Hacker News Reader

Comment by eric_h | Hacker News Reader

> I don't like 2FA either

That seems to be a rather dangerous position to hold these days. I personally dislike that googles 2FA is SMS based (unless there's a way to use e.g. Authy with it that I'm unaware of), but still seems that the only way to be reasonably safe is a strong password and 2FA.

I'll add that The authy app on the Apple Watch has made 2FA for services that support it rather painless.

View on HN

I use 1Password as my 2FA app for Google services. I only set it up relatively recently so maybe support for non-SMS is new. Or region-based?

It's been there for years. Since ~1yr ago they also support U2F (hardware token based, un-phishable)

Google also allows you to use google authenticator, but I don't believe they allow third party services.

Google does allow other apps (I think it is still same as GAuth) SASS pass and other authenticators with good. But yes they don't allow other token provides like Yubikey or RSA fobs

> But yes they don't allow other token provides like Yubikey or RSA fobs

I think this is incorrect, at least provided you're using Chrome. The implementation was buggy somewhere in the chain the last time I tried it, but it's there.

Google is one of the major proponents of U2F, which is based on hardware tokens. Yubikeys support it, either the cheap U2F-only one or a Neo / 4. I use it and it works flawlessly. At the moment, only Chrome implements the required APIs as far as I know, but Mozilla is working on adding it to Firefox.

You can use any TOTP app you like, they all use the same QR code format. You can even build your own, it's all well documented.

Reply on news.ycombinator.com