Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Want to be more secure? Build two-factor authentication into your webapp

blog.alainmeier.com

Post reply on HN
Print view View original

11–20 of 41 posts

Re: Want to be more secure? Build two-factor authentication into your webapp

#11

Post by jamesmcn »

The trouble with two-factor authentication is that it tends to be a nucleus around which a monoculture of security procedure forms. It is convenient to have a single sign-on that is believed to be beyond reproach, even if that sign on is a bit more obnoxious than the old username + password combo.

Until your two-factor system gets hacked, as happened to RSA: http://bits.blogs.nytimes.com/2011/04/02/the-rsa-hack-how-th...

The more common a security system is, the more attractive a target it is for professional (organized crime) hackers to attack.

Re: Want to be more secure? Build two-factor authentication into your webapp

#12

Post by arunoda »

eldavido wrote: post #10

Two-factor authentication is a good step, a better one is to completely outsource authentication to a third-party single sign-on provider (Google, Facebook, Twitter). It's a little more work upfront than a standard username/password box, but you get out of a ton of annoying hassles by doing this, including email verification, account suspension, enforcing password rotation/complexity, and building two-factor authenti…

No it's not better. If one'e Google Account get hacked. hacker can access all the sites, including yours. SSO offers good UX but not the security.

Re: Want to be more secure? Build two-factor authentication into your webapp

#13

Post by bithive123 »

I think the better advice is to completely decouple your authentication from your web app, and then add two-factor authentication to that.

We use Kerberos/LDAP at work so are able to use CoSign to provide web SSO. I did a quick write-up about a service that I wrote which allows me to use Google Authenticator as an additional factor with CoSign: http://it.isevil.org/blog/2011/11/13/authentication-service-...

Since it's just a Sinatra app, the web service could be used by other things. We also use it with FreeRADIUS so our users can use their second factor on the web and in their VPN client.

Re: Want to be more secure? Build two-factor authentication into your webapp

#14

Post by zobzu »

of course the issue with 2 factors is that:

- you can still social engineer your way out (!) - "oh i lost my phone and the recovery keys" "heres my name address cc number, etc please help!" (ie nothing has been solved)

- its quite annoying to use

- it doesnt solve everything, only weak passwords/brute force

- it locks you out if you lose your phone/token until you get back home to get your recovery keys

- compromising the phone (2nd factor for the general public) allow compromising both passwords and the authenticator

and the issue of passwords managers:

- they're stored everywhere because you need them (incl. your phone)

- you have a single password to decrypt them all

- compromising the phone, once again, give you all passwords, and the authenticator

Re: Want to be more secure? Build two-factor authentication into your webapp

#15

Post by sk5t »

SeoxyS wrote: post #2

Two-factor authentication is by definition more annoying than regular authentication. The solution to security is not to add annoyance for users, who will simply hate your product, or disable two-factor. The solution to security is to come up with better and innovative security solutions. Imagine that you had a "log in with iPhone" button, like the common "log in with Facebook" buttons. It would send down a push noti…

This argument is a tautology -- "make secure security less annoying by developing new less annoying but more secure approaches that will not be a barrier to user adoption and ignoring implementation complexity"... hmmmm.

Re: Want to be more secure? Build two-factor authentication into your webapp

#16

Post by pavel_lishin »

jwbaker wrote: post #9
SeoxyS wrote: post #2

Two-factor authentication is by definition more annoying than regular authentication. The solution to security is not to add annoyance for users, who will simply hate your product, or disable two-factor. The solution to security is to come up with better and innovative security solutions. Imagine that you had a "log in with iPhone" button, like the common "log in with Facebook" buttons. It would send down a push noti…

Oh yeah, that'll be way more convenient. Right up until you need to login when your phone is out of batteries, not in wireless coverage, under water, etc.

"I wish I could log in and check my account balance. If only I hadn't burned one finger, and got a cut on the other!"

Re: Want to be more secure? Build two-factor authentication into your webapp

#17

Post by sporksmith »

arunoda wrote: post #12
eldavido wrote: post #10

Two-factor authentication is a good step, a better one is to completely outsource authentication to a third-party single sign-on provider (Google, Facebook, Twitter). It's a little more work upfront than a standard username/password box, but you get out of a ton of annoying hassles by doing this, including email verification, account suspension, enforcing password rotation/complexity, and building two-factor authenti…

No it's not better. If one'e Google Account get hacked. hacker can access all the sites, including yours. SSO offers good UX but not the security.

Isn't this typically the case anyways? A hacker with access to your email account can just use the password reset mechanism to get a sign-in link to your other web sites.

Re: Want to be more secure? Build two-factor authentication into your webapp

#18

Post by rgregory »

We hope to launch a service precisely to help with this (toofactor.com). It's great to see this additional attention and options in the space.

Google Authenticator is a great service imho, but I find myself moreso pleased with the 'application specific' password feature which allows me to abstract my exposure even further.

Re: Want to be more secure? Build two-factor authentication into your webapp

#20

Post by arunoda »

sporksmith wrote: post #17
arunoda wrote: post #12

Earlier quoted context omitted.

No it's not better. If one'e Google Account get hacked. hacker can access all the sites, including yours. SSO offers good UX but not the security.

Isn't this typically the case anyways? A hacker with access to your email account can just use the password reset mechanism to get a sign-in link to your other web sites.

Yes! It is the typical situation. That's why 2fac auth comes in.
Post reply on HN