Two Factor Auth List of Websites • Hacker News Board

Re: Two Factor Auth List of Websites

#61

Post by nickik » Tue, Jul 12, 2016, 8:48 PM UTC

CiPHPerCoder wrote: post #60

nickik wrote: post #56

Earlier quoted context omitted.

I have implemented this before. I have it in production right now. The fact is people hate typing stuff from their phone into their computer. Specially if you phone is not always within reaching distance. If you have to do it with tons of different logins you will be annoyed. As long as you have 1-2 accounts its fine, but if we really want to role it out everywhere, we need something better.

What are your thoughts about SQRL?

I don't know enougth about it. I have stumbled on it before, but I need to get into it.

Re: Two Factor Auth List of Websites

#62

Post by rahimnathwani » Wed, Jul 13, 2016, 3:19 AM UTC

nickik wrote: post #56

CiPHPerCoder wrote: post #49

Earlier quoted context omitted.

> The TOTP stuff will never be widly used. Its just a total pain to work with. I'm not sure I agree with that. Generating a code: makeQRCode(); Validating a code: validateCode($_POST['2facode'])) { // Login successful } } Then you can just use the 2FA app of your choice (Authy, Google Authenticator, etc.), scan the QR code, and you're good to go.

I have implemented this before. I have it in production right now. The fact is people hate typing stuff from their phone into their computer. Specially if you phone is not always within reaching distance. If you have to do it with tons of different logins you will be annoyed. As long as you have 1-2 accounts its fine, but if we really want to role it out everywhere, we need something better.

People can get used to it. In China, it's very common to require either (i) entry of a 6-digit code sent by SMS or (ii) using a mobile app to scan a QR code, to complete a web site login.

Neither of these things is a barrier.

Re: Two Factor Auth List of Websites

#63

Post by akerro » Wed, Jul 13, 2016, 7:14 AM UTC

peterwwillis wrote: post #39

akerro wrote: post #21

It always wondered me why my bank can't offer my 2FA with SMS code, but Steam or Github can?

Why do you want the place that keeps all your money to support an unencrypted, unauthenticated, over-the-air token delivered by an insecure provider over an insecure protocol?

Because is still better than login + password?

Re: Two Factor Auth List of Websites

#64

Post by sib » Wed, Jul 13, 2016, 9:14 PM UTC

olivier_martel wrote: post #5

Instagram does have 2FA...

It turns out that (outside of FB employees), Instagram 2FA is only enabled for users with more than 1,000 followers. So, if you don't have more than 1,000 followers, they don't care if your account is hacked.

Re: Two Factor Auth List of Websites

#65

Post by olivier_martel » Thu, Jul 14, 2016, 12:30 PM UTC

sib wrote: post #35

olivier_martel wrote: post #5

Instagram does have 2FA...

Are you sure it's rolled out for everyone? I have been trying to find it (web & mobile app) for weeks and can't find it... I know there was a bunch of press about it in February 2016, but I don't see it in the UI.

I do have it since the beginning of 2016... I have 16k followers so it might explain the 1k+. It's in the options, right under "Posts You've Liked".