Thoughts on Twitter's new Two-Factor Authentication • Hacker News Board

Re: Thoughts on Twitter's new Two-Factor Authentication

#11

Post by thezilch » Wed, Aug 07, 2013, 6:38 PM UTC

ramy_d wrote: post #9

dubcanada wrote: post #7

Earlier quoted context omitted.

Maybe they are trying to tell you to stop tweeting about it, put down your phone and enjoy your vacation?

I appreciate the sentiment but let's be real, what problem did they solve exactly?

Twitter? They solved the insecurity and instability in using their previous SMS solution, and they don't hold the key to the second factor of authorization, in the event their systems leak.

Re: Thoughts on Twitter's new Two-Factor Authentication

#12

Post by thezilch » Wed, Aug 07, 2013, 6:40 PM UTC

mpyne wrote: post #3

bpicolo wrote: post #2

Not sure why there are complaints about it only working when the phone is online. Twitter will only work with a phone online anyway.

It's possible to have computer Internet connectivity in an area with no cell phone reception. I go to a place like that about once a year at least, or so.

Once a year? Store your backup S/KEY under your favorite keyring.

Re: Thoughts on Twitter's new Two-Factor Authentication

#13

Post by ChuckMcM » Wed, Aug 07, 2013, 6:44 PM UTC

dmix wrote: post #8

Neither TOTP (Google Authenticator) or Twitter factor in how easy it is to malware/root Android phones these days. I still prefer Yubikey or other opensource cards until the state of mobile security improves (for ex SEAndroid).

This is something I was thinking as well. I've got a Yubikey, and felt like there is a really good use case for a 'trusted' off phone device. I've pitched it a couple of times and the story gets either diverted into the "You can't solve the 'Identity' problem, it's the security equivalent of the halting problem." rat hole or the "Why would anyone care something around in addition to their phone?"

I explain the phone 'rooting' problem and it isn't perceived as a real issue yet (although perhaps it is getting there). In the mean time I have it on my shelf of "things I could build that at least 10 people I know would buy one of." :-)

Re: Thoughts on Twitter's new Two-Factor Authentication

#14

Post by kylelibra » Wed, Aug 07, 2013, 6:52 PM UTC

For anyone who is interested in implementing two-factor authentication, Authy (company behind blog post) is quite easy to use. I recommend it.

Re: Thoughts on Twitter's new Two-Factor Authentication

#15

Post by umsm » Wed, Aug 07, 2013, 6:55 PM UTC

I have a bad feeling that one of these days we will lock ourselves out of our own accounts...

Re: Thoughts on Twitter's new Two-Factor Authentication

#16

Post by icebraining » Wed, Aug 07, 2013, 7:02 PM UTC

dmix wrote: post #8

Neither TOTP (Google Authenticator) or Twitter factor in how easy it is to malware/root Android phones these days. I still prefer Yubikey or other opensource cards until the state of mobile security improves (for ex SEAndroid).

But TOTP != Google Authenticator. The advantage of TOTP is that, as an open standard, it can be implemented by anyone.

For example, here's an hardware token implementing the protocol: https://www.safenet-inc.com/products/data-protection/two-fac...

Re: Thoughts on Twitter's new Two-Factor Authentication

#17

Post by sbarre » Wed, Aug 07, 2013, 7:11 PM UTC

My first experience with the new two-factor auth has been poor.

1. I sign into Twitter with my browser

2. My phone receives a push notification saying that I have a pending auth request.

3. So I click it and load the Twitter iOS app, and I see "You have no login requests" for that account, no matter how much I refresh it (it has been 10 minutes now).

4. Now I can't get into my Twitter account on the browser.

The urge to disable it is certainly strong..

Re: Thoughts on Twitter's new Two-Factor Authentication

#18

Post by WiseWeasel » Wed, Aug 07, 2013, 7:31 PM UTC

sbarre wrote: post #17

My first experience with the new two-factor auth has been poor. 1. I sign into Twitter with my browser 2. My phone receives a push notification saying that I have a pending auth request. 3. So I click it and load the Twitter iOS app, and I see "You have no login requests" for that account, no matter how much I refresh it (it has been 10 minutes now). 4. Now I can't get into my Twitter account on the browser. The urge…

Did you update to version 5.9 of Twitter for iOS, released 8/6, featuring support for login verification? Maybe the notification should mention that requirement.

Re: Thoughts on Twitter's new Two-Factor Authentication

#19

Post by dmayer » Wed, Aug 07, 2013, 8:16 PM UTC

mpyne wrote: post #3

bpicolo wrote: post #2

Not sure why there are complaints about it only working when the phone is online. Twitter will only work with a phone online anyway.

It's possible to have computer Internet connectivity in an area with no cell phone reception. I go to a place like that about once a year at least, or so.

I thought his is one of the reasons they have backup keys which you can use when your phone is not reachable. I haven't actually tested the new system though.

Re: Thoughts on Twitter's new Two-Factor Authentication

#20

Post by InAnEmergency » Wed, Aug 07, 2013, 8:23 PM UTC

bpicolo wrote: post #2

Not sure why there are complaints about it only working when the phone is online. Twitter will only work with a phone online anyway.

Not sure why there are complaints about it only working when the phone is online, since you can generate a backup code offline and use that. Your phone does not need internet access once you have set it up.