Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Two-factor Authentication

github.com

Post reply on HN
Print view View original

61–70 of 94 posts

Re: Two-factor Authentication

#61

Post by Rizbo »

pilif wrote: post #40

The issue I have with third-party token applications like the Duo Security one that the github guys are recommending is that due to the way how TOTP works (shared secret), I'm practically giving away my second factor to whoever produces the app. Google Authenticator has the advantage that it's Open Source, but I can't really control whether the thing I downloaded in the app store is actually built from the public sou…

Android Token app doesn't require any permissions and is free open source Software. The current version of Google Authenticator isn't open source.

Re: Two-factor Authentication

#62

Post by SEMW »

bpatrianakos wrote: post #50
pilif wrote: post #40

The issue I have with third-party token applications like the Duo Security one that the github guys are recommending is that due to the way how TOTP works (shared secret), I'm practically giving away my second factor to whoever produces the app. Google Authenticator has the advantage that it's Open Source, but I can't really control whether the thing I downloaded in the app store is actually built from the public sou…

These are exactly the issues I'm dealing with in re-implementing two-factor auth in my own app. On the one hand you can easily roll your own SMS based TFA with the option to use Google Authenticator with a negligible amount of work. Google's app is pretty reliable and most people trust Google (rightly or wrongly is beside the point here). But then what if Google pulls the rug out from under apps that rely on it and w…

> But then what if Google pulls the rug out from under apps that rely on it

As has been pointed out, it's open source (specifically, Apache 2.0)[1]. So, fork the code[2], if necessary find&replace any google trademarks, and republish as a dedicated authenticator for your own app. Or use one of the existing apps which have forked off gauthenticator, e.g. https://github.com/kaie/otp-authenticator-android .

[1] Except for some bits specific to gmail's 2-factor workflow added after v2.21

[2] git clone https://code.google.com/p/google-authenticator/

Re: Two-factor Authentication

#63

Post by aufreak3 »

I'm beginning to wonder whether "support for 2FA" is a way for companies to get your telephone number into their database. Does using an authenticator application also provide the same information to the company?

Re: Two-factor Authentication

#64

Post by shmageggy »

I'd just like to point out that this is another example of the failure of the overly-rigid submission title policy here. This title tells me almost nothing about the content I'm about to see or whether it's relevant to me. Expecting to see something about 2FA in general or maybe even a library that eases implementation (given the github domain), I was let down when I opened the link and realized I didn't care in the least about this content. I wasted my time browsing, and I wasted even more time writing this rant.

Re: Two-factor Authentication

#65

Post by jonesetc »

shmageggy wrote: post #64

I'd just like to point out that this is another example of the failure of the overly-rigid submission title policy here. This title tells me almost nothing about the content I'm about to see or whether it's relevant to me. Expecting to see something about 2FA in general or maybe even a library that eases implementation (given the github domain), I was let down when I opened the link and realized I didn't care in the…

In the time it took you to get angry you could have just hovered over the link and seen it went to the github blog. Pretty obvious once you see that. It didn't need to say everything because if you look at the context, it was already there.

Re: Two-factor Authentication

#66

Post by xyzzyz »

jonesetc wrote: post #65
shmageggy wrote: post #64

I'd just like to point out that this is another example of the failure of the overly-rigid submission title policy here. This title tells me almost nothing about the content I'm about to see or whether it's relevant to me. Expecting to see something about 2FA in general or maybe even a library that eases implementation (given the github domain), I was let down when I opened the link and realized I didn't care in the…

In the time it took you to get angry you could have just hovered over the link and seen it went to the github blog. Pretty obvious once you see that. It didn't need to say everything because if you look at the context, it was already there.

There are 19 more links at the front page, FYI. It actually takes a lot of time to hover all of them.

Re: Two-factor Authentication

#67

Post by krebby »

shmageggy wrote: post #64

I'd just like to point out that this is another example of the failure of the overly-rigid submission title policy here. This title tells me almost nothing about the content I'm about to see or whether it's relevant to me. Expecting to see something about 2FA in general or maybe even a library that eases implementation (given the github domain), I was let down when I opened the link and realized I didn't care in the…

For what it's worth, the old title was something like "Github Introduces Two-Factor Auth", which is a lot more descriptive and informative than the shorter title. Would like to know why it was changed.

Re: Two-factor Authentication

#68

Post by stock_toaster »

dmd wrote: post #49
madsushi wrote: post #12

Earlier quoted context omitted.

I would also suggest that any iOS users move away from Google Authenticator and towards Authy or another solution. Google Auth in iOS7 has been deleting labels, and even worse, deleting tokens, for many users. The app hasn't been updated since 2011 and there's been no word from Google on an upcoming update to fix the issue. With iOS7's launch/announcement next week, I suggest looking into a new TOTP app (like Authy)…

Can anyone here speak to Authy vs. Duo (as a regular user, not as someone providing 2fa for their site)?

Duo app doesn't store token data server side (authy used to last time I checked. -_-), and did not require a phone number to use totp.

I use duo.

Re: Two-factor Authentication

#69

Post by rdl »

pilif wrote: post #40

The issue I have with third-party token applications like the Duo Security one that the github guys are recommending is that due to the way how TOTP works (shared secret), I'm practically giving away my second factor to whoever produces the app. Google Authenticator has the advantage that it's Open Source, but I can't really control whether the thing I downloaded in the app store is actually built from the public sou…

I also want to be able to give the site a seed to an existing token, i.e. a hard token like the gemalto. This is the step so many of them get wrong.

(If I'm logging in primarily from a phone/tablet, an authenticator app on the same device is much less secure against targeted attacks than a hardware token would be. Plus, hardware tokens allow lots of useful things like physical-escrow based access control.)

Re: Two-factor Authentication

#70

Post by mbrubeck »

shmageggy wrote: post #64

I'd just like to point out that this is another example of the failure of the overly-rigid submission title policy here. This title tells me almost nothing about the content I'm about to see or whether it's relevant to me. Expecting to see something about 2FA in general or maybe even a library that eases implementation (given the github domain), I was let down when I opened the link and realized I didn't care in the…

I agree. I've been a regular reader of the site for over six years (and a regular poster for 4.5 years) and I'm pretty sure this has gotten a lot worse in the last few years.

Headline-writing is very audience-specific. A headline that works fine in its original context (on a personal or company blog, for example) does not always work out of that context. In the early days, the "use original titles" guideline was much less rigidly enforced, and most users did a good job of tweaking titles to make them more informative and appropriate for the HN audience. When they failed, editors did a good job of fixing that.

Today it seems the rule is applied blindly and often detrimentally. And unlike, say, MetaFilter, where the moderators are visible and engaged with the community on questions of policy, the HN "editors" act invisibly and seem never to respond or engage with their readers. :(

Post reply on HN