Hacker News Reader

There are a few advantages you're not mentioning: 1) This is two factor authentication. I don't trust any of my really "essential" accounts like GMail or Coinbase without two factor. And all of the problems you mentioned around needing your phone are common to nearly all two-factor auth solutions.

2) More secure password. You won't be susceptible to many brute-force based hacking methods because your password won't be in any rainbow tables or anything like that.

How is this two factor? As near as I can tell, it replaces your password (something you know) with your phone (something you have). It doesn't add a second factor to the auth.

Two factor auth is defined as something you know plus something you have.

Two-step verification (also known as two-factor authentication) is a process involving two stages to verify the identity of an entity trying to access services in a computer or in a network. This is a special case of a multi-factor authentication which involves the presentation of two or more of the three authentication factors: a knowledge factor, a possession factor, and an inherence factor.

Their point was, there's only one factor here: something you have. There's no password you give the site. So it's one factor. It is probably significantly safer than just a password, since nigerian hackers can't steal your phone from a huge poorly secured database.... but it's still just one factor.

This is not two factor authentication, since it eliminates one of the factors (the password). Gmail's doesn't, so that is two factor auth.

Clef app has a PIN. And my phone has a lock screen password.

No, because you're not authenticating to the service.

Think about what would happen if your phone gets owned by some malware that escalates to root. It can simply log the PIN, extract the key and then login as it wishes. That's because the phone is the single factor for the service.

Compare that with the auth against, say, Gmail, where even if a malware were to own the Authenticator, it still couldn't login as you, since your password goes directly to the service.

I finally installed Google Authenticator on my phone yesterday because Digital Ocean utilizes it. It's great. Like RSA stuff, only more convenient. And hopefully given the response of Google's security people to NSA activity, more secure than the RSA stuff.

This thing basically looks like a more automated version of Google Authenticator. Cool, but meh, would it really change my life?

But maybe it would make a difference for the same market that feels like the iPhone 5s's fingerprint scanner is way more convenient than previous security mechanisms on the iPhone and so can never go back. I dunno.

Google's Authenticator 2FA system is based on an open standard [1], and can even be implemented on your own/other web sites. Given the open nature of the standard, that can be considered an additional safeguard against NSA exposure.

[1] http://en.wikipedia.org/wiki/Google_Authenticator

May I suggest you try the Authy[1] app for your phone. Its much prettier than GA, has a PIN screen lock, and can save your encrypted credentials in case you lose your phone. Plus, if you run OS X it will sync to your computer's clipboard via Bluetooth.

[1] https://www.authy.com/

While this is cool, I don't think I can replace GA with this because GA is the one implemented by the services I use, yeah? I can only use this for services that implement this.

Authy's app works with Google Authenticator-compatible sites. Authy also has its own two-factor system, but you're not required to use it.

> all of the problems you mentioned around needing your phone are common to nearly all two-factor auth solutions.

Not true. From his list of problems, TOTP does not require the Clef servers (or any third-party server), nor does it require your phone camera or (more importantly) phone networking to be working.

And to make the comparison fair, you have to realize that this is not two-factor. There's only one factor (something you have) since there isn't a password requirement.

This is wrong though because unless you have the same password for everything (you shouldn't) the process isn't the single serving:

click login box, type, tab, type, enter

It is moreso:

click login box, type one of passwords 1-10, tab, type, enter

Which assumes you remember each one. It's an even better use case scenario if you are the guy with only one password for everything.

I would think something like lastpass is an even better workflow however.

1. click login button 2. there is no step 2

Lastpass used to work like that for me. Now it causes me about as much hassle as it saves me. It does not do a wonderful job of handling multiple accounts on single sites; I frequently find multiple entries in the vault for single accounts, only one of which has the correct password (and usually the username is missing), and there are a number of sites whose presentation seems to baffle Lastpass, either in the login screen or in form-filling.

Also, Lastpass doesn't seem to offer to do as much for me anymore. Maybe I screwed something up in my config, but I don't see an AutoLogin option anymore.

So I'm just about ready to abandon Lastpass if anything else comes along that gives me a user experience like Lastpass used to give me. I don't know whether Clef is that service, but I'm at least glad that someone is exploring the space.

+1 for LastPass. Saves a bunch of time. They're pretty damn persistent about doing security the right way -- they don't have the key to open your data.

Except that's a bandaid over existing solutions. It's hard to imagine in 50 years we'll still require people to remember both a user identifier plus a password.

