#21

Post by feld »

akerl_ wrote: post #15
feld wrote: post #2

What is the reason for all of these 2FA apps? This is completely unnecessary. If you're going to offer 2FA, please offer at least the following: * TOTP * Yubikey * SMS If you want to partner with someone and ram unnecessary apps down our throats, optionally add the following: * Authy * RSA * etc I have places where I want 2FA but I will not install the Authy app, so I go without. Sorry. Let me use TOTP or my Yubikey.

What makes Yubikey part of the "default" set but not Authy or RSA? This seems awfully like "If you're going to offer 2FA, at least offer all the tools I like, before you offer any tools that I don't like". It's also worth noting that Authy's app supports TOTP, last I looked.

Because Yubikey is very reasonably priced and they're very open about their design... and don't require you provide any identifying information to own one.

Re: Authy is joining Twilio

#22

Post by maxerickson »

feld wrote: post #17
danielpal wrote: post #7

Earlier quoted context omitted.

Hi, good question. The reason for the phone number is that we depend on your phone number as part of your identity. Almost all 2-FA systems today use the phone number as a way to send you the code via text/phone call. If you read my blog post: blog.authy.com/twilio you'll see we decided to build our infrastructure on top of the telecom infrastructure because it was ubiquitous. I also understand why some people don't…

This tweet indicates you're using TOTP, slightly modified from Google's implementation: https://twitter.com/authy/status/498244613766139904 @benmcginnes Yes we are RFC 6238 TOTP compatible. Same algorithm as GAuth but 7 digits, 256 bit keys and 10 seconds window. So why do you still need my phone number? There's no network connection or SMS required to generate those TOTP codes. I'm not buying the story that you need…

Authy exists to make 2 factor easier for people implementing it. Some users will want methods other than TOTP, so they support methods other than TOTP.

If they don't have a phone number they can't do all that transparently, which is bad when you are aiming your service at a broad audience.

Re: Authy is joining Twilio

#23

Post by fluidcruft »

feld wrote: post #2

What is the reason for all of these 2FA apps? This is completely unnecessary. If you're going to offer 2FA, please offer at least the following: * TOTP * Yubikey * SMS If you want to partner with someone and ram unnecessary apps down our throats, optionally add the following: * Authy * RSA * etc I have places where I want 2FA but I will not install the Authy app, so I go without. Sorry. Let me use TOTP or my Yubikey.

s/Yubikey/U2F/

(But I will use my Yubikey for U2F)

I also refuse to install Authy. I really, really do not like their creeping, creepy intrusiveness and the profiling it enables. I get the feeling that people don't actually understand Authy beyond "Hey, it backs up my secrets to the cloud. Cool!"

I recently had to renew my Google Authenticator tokens and I was tempted by Authy but the setup/onboarding sent me away screaming. Then I remembered the NEO can handle this (well except for Amazon tokens). Can't wait for U2F NFC to be standardized.

Re: Authy is joining Twilio

#24

Post by [deleted] »

rtpg wrote: post #13
feld wrote: post #2

What is the reason for all of these 2FA apps? This is completely unnecessary. If you're going to offer 2FA, please offer at least the following: * TOTP * Yubikey * SMS If you want to partner with someone and ram unnecessary apps down our throats, optionally add the following: * Authy * RSA * etc I have places where I want 2FA but I will not install the Authy app, so I go without. Sorry. Let me use TOTP or my Yubikey.

You do realise that with authy you're just registering TOTP stuff right? It's not on the same level as what you're mentioning. It's like complaining about having to use Firefox instead of google.com

[deleted]

Re: Authy is joining Twilio

#25

Post by feld »

fluidcruft wrote: post #23
feld wrote: post #2

What is the reason for all of these 2FA apps? This is completely unnecessary. If you're going to offer 2FA, please offer at least the following: * TOTP * Yubikey * SMS If you want to partner with someone and ram unnecessary apps down our throats, optionally add the following: * Authy * RSA * etc I have places where I want 2FA but I will not install the Authy app, so I go without. Sorry. Let me use TOTP or my Yubikey.

s/Yubikey/U2F/ (But I will use my Yubikey for U2F) I also refuse to install Authy. I really, really do not like their creeping, creepy intrusiveness and the profiling it enables. I get the feeling that people don't actually understand Authy beyond "Hey, it backs up my secrets to the cloud. Cool!" I recently had to renew my Google Authenticator tokens and I was tempted by Authy but the setup/onboarding sent me away sc…

This precisely. I commend Authy for trying to make 2FA for a wide audience, but security is not easy. Training users is the correct approach.

