21–30 of 35 posts
For anyone who is interested in implementing two-factor authentication, Authy (company behind blog post) is quite easy to use. I recommend it.
For anyone who is interested in implementing two-factor authentication, Authy (company behind blog post) is quite easy to use. I recommend it.
They suffer from the "click company logo after reading their blog and it takes you to their blog" syndrome.
Puzzling.
The author cites two "flaws":
1. Your phone is offline sometimes.
Twitter has a backup code mechanism that covers this case. They talk about it, right in the post.
2. An attacker can send verification requests that look exactly like yours.
The sole use case for this mechanism is to verify login attempts by the phone's owner in real-time. If a verification request comes in and you're not actually trying to log into Twitter, or if you see more than one, you know you're being attacked.
It's true if you share a login among multiple coworkers then you're vulnerable to being tricked. But that's a bad practice to begin with, and this 2-factor system is still a massive improvement in security even for that scenario.
We want to secure with 2 factor here in our offices, but it involves giving 10 people the app and possibly getting spammed every time someone logs in. I realize they went for this approach rather than have your average user type in numbers but I can't help but feel confused by this move.
My first experience with the new two-factor auth has been poor. 1. I sign into Twitter with my browser 2. My phone receives a push notification saying that I have a pending auth request. 3. So I click it and load the Twitter iOS app, and I see "You have no login requests" for that account, no matter how much I refresh it (it has been 10 minutes now). 4. Now I can't get into my Twitter account on the browser. The urge…
Did you update to version 5.9 of Twitter for iOS, released 8/6, featuring support for login verification? Maybe the notification should mention that requirement.
OTPs are great and all but in the end you keep the damn unhashed secret on all machines that have to accept the OTP.
Neither TOTP (Google Authenticator) or Twitter factor in how easy it is to malware/root Android phones these days. I still prefer Yubikey or other opensource cards until the state of mobile security improves (for ex SEAndroid).
My first experience with the new two-factor auth has been poor. 1. I sign into Twitter with my browser 2. My phone receives a push notification saying that I have a pending auth request. 3. So I click it and load the Twitter iOS app, and I see "You have no login requests" for that account, no matter how much I refresh it (it has been 10 minutes now). 4. Now I can't get into my Twitter account on the browser. The urge…
Earlier quoted context omitted.
Maybe they are trying to tell you to stop tweeting about it, put down your phone and enjoy your vacation?
I don't think they can be, as I don't have a Twitter account. Certainly I would be pissed beyond belief if I tried to login to my bank (assuming they ever pull their heads out of their asses to support 2FA) and couldn't because I don't have cellular service in addition to Internet.
My first experience with the new two-factor auth has been poor. 1. I sign into Twitter with my browser 2. My phone receives a push notification saying that I have a pending auth request. 3. So I click it and load the Twitter iOS app, and I see "You have no login requests" for that account, no matter how much I refresh it (it has been 10 minutes now). 4. Now I can't get into my Twitter account on the browser. The urge…
Did you update to version 5.9 of Twitter for iOS, released 8/6, featuring support for login verification? Maybe the notification should mention that requirement.