Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Two-factor Authentication

github.com

Post reply on HN
Print view View original

51–60 of 94 posts

Re: Two-factor Authentication

#51

Post by vulf »

pilif wrote: post #40

The issue I have with third-party token applications like the Duo Security one that the github guys are recommending is that due to the way how TOTP works (shared secret), I'm practically giving away my second factor to whoever produces the app. Google Authenticator has the advantage that it's Open Source, but I can't really control whether the thing I downloaded in the app store is actually built from the public sou…

You could just use the SMS option instead of the app one when you turn on github's 2fa. Then no 3rd party will have access to the secret.

Re: Two-factor Authentication

#53

Post by vulf »

eric59 wrote: post #39

Does anyone have a good way of storing recovery codes? I currently keep them on paper, in my wallet, but with more and more sites using 2fa I'm having to carry more and more recovery codes around.

This may sound extra paranoid, but I've locked myself out of 2FA'd accounts before and recovery is not fun, so I go out of my way to keep the recovery codes secured but available to me in case of catastrophe.

First, I make an encrypted disk image with a very strong, unique passphrase (easy on OSX, not sure about windows). In this I put the QR setup codes and my recovery codes. I put a copy of this on every device I own, every computer I own, stash it in my home directory on my server, and put it on dropbox. I then share the dropbox copy to two friends, and instruct them to hold on to it in case I lose access to all my devices. Any time I enable 2FA on a new account, like I did today, I update the image and redistribute it.

I previously kept a copy on github as well as dropbox, but now that both are behind 2FA I wouldn't be able to recover from those sources if I lost all my devices. Maybe I should push a copy to pages.github.io under some secret path that only I knew.

Oh, and check out BitTorrent Sync, it makes it really easy to distribute among my computers and phone without worrying about dropbox somehow losing my files or preventing my access.

Re: Two-factor Authentication

#54

Post by epistasis »

buro9 wrote: post #52

Love it. But Yubikey support as well please.

Having bought a Yubikey last week, I wish that Yubikey was better at TOTP (which I didn't realize that Github used, until posters here corrected me).

Right now there are Windows and Linux add on apps for Yubikey TOTP, but for OS X you have to pay $9 to a third party.

But then, I also wished that Yubikey supported PKCS#11, which looks like it may eventually be coming for the upscale Yubikey NEO.

Yubico is pretty cool in that they made something that is fairly programmable, but the better supported standards are not well supported by defualt.

Re: Two-factor Authentication

#55

Post by bri3d »

bpatrianakos wrote: post #50
pilif wrote: post #40

The issue I have with third-party token applications like the Duo Security one that the github guys are recommending is that due to the way how TOTP works (shared secret), I'm practically giving away my second factor to whoever produces the app. Google Authenticator has the advantage that it's Open Source, but I can't really control whether the thing I downloaded in the app store is actually built from the public sou…

These are exactly the issues I'm dealing with in re-implementing two-factor auth in my own app. On the one hand you can easily roll your own SMS based TFA with the option to use Google Authenticator with a negligible amount of work. Google's app is pretty reliable and most people trust Google (rightly or wrongly is beside the point here). But then what if Google pulls the rug out from under apps that rely on it and w…

Why not just support both? As a savvy user I can choose SMS-only without ever letting Google anywhere near my shared secret.

Or I can implement or build from source a TFA app I trust and use that.

I really hate sites that support TFA and don't support authentication apps as I have very poor phone service at both my home and place of work and hence SMS is a frustrating experience for me.

Re: Two-factor Authentication

#56

Post by necubi »

gaveeno wrote: post #21
obilgic wrote: post #15

I am an international student and I literally hate when they don't let me put in 2 different numbers. I get locked out when I travel. For example, twitter

Use Google Voice or some other similar service that'll let you receive SMS via the web.

Be careful with that. A lot of automated SMS systems can't send to Google Voice.

Re: Two-factor Authentication

#57

Post by wereHamster »

vulf wrote: post #51
pilif wrote: post #40

The issue I have with third-party token applications like the Duo Security one that the github guys are recommending is that due to the way how TOTP works (shared secret), I'm practically giving away my second factor to whoever produces the app. Google Authenticator has the advantage that it's Open Source, but I can't really control whether the thing I downloaded in the app store is actually built from the public sou…

You could just use the SMS option instead of the app one when you turn on github's 2fa. Then no 3rd party will have access to the secret.

Except the NSA party...

Re: Two-factor Authentication

#58

Post by JacobHenner »

epistasis wrote: post #54
buro9 wrote: post #52

Love it. But Yubikey support as well please.

Having bought a Yubikey last week, I wish that Yubikey was better at TOTP (which I didn't realize that Github used, until posters here corrected me). Right now there are Windows and Linux add on apps for Yubikey TOTP, but for OS X you have to pay $9 to a third party. But then, I also wished that Yubikey supported PKCS#11, which looks like it may eventually be coming for the upscale Yubikey NEO. Yubico is pretty cool…

As a Yubikey user, I wish more sites allowed the native Yubikey format, or even a VIP credential. TOTP doesn't make sense in a lot of use cases.

Re: Two-factor Authentication

#59

Post by mdpye »

bdarnell wrote: post #42
movingahead wrote: post #38

I cannot use an Indian fallback SMS number. Wonder, what is behind that.

India has a strictly-enforced national do-not-call list (among other limitations). Twilio cannot send messages to numbers on this list (other SMS providers are probably in a similar situation). Github probably decided it's better to disallow Indian numbers completely than let you sign up with a number that may not work when you need it. http://www.twilio.com/help/faq/sms/are-there-limitations-on-...

All SMS providers are in the same boat. IIRC, the penalties for breaking the DNC list in India are brutal. (until recently I worked at a big mobile aggregator)

Re: Two-factor Authentication

#60

Post by StavrosK »

pilif wrote: post #40

The issue I have with third-party token applications like the Duo Security one that the github guys are recommending is that due to the way how TOTP works (shared secret), I'm practically giving away my second factor to whoever produces the app. Google Authenticator has the advantage that it's Open Source, but I can't really control whether the thing I downloaded in the app store is actually built from the public sou…

You don't need a developer account for an Android app. Connect your phone to the pc, press "build" in Eclipse, select the phone and the app's there. You can even just transfer the apk over and install it.
Post reply on HN