Show HN: Authian – Open Source 2-Factor Authentication Using Instant Messengers | Hacker News Reader

Show HN: Authian – Open Source 2-Factor Authentication Using Instant Messengers

authian.org

37 pointsauthian15 comments

One of the key features of something like Signal is not just security, but authentication: if I'm talking to my girlfriend over Signal and it tells me that her key suddenly changed, I stop talking to her, call her, and ask her what's up (and, to be fair, it's happened twice so far due to changing phones). It's supposed to stop a MITM attack, so that someone cannot pretend to be her and continue the conversation.

What will your authian bot do, however, if the key changes? Will it happily continue communicating with the new, possibly malevolent recipient?

Does signal even allow bots? They have pretty draconian terms on allowing 3rd party clients to connect to their service.

Where the key changes and the API supports it, we will definitely use such a feature.

Concerning Signal though, it does not support bots (officially).

Where is said source? The Github & Gitlab orgs are empty. Seems like this post is a bit premature.

I came to ask just this question. :)

What about ethical messengers like XMPP, Matrix, Signal, Wire?

I'm not sure about their reasons, but I would guess it's because the three messenger they support (Telegram, WhatsApp, WeChat) are significantly easier to integrate with, and have nearly a billion active users combined.

What vesak has said is partly correct. We are integrating IMs that have the most reach firstly.

We also investigated IMs where users are not registered to a particular number and we deduced that most companies would not want clients to authenticate themselves with accounts that are not attached to a number (when they already have such numbers available).

We stand to be corrected and would gladly integrate with other IMs where demand/interest exists.

So this basically is OTP over encrypted IM instead of OTP over SMS.

Im not sure why you'd use this over TOTP?

Good question!

My answers (in point form) are:

1) We plan on integrating TOTP into the Authian server so that TOTP can be used as an alternate option where no other IMs are supported by the end-user

2) Using OTP over encrypted IM has less friction. Many other options require people to install "yet another app". TOTP is also not that well understood by the average person, whereas most people are already familiar with SMS-based authentication (which also has low friction, but is comparatively expensive)

3) TOTP can't do notifications of successful login attempts to the TOTP app. Whereas OTP over IM offers this, as well as baking in other security enhancements as required by vendors (eg. account recovery options)

With that said though, I would consider TOTP and OTP over IM to be complementary products.

Not sure if this is relevant, but TOTP via phone app doesn't work when a phone is experiencing NTP sync issues. At least, this is a problem which I experienced.

Telegram is not encrypted without secret chat

> Telegram is not encrypted without secret chat

Yes it is. It's not end-to-end encrypted, however. An attacker would need to have successfully attacked Telegram first.

> It will be released when the code is a bit more stable (and provides better performance)

Can you provide more details? I am not ready to use this until there is something on github/gitlab to look at.

I can understand needing another month or two, but I would like some assurance this isn't going to be another minecraft.

Part of our assurance that the product is good/reliable/secure is releasing the source code for people to determine that themselves.

We have no plans to rescind on this, although we would like people to join our newsletter so that we can reach them. By having a point of contact, we hope to build a product and form a community based on the needs of end-users (eg. how the product is being used and how we can improve upon it)

If you joined the newsletter, we will be reaching you shortly.

Reply on news.ycombinator.com