Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Two-factor Authentication

github.com

Post reply on HN
Print view View original

41–50 of 94 posts

Re: Two-factor Authentication

#41

Post by maratd »

eric59 wrote: post #39

Does anyone have a good way of storing recovery codes? I currently keep them on paper, in my wallet, but with more and more sites using 2fa I'm having to carry more and more recovery codes around.

Screenshot all QR codes and store them in Dropbox, which also has 2-factor authentication. Store recovery code for Dropbox in Google Docs, which also has 2-factor authentication.

So for me to be totally screwed, I would have to lose my phone and have my logins expire on both Dropbox and Google.

Hasn't happened yet =)

Re: Two-factor Authentication

#42

Post by bdarnell »

movingahead wrote: post #38

I cannot use an Indian fallback SMS number. Wonder, what is behind that.

India has a strictly-enforced national do-not-call list (among other limitations). Twilio cannot send messages to numbers on this list (other SMS providers are probably in a similar situation). Github probably decided it's better to disallow Indian numbers completely than let you sign up with a number that may not work when you need it. http://www.twilio.com/help/faq/sms/are-there-limitations-on-...

Re: Two-factor Authentication

#43

Post by YuriNiyazov »

maratd wrote: post #41
eric59 wrote: post #39

Does anyone have a good way of storing recovery codes? I currently keep them on paper, in my wallet, but with more and more sites using 2fa I'm having to carry more and more recovery codes around.

Screenshot all QR codes and store them in Dropbox, which also has 2-factor authentication. Store recovery code for Dropbox in Google Docs, which also has 2-factor authentication. So for me to be totally screwed, I would have to lose my phone and have my logins expire on both Dropbox and Google. Hasn't happened yet =)

Actually, I disagree with you here (because what hasn't happened to you has actually happened to me).

I was robbed at gunpoint, the perpetrator took both my phone and my laptop (the only computer authorized to login), which was the only computer that had a non-expired login.

I print out all the codes, stored them in a secure place in my house (with things like my passport). For the truly paranoid, get a safe, or a safety deposit box at a bank.

Re: Two-factor Authentication

#44

Post by nothingsTrivial »

ing33k wrote: post #27

its very good to see github adding 2FA, but I wish they could also support their Indian users for using it via SMS. edit : genuinely interested to know why they are not able to support SMS in some countries and mainly India.

ing33k, give it another look. I just updated the supported countries list.

Re: Two-factor Authentication

#46

Post by mastahyeti »

ing33k wrote: post #27

its very good to see github adding 2FA, but I wish they could also support their Indian users for using it via SMS. edit : genuinely interested to know why they are not able to support SMS in some countries and mainly India.

We just added support for India. Try again.

Re: Two-factor Authentication

#47

Post by teach »

ing33k wrote: post #27

its very good to see github adding 2FA, but I wish they could also support their Indian users for using it via SMS. edit : genuinely interested to know why they are not able to support SMS in some countries and mainly India.

See bdarnell's comment a few above yours. The problem is that India has a very strictly enforced 'do not call' list.

Re: Two-factor Authentication

#48

Post by nothingsTrivial »

bdarnell wrote: post #42
movingahead wrote: post #38

I cannot use an Indian fallback SMS number. Wonder, what is behind that.

India has a strictly-enforced national do-not-call list (among other limitations). Twilio cannot send messages to numbers on this list (other SMS providers are probably in a similar situation). Github probably decided it's better to disallow Indian numbers completely than let you sign up with a number that may not work when you need it. http://www.twilio.com/help/faq/sms/are-there-limitations-on-...

We do send a test message before SMS 2fa is enabled. I just enabled support for +91. But given the other limitations in that article I'll need to keep an eye things.

Re: Two-factor Authentication

#49

Post by dmd »

madsushi wrote: post #12
danielsju6 wrote: post #4

Earlier quoted context omitted.

You can certainly use your Authy app for it, it's just Authenticator.

I would also suggest that any iOS users move away from Google Authenticator and towards Authy or another solution. Google Auth in iOS7 has been deleting labels, and even worse, deleting tokens, for many users. The app hasn't been updated since 2011 and there's been no word from Google on an upcoming update to fix the issue. With iOS7's launch/announcement next week, I suggest looking into a new TOTP app (like Authy)…

Can anyone here speak to Authy vs. Duo (as a regular user, not as someone providing 2fa for their site)?

Re: Two-factor Authentication

#50

Post by bpatrianakos »

pilif wrote: post #40

The issue I have with third-party token applications like the Duo Security one that the github guys are recommending is that due to the way how TOTP works (shared secret), I'm practically giving away my second factor to whoever produces the app. Google Authenticator has the advantage that it's Open Source, but I can't really control whether the thing I downloaded in the app store is actually built from the public sou…

These are exactly the issues I'm dealing with in re-implementing two-factor auth in my own app. On the one hand you can easily roll your own SMS based TFA with the option to use Google Authenticator with a negligible amount of work. Google's app is pretty reliable and most people trust Google (rightly or wrongly is beside the point here).

But then what if Google pulls the rug out from under apps that rely on it and what if knowledgeable users like you don't like the idea of a third party having access to their second factor?

I'm starting to think that unless you're willing to build your own authenticator apps for multiple mobile OSes SMS-only is the best way to go.

Post reply on HN