Linode Manager Two-Step Authentication

I'll have to see if the Google Authenticator app shows up on all of my iDevices linked to my Apple account and whether the code from any of them will work (from the setup process, I don't see why not). Does anybody know?

If the app will work from any of iDevices, it would not be secure enough for a service storing bitcoins :) because the second factor should be hard to copy (which a real hardware token is, while a software token isn't).

Re: Linode Manager Two-Step Authentication

#5

Post by rdl » Thu, May 02, 2013, 10:03 PM UTC

Wow, this is great.

It would be nice if they let you set up SSL cert + MFA + password. I am kind of angry that modern desktop browsers continue to make SSL certs suck so much, but they're decent on mobile. I hope a future version of OSX builds in great cert management and UI/UX with local biometrics or something.

Re: Linode Manager Two-Step Authentication

#6

Post by rdl » Thu, May 02, 2013, 10:04 PM UTC

luser001 wrote: post #4

I was hoping for Yubikey support. But I'll take this for now. I'll have to see if the Google Authenticator app shows up on all of my iDevices linked to my Apple account and whether the code from any of them will work (from the setup process, I don't see why not). Does anybody know? If the app will work from any of iDevices, it would not be secure enough for a service storing bitcoins :) because the second factor shou…

It's per-device, not per account (I know the guy who developed it for Google; one of the smarter people in the industry).

It uses protected storage for the credential so it isn't backed up to iCloud, either. Sadly on Android they don't have the same security features available, due to limitations in the OS; it would be fun to talk to Samsung and make a "actually secure Google Authenticator" specific to the S3/S4 since they have a security element.

If you do want it on multiple iDevices, you need to do that at setup time, by copying the secret manually.

Re: Linode Manager Two-Step Authentication

#7

Post by threeseed » Thu, May 02, 2013, 10:04 PM UTC

After being bitten the first time with Linode I don't care what technical measures they are taking. I want to know what process and policy changes have been made.

Do they still store public/private keys on the same server ? How often are they doing security audits (which clearly never happened before) ? Are they still going to be dodgy and withhold key information from their users ? Are users still going to find out hackings from IRC/Reddit rather than Linode itself ?

Two factor authentication would have done NOTHING to prevent both hacking attempts.

Re: Linode Manager Two-Step Authentication

#8

Post by threeseed » Thu, May 02, 2013, 10:08 PM UTC

luser001 wrote: post #4

I was hoping for Yubikey support. But I'll take this for now. I'll have to see if the Google Authenticator app shows up on all of my iDevices linked to my Apple account and whether the code from any of them will work (from the setup process, I don't see why not). Does anybody know? If the app will work from any of iDevices, it would not be secure enough for a service storing bitcoins :) because the second factor shou…

   it would not be secure enough for a service storing bitcoins

Linode was hacked twice (once where Bitcoins were stolen) in recent times and was shown to have the worst security practices I've ever seen. They have never been secure enough for storing Bitcoins.

Re: Linode Manager Two-Step Authentication

#9

Post by DigitalJack » Thu, May 02, 2013, 10:08 PM UTC

luser001 wrote: post #4

I was hoping for Yubikey support. But I'll take this for now. I'll have to see if the Google Authenticator app shows up on all of my iDevices linked to my Apple account and whether the code from any of them will work (from the setup process, I don't see why not). Does anybody know? If the app will work from any of iDevices, it would not be secure enough for a service storing bitcoins :) because the second factor shou…

Each copy of the software needs to be initialized with a token. Google tries to limit you to have one copy initialized at a time, but I'm not too sure how effective they are.

Re: Linode Manager Two-Step Authentication

#10

Post by chc » Thu, May 02, 2013, 10:18 PM UTC

threeseed wrote: post #8

luser001 wrote: post #4

I was hoping for Yubikey support. But I'll take this for now. I'll have to see if the Google Authenticator app shows up on all of my iDevices linked to my Apple account and whether the code from any of them will work (from the setup process, I don't see why not). Does anybody know? If the app will work from any of iDevices, it would not be secure enough for a service storing bitcoins :) because the second factor shou…

it would not be secure enough for a service storing bitcoins Linode was hacked twice (once where Bitcoins were stolen) in recent times and was shown to have the worst security practices I've ever seen. They have never been secure enough for storing Bitcoins.

In fairness, I don't think that is an appreciably worse record for security than most Bitcoin exchanges.