Hacker News Reader

Comment by jrockway | Hacker News Reader

Have you encountered any other sites that allow you to use Google Authenticator to generate OTPs?

Part of the reason I think two-factor authentication is a usability burden is because each "identity provider" wants to use its own protocol. Google uses an Android app. PayPal sent me a card. My brokerage has a keychain token available. Other companies use a "soft" RSA token that runs on Windows. But if everyone agreed on a protocol, then I could have everything in one place, which would make two factor authentication significantly more enjoyable to use. (I know there are standards: the question is, who other than Google follows them? :)

View on HN

Good question. I have seen http://drupal.org/project/ga_login for Drupal, for example. Likewise, here's a write-up about using a YubiKey with Gmail's two-factor authentication: http://static.yubico.com/var/uploads/pdfs/Howto_GmailYubiKey...

I believe Google Authenticator is based on open standards and open source, so people could standardize on it if they wanted too.

> I believe Google Authenticator is based on open standards

The standards implemented are bonafide RFCs - HOTP (counter-based) was published in 2005, no less. I'm not sure how much lower the barriers for integration could be.

Lastpass also uses Google Authenticator. You can get server-side code so you can use Google Authenticator on your own server, or use it to offer two-factor authentication to a web service you are running. It's an open protocol, with an open source implementation. All you have to use it.

Amazon AWS supports the google authenticator app.

It is an open standard protocol, but I don't know in practice how many companies have compatible implementations.

A lot of the tokens(Google Auth included) follow http://www.ietf.org/rfc/rfc4226.txt. Problem is everyone has a different way of provisioning the secure key. Some of which are unsafe (I am looking at you Google Authenticator!. Yes a qrcode is kool idea but theres no guarantee that you are the only one who provisions the key using the image.)

I designed Authy with that in mind. I wanted a way to have a 1 token for all accounts. Maybe we will add support for Google Authenticator, so you could import your Google Auth token into the app.

I use pam_google_authenticator to login (via SSH) to my Linux server, and so can you.

Meraki (full disclosure: my employer) has two-factor authentication for their network config/admin web interface; whatever the tool used (I haven't worked on that part of our codebase), it is compatible with Google Authenticator.

There's a Google Authenticator WordPress plugin: http://wordpress.org/extend/plugins/google-authenticator/

DreamHost use Google Authenticator.

The bitcoin exchange MtGox supports securing your account with the Google Authenticator app.

Lastpass for one supports Google Authenticator. I am not sure about any other services.

Facebook. See https://www.facebook.com/settings?tab=security&section=a...

As far as I can tell, this offers no way to use Google Authenticator. Only the Facebook for Android app.

FB doesn't use Google Authenticator.

Reply on news.ycombinator.com