Give an option for those who deeply care about their security. If you're going to grab the industry by the balls and capture the attention of major industry players at least stick to your core values and offer an advanced/expert option for those of us who want to stay out of your system but still use 2FA.

Re: Authy is joining Twilio

#26

Post by feld »

asyncwords wrote: post #16
danielpal wrote: post #3

Founder of @Authy here. Happy to answer any questions.

Do you have any plans for a Windows Phone app? The SMS backup works well, but an app would be ideal; it's one of the few things I'm still missing after switching from Android.

It's just TOTP, so if they weren't creating a walled 2FA garden you could use any of the available TOTP apps on Windows Phone, but alas...

Re: Authy is joining Twilio

#27

Post by mmebane »

feld wrote: post #20
rtpg wrote: post #13

Earlier quoted context omitted.

You do realise that with authy you're just registering TOTP stuff right? It's not on the same level as what you're mentioning. It's like complaining about having to use Firefox instead of google.com

Then why do they need an account or my phone number to do TOTP?

Yes, that's definitely unfortunate. I don't remember it being required with older versions of the Authy app. I really hate forced cloud service integration, especially in applications that deal with sensitive material.

Re: Authy is joining Twilio

#28

Post by mmebane »

maxerickson wrote: post #22
feld wrote: post #17

Earlier quoted context omitted.

This tweet indicates you're using TOTP, slightly modified from Google's implementation: https://twitter.com/authy/status/498244613766139904 @benmcginnes Yes we are RFC 6238 TOTP compatible. Same algorithm as GAuth but 7 digits, 256 bit keys and 10 seconds window. So why do you still need my phone number? There's no network connection or SMS required to generate those TOTP codes. I'm not buying the story that you need…

Authy exists to make 2 factor easier for people implementing it. Some users will want methods other than TOTP, so they support methods other than TOTP. If they don't have a phone number they can't do all that transparently, which is bad when you are aiming your service at a broad audience.

Then why not allow users to defer entering a phone number until they try to add a service that actually requires it?

Re: Authy is joining Twilio

#29

Post by mcdoug »

feld wrote: post #17
danielpal wrote: post #7

Earlier quoted context omitted.

Hi, good question. The reason for the phone number is that we depend on your phone number as part of your identity. Almost all 2-FA systems today use the phone number as a way to send you the code via text/phone call. If you read my blog post: blog.authy.com/twilio you'll see we decided to build our infrastructure on top of the telecom infrastructure because it was ubiquitous. I also understand why some people don't…

This tweet indicates you're using TOTP, slightly modified from Google's implementation: https://twitter.com/authy/status/498244613766139904 @benmcginnes Yes we are RFC 6238 TOTP compatible. Same algorithm as GAuth but 7 digits, 256 bit keys and 10 seconds window. So why do you still need my phone number? There's no network connection or SMS required to generate those TOTP codes. I'm not buying the story that you need…

For those interested in how TOTP is implemented, here it is in Python [1] and Ruby [2]. It is really simple and understandable. Oh, and did you know you can secure your SSH connections using TOTP [3]?

This stuff is no more complicated than storing password hashes. Having a nice client app is good, but Google Authenticator is good enough. So instead of using authy and relying on a third party, why not get something like [4] and be done with it?

[1] https://github.com/nathforge/pyotp

[2] https://github.com/mdp/rotp

[3] http://delyan.me/securing-ssh-with-totp/

[4] https://github.com/mtigas/django-twofactor

Re: Authy is joining Twilio

#30

Post by rglullis »

feld wrote: post #17
danielpal wrote: post #7

Earlier quoted context omitted.

Hi, good question. The reason for the phone number is that we depend on your phone number as part of your identity. Almost all 2-FA systems today use the phone number as a way to send you the code via text/phone call. If you read my blog post: blog.authy.com/twilio you'll see we decided to build our infrastructure on top of the telecom infrastructure because it was ubiquitous. I also understand why some people don't…

This tweet indicates you're using TOTP, slightly modified from Google's implementation: https://twitter.com/authy/status/498244613766139904 @benmcginnes Yes we are RFC 6238 TOTP compatible. Same algorithm as GAuth but 7 digits, 256 bit keys and 10 seconds window. So why do you still need my phone number? There's no network connection or SMS required to generate those TOTP codes. I'm not buying the story that you need…

Ok, serious question: how do you manage your tokens? What happens if your device flies out of the window?

A couple of months ago I managed to break the screen of my tablet with 20-30 services I use 2FA (Google Authenticator). I had to spend about 50 bucks just to get a new screen and repair it.

For some of these services I had the token saved on my keepass, but I always felt a little dirty doing that. If there was a way to keep backups of Google Authenticator data, I'd take it in a heartbeat.

Post reply on HN