Hacker News Reader

Comment by robin_reala | Hacker News Reader

It’s worth setting up two-factor authentication on any service that supports it: Google, Facebook and Github spring to mind.

View on HN

I'd like to enable two factor auth on my twitter account, but I'm put-off by their SMS-based implementation. Does anyone know if they have plans to support TOTP, like Google, GitHub, etc?

If you have the Twitter app on your smartphone, you can get notifications through it. I have 2FA for Twitter but do not receive SMS messages.

Thanks, I didn't know that! That might be good enough, as I quite often have no phone signal (and therefore no SMS) but still have net connectivity via wifi.

I'd still prefer the TOTP approach though because it doesn't require any connectivity on the phone.

And AWS! As the article said he got lucky that the attacker didn't twig that there was an AWS account associated with that amazon.com login.

You should be using two-factor authentication for all your AWS accounts, especially the 'root' account that's tied to your regular Amazon.com login (I've always though this is a bit odd).

You should also never use that root account and set up IAM accounts for yourself and any other user (which also use 2FA).

Definitely. While it's not a perfect solution, it provides an extra layer of protection for your accounts by making an extra hurdle for any attacker to clear. Needing two components to access/change your accounts is elegant and effective.

Pay-as-you-go phones are advisable to use for two factor verification, as they are affordable and could be used only for this purpose. Don't hand out the number and you've got a nice disposable tool for protecting your accounts.

Many providers shuts down the account if you don't use it for calling at least once per year. Some close it down if you don't fill up the cachpool with money every 6-12 months.

Right, pay-as-you-go phones are annoying that way, if you aren't actually using them. I've lost a few phone numbers because I didn't remember to top-up a phone I wanted for rare uses and/or only incoming calls.

Ah yes, I hadn't thought of that. Probably because I have around two years worth of service built up on mine.

Dropbox and app.net also do 2FA.

If the service you're using doesn't support it, ask them to implement it. If enough people did it..

I'm currently building a framework agnostic Authentication module for PHP/Composer, that has 2FA baked in. I want to give everyone who's building web apps in PHP no excuse for not having it. It's painful, but worth it IMO.

And I thought that dropbox had already lost their reputation with pretty much everyone around since those massive security flaws exposed a while back. Silly me.

So does Namecheap.

I've got it setup on facebook and google, didn't know GitHub has it.

Awesome! Github setup! Thanks.

Reply on news.ycombinator.com