Hacker News Reader

Comment by staticshock | Hacker News Reader

> the user's phone has to be in working order (camera working, network working)

battery not dead...

Just about all the widely public 2 factor schemes out there leverage cell phones via SMS or another route, they all require your device to be some battery life.

I bought a yubikey, but hardly any web services support it.

Actually, any website that supports Google 2FA also happens to support your Yubikey Neo, assuming you have a Neo.

Step 1: Install the Yubico Authenticator from the Play Store.

Step 2: Install the OATH applet. Linux instructions are at http://forum.yubico.com/viewtopic.php?f=26&t=1159, but there are OS X instructions kicking around on the forums as well.

Step 3: Wherever you would normally use Google Authenticator, use the Yubico Authenticator instead.

You now have proper two-factor authentication.

EDIT: Wrong link...

Damn. I bought the standard.

Well, sit tight. There's a new version of the Neo that supports U2F (https://sites.google.com/site/oauthgoog/gnubby) coming out Real Soon Now (https://www.yubico.com/products/yubikey-hardware/yubikey-neo...) -- sometime in 2014 is all I've heard.

None of the 2FA services that I use require me to use an actual phone. The phone number that I associate with 2FA services is set up to forward SMS messages to an email account that is dedicated to receiving only SMS messages from 2FA services.

How is that two factor any more? You've broken the security model. You now have only a knowledge factor, no possession factor.

The whole point of two-factor authentication is to make it so you need two things of two different types. You reduced this problem to having two passwords (two things of the same type).

Do you mean there is any significant difference between an email and SMS accounts?

I think that depends on the adversary. Against the NSA there might not be a major difference (depending on your email provider), but SMS is probably more secure in the typical case, as it is much more common for your run of the mill script kiddie/phisher/etc to get access to someone's email than their phone.

At least some mobile operators have "SMS archive" option, that can be enabled and accessible from self-service site. It requires some time to set up, but attacker with sufficient time, knowledge and patience may pull the attack relatively easily. No need for NSA-grade adversary.

(Even worse, until relatively recently they had used numeric passwords (those had to be set from a phone, using DTMF tone dial). This had changed only 3 or maybe 4 years ago. Wonder whenever that change was 2FA-related. :) )

So I'm uncertain whenever SMS is more secure.

But then you get added security. This isn't two factor, this is one factor.

You have to enter a 4 digit PIN number into the app. It's still two factor, since you have to auth to the app to get the one time pass.

Also, if you want to log into the site on your phone, you need a second phone.

Pretty sure they have an app to solve that.

Reply on news.ycombinator.com