Hacker News Reader

Comment by Wingman4l7 | Hacker News Reader

The more I read about this, the more I think that 2-factor authentication is the future, whether it's using robocalls / texted codes sent to mobile phones, or just a security token. It's easier to just add one of the 3 types of authentication* to the mix rather than wrapping yet another layer of complexity around a single one of them.

* (what you have, what you are, what you know)

View on HN

I have been reading the list of 2 factor at lastpass [1] and in addition to mentioning the yubikey, it talks about the grid multifactor [2] - probably about on par with what was used in WW2 but it seems extremely simple, low tech solution to multifactor that doesn't require computers, phones or electronics - solving that problem of 'something you know' + 'something you have'

[1] http://helpdesk.lastpass.com/security-options/

[2] http://helpdesk.lastpass.com/security-options/grid-multifact...

Sounds like you're referring to a one-time pad[1], which is what that grid looks like. Google's 2-factor auth has a simpler version of this -- they just give you 10 or so one-time passwords. I like the grid; it seems to have a much longer potential "lifetime" of use.

[1]: http://en.wikipedia.org/wiki/One-time_pad

Duo Security, from some of the Open{BSD,SSH} guys, offers a nice two-factor auth layer that's pluggable into any web or online service; push notifications, SMS, or voice. Similar to Google Authenticator except that Duo isn't limited to Google supported services (although they did take an investment from Google Ventures).

I hope not. Two-factor auth ties you down to a cellphone (or physical token) while giving you only marginal improvement in real-life usage scenarios. (You are not going to enter a new token every time you check your email or Facebook.) We have higher-level problems with authentication that need to be solved.

I never said I liked it, I just thought that's where we might be headed. =/

As far as that goes, Google's 2-factor auth mitigates this a bit, with its "keep this auth instance valid for X days" option. (They also have a new "permanently auth this computer by adding it to a trusted list" option, which IMO defeats the point.)

As far as personal security tokens go, I recently came across the YubiKey, which provides 2-factor auth using OTPs. It looks very promising, but I haven't used it myself, so I can't provide any anecdata on it.

Google authenticator is great; can be used on many sites (gmail, last pass, aws) and is based on an open standard that is to implement on your own servers.

Reply on news.ycombinator.com