Hacker News Reader

Comment by eru | Hacker News Reader

It's a shame that 2FA is often implemented via unsecure SMS.

The apps are actually more secure.

I agree, but it's worse than that, with SMS widely used for account recovery.

> But 2FA via SMS is ubiquitous because of its ease of use. “Not everyone is running around with a smartphone. Some people still have dumb phones,” says Android security researcher Jon Sawyer. “If Google cut off 2FA via SMS, then everybody with a dumb phone would have no two-factor at all. So what’s worse — no two-factor or two-factor that is getting hacked?”

The thing is, SMS is worse than a reasonably good password. So it's a bit annoying that Google strongly encourages me to register my phone number with my gmail account for recovery.

And many services, including Google, make it difficult or impossible to enable TOTP without first registering a phone number. They really really push the SMS route. Brings up the average security level for the average person, I'm sure. Very annoying for me.

This is interesting to me, as I live in an area with no mobile reception.

So (for me) it's a real PITA when places require a mobile phone number and there's no way to skip it. Obviously, can't use those services.

Does anyone know if Google Authenticator would run on a wifi iPad? As a potential workaround for the "no mobile network" situation.

It should require no connectivity at all, so yes.

Excellent. Might need to get an up-to-date iPad now. :)

Why? Any phone or laptop will do. No connectivity required.

I have an original iPad. It doesn't get connected to the net. So, no way to get the app on there, and it probably wouldn't work for iOS ~5.1.1 anyway. ;)

That being said, it hadn't clicked that a non mobile (eg laptop/desktop) version of it could exist.

The wikipedia page for it says it's strictly mobile only[1], as does the Google install info page[2].

[1]: https://en.wikipedia.org/wiki/Google_Authenticator

[2]: https://support.google.com/accounts/answer/1066447

Oh well.

Even the wikipedia page you linked lists alternatives for all kinds of platforms (which is no surprise, since it just implements standard algorithms)

No connectivity is required, it's TOTP on a 30-second interval. The tl;dr: is that you have a shared secret (so if this ever gets leaked to an attacker, yes, you're vulnerable) which is used in conjunction with current time (give or take a few seconds) to generate a code you can use to confirm authentication.

Thanks. :)

This may sound silly, but keep in mind that TOTP requires that both ends agree on the current time. I learned this the hard way when my authenticator stopped working consistently.

Apparently I had disabled my device's (the one with the authenticator app) "automatically set time from NTP" feature. Over time this resulted in my device's clock drifting X seconds away from the providers' clock(s), which in turn resulted in my occasionally using codes that were already X seconds expired.

The counter based OTP is actually more secure, but Google doesn't go for them with end-users, because they can go out of sync (eg if your kid is idly flicking through a lot of them on your phone) and then have to be reset.

Google Voice is another option for this.

Not only dumb phones, but all regular Android users in China. They don't have the Play store app on their phones and can't sideload it because it's not a simple apk file. Even if they managed to hack that, it's blocked through the great firewall anyway. Whatever Android 2FA app an email service used would probably only be available via the Play store and thus cut off all Chinese users, and even people from China who moved to another country and brought their old phone with them.

You can probably sideload FreeOTP (which is what I use, although I do install it from the play store).

A reasonably trustworthy APK download can be found on f-droid: https://f-droid.org/repository/browse/?fdfilter=freeotp&fdid...

There's a build of Authenticator in F-Droid, and the source is on GitHub

FreeOTP, as well.

Well, you can generate TOTP codes on your laptop, using oathtool, if someone has a "dumb" phone. One of the downsides is then you need to have your laptop always with you...

Reply on news.ycombinator.com