It's a tough problem. Human memories are fallible, yet it's with you always. Passwords can be given to others, which can be convenient in many situations (something bio recognition can't do). Bio markers like fingerprints are left everywhere as CCC has demonstrated, or the markers themselves can change such as with Macular degeneration in eyes. Phones can be stolen or run out of battery, physical key cards lost, and centralized systems like RSA's SecurID hacked.

In a lot of ways the banks have it done best, with combining a replaceable physical object (loanable) with a short PIN (sharable and more memorable), and then throwing fraud detection on top of it. It's the last piece that's the best and also the least available for others to do easily.

The problem would be better addressed by having a turn-key solution that any company can easily plug into their code to detect fraud attempts on short passwords. Big hole waiting for a startup to fill...

Plus the notion of "which of my ten passwords did I use for 'xyz.com?", you end up exposing your other nine passwords to 'xyz.com. Not as bad as using the same password everywhere, but still. I wouldn't want to accidentally give my bank password to, say, a crappy online forum.

BTW, what about the security implication of this password-test-runs? Users are essentially giving their "other" passwords to the site, right?

Obviously a benevolent site will NOT save/process those failed passwords, it may even take care to have them NOT stored in any logs...

An malevolent site on the other hand may even trick you into providing it some of your other passwords to it...

...cache invalidation, naming things and secure authentication for a broad public

I don't think it's any more accurate to say the average case is having to cycle through ten passwords to login to a site. Generally, I remember my passwords for most sites, and for the few I don't get right on the first try, I'm usually able to get in by the second. And yes, I have more than two passwords I use.

> the user's phone has to be in working order (camera working, network working)

battery not dead...

Just about all the widely public 2 factor schemes out there leverage cell phones via SMS or another route, they all require your device to be some battery life.

I bought a yubikey, but hardly any web services support it.

Actually, any website that supports Google 2FA also happens to support your Yubikey Neo, assuming you have a Neo.

Step 1: Install the Yubico Authenticator from the Play Store.

Step 2: Install the OATH applet. Linux instructions are at http://forum.yubico.com/viewtopic.php?f=26&t=1159, but there are OS X instructions kicking around on the forums as well.

Step 3: Wherever you would normally use Google Authenticator, use the Yubico Authenticator instead.

You now have proper two-factor authentication.

EDIT: Wrong link...

Damn. I bought the standard.

Well, sit tight. There's a new version of the Neo that supports U2F (https://sites.google.com/site/oauthgoog/gnubby) coming out Real Soon Now (https://www.yubico.com/products/yubikey-hardware/yubikey-neo...) -- sometime in 2014 is all I've heard.

None of the 2FA services that I use require me to use an actual phone. The phone number that I associate with 2FA services is set up to forward SMS messages to an email account that is dedicated to receiving only SMS messages from 2FA services.

How is that two factor any more? You've broken the security model. You now have only a knowledge factor, no possession factor.

The whole point of two-factor authentication is to make it so you need two things of two different types. You reduced this problem to having two passwords (two things of the same type).

Do you mean there is any significant difference between an email and SMS accounts?

I think that depends on the adversary. Against the NSA there might not be a major difference (depending on your email provider), but SMS is probably more secure in the typical case, as it is much more common for your run of the mill script kiddie/phisher/etc to get access to someone's email than their phone.

At least some mobile operators have "SMS archive" option, that can be enabled and accessible from self-service site. It requires some time to set up, but attacker with sufficient time, knowledge and patience may pull the attack relatively easily. No need for NSA-grade adversary.

(Even worse, until relatively recently they had used numeric passwords (those had to be set from a phone, using DTMF tone dial). This had changed only 3 or maybe 4 years ago. Wonder whenever that change was 2FA-related. :) )

So I'm uncertain whenever SMS is more secure.

But then you get added security. This isn't two factor, this is one factor.

You have to enter a 4 digit PIN number into the app. It's still two factor, since you have to auth to the app to get the one time pass.

Also, if you want to log into the site on your phone, you need a second phone.

Pretty sure they have an app to solve that.

Pretty much, yeah; this is condemned to fail and they should pivot ASAP.

Beats the heck out of time-based algorithms that generate a code on a fob. Obviously not usable everywhere, but definitely a solid option.

Yes, yes, except this allows you to log in from an untrusted computer.

How? An untrusted computer can just steal your session token.