Two Factor Auth List | Hacker News Reader

Two Factor Auth List

twofactorauth.org

104 pointsdavis43 comments

Open articleView on HN

You should probably rename Google Auth to "TOTP" since that's what is actually supported.

Neat idea for a site.

Agreed. I don't see why they list Google Auth and Authy separately when they both support the same TOTP system.

Authy also supports (it's own?) TFA system that is incompatible with the google app.

Yes, but you include TOTP sites in the Authy app and have them all in one place.

While this is all good(and it is, no sarcasm intended).

What I really want/care about is banking sites/companies. If this website could also compile a list for these institutions that would be awesome. It truly amazes me how most major banks lack 2fa.

I feel that I should point out that nearly every UK banking site uses 2fa for transactions, and many as an option for login. This only comes with chip & pin.

I setup a bank account in Germany in 2007 that issued me a hardware token generator (I forget the name of the bank). It was my first experience with 2 factor auth, and I'm a little surprised that I have yet to see it implemented with banks in the US.

Today, these usually work by transmitting some code via a flickering field on the website. You insert your bank card into the generator, hold it to your screen and type the number it shows on the device.

The German Wikipedia has some pictures: http://de.wikipedia.org/wiki/Transaktionsnummer#chipTAN_comf...

A long while back, American Express through it's Blue card line actually proposed the use of a card reader and physical token (the card for internet purchases). It never took off.

An article on such -- http://bits.blogs.nytimes.com/2008/12/05/a-credit-card-loses...

That said, their own site (at least when I last changed my password) had some fairly silly password rule restrictions like no punctuation.

I agree. Banking login options are far from the most secure. My phpBB login passwords are much, much more secure than my banking.

I just went to send a web-form email to my bank about it, and got this error:

> Input contains invalid characters. e.g. angle bracket, quotes, slashes, semicolon.

If a web form doesn't allow basic punctuation, I don't hold out much hope for a two-factor authentication system.

I would change custom to not show red if it doesn't exist.

It gives off an impression that it's bad that they don't have their own custom solution to 2FA.

1. I thought Google auth and Authy were interchangeable.

2. https://library.linode.com/linode-manager-security for the dev section.

Authy use their own system, but the app also supports TOTP.

Not sure of the details, but according to https://blog.cloudflare.com/choosing-a-two-factor-authentica... they are not (always) interchangeable.

You are right, but the end of that article alluded to a bit of an interchangeability.

> They're adding support in the next few weeks for Google Authenticator tokens to their system as well. That way you can use Authy's great UI to access your Google codes through one app.

So I got looking, and it looks like now you can always use Authy for google authenticator tokens [1].

http://blog.authy.com/authenticator

Random: I really like how simple the Google Authenticator's TOTP algorithm is: https://github.com/tadeck/onetimepass/blob/master/onetimepas...

It's only a few lines of code and other than having sync'ed clocks does not require any other running services. At one point I implemented it as a second factor for my most important servers that I ssh to so that my IP would be unlocked for 45 minutes after the initial connection.

Nitpick: It's not Google's, it's an open standard (OATH): http://tools.ietf.org/html/rfc6238

There's also HOTP.

You are right, I should have elaborated. Just like most people, I first learned about it from using the Google Authenticator app.

Sure, I'm just clarifying that it's a standard (and thus awesome).

If it works with Google Auth, it also works with Authy - same algorithm.

That's exactly what I was going to say. I finally put 2FA on my Dropbox account a while ago. Scanned the QR code in Authy, and everything worked just ifne.

I use two factor authentication apps on my phone to generate my one time passwords. This works great for me but I always wonder what I will do if I lose my phone. I've backed up the authenticator apps. I am correct in assuming I can restore the one time password generators from the back-ups? Is there anything else I should do?

I have used Titanium Backup to restore Google Authenticator and Battle.net Mobile Authenticator onto a different device and both apps have retained my accounts with no problem at all. So yes, you are correct in assuming that you can restore OTP generators from backups.

I can also confirm this. AS well as local, I have set Titanium Backup to send an additional (encrypted) backup to a cloud storage service as well (in my case Google Drive). I have restored from Titanium Backup many times with different ROMS and different phones.

If you have a phone and a tablet, install Google Authenticator and Authy on each, and scan the QR code with each app (a total of 4 times). As long as the clocks are in sync it will work fine, and protects access in case of:

- loss of 1 device, and - one of the apps not being available (e.g. during a stuck iOS app update)

I tried to setup Facebook Two Factor Auth and it says: "Make sure you have the latest version of the Facebook app on your device." According to your site, Facebook supports Google Auth but I am clueless on how to set this up without installing the FB android app.

Head to https://www.facebook.com/settings?tab=security&section=code_... and click "Set up another way to get security codes."

Evernote's documentation says they "recommend" Google Authenticator, but I've never managed to set it up because their setup process requires SMS. (Is the TOTP support premium only?)

This is a great resource. However, the SMS column might require some expansion as although some of the companies on this list support SMS two-factor auth, they don't support it outside of the US. Paypal, for example, does not support Finland (checked last week).

Great site. Is there a way (as a user) to mandate two-factor authentication on sites that don't natively offer it? I recognize that the obvious answer is no, but I'm curious to know if anyone has tried workarounds.

http://aws.amazon.com/iam/details/mfa/

amazon supports MFA, but the site seems to not know that...

Thats for AWS which is listed as supported further down the page as Amazon Web Services under the "Developer" section.

The Amazon they list above it is for the consumer store which AFAIK doesn't support MFA yet.

Sites didn't have a standard to follow and not everyone has the resources of Google to roll their own. Now that the Fido Alliance has big names on it, I hope to see companies use it.

That's a great resource! The first step before increased security is to increase awareness. Big service providers must be put on spot about two factor authentication IMHO.

or http://evanhahn.com/2fa/

There are sites that allow you to add 2FA to practically any site. Okta for example has this feature.

+1. Any SAML enabled (or WS-FED) site can be integrated with Okta to offer 2FA.

Even non-SAML sites can get 2FA support via Google Auth -our company Meldium (https://www.meldium.com/) now supports over 1,000 web apps, while there are only a few dozen major SaaS apps with SAML support.

Is there a decent hacker-friendly domain name provider that supports 2FA?

gandi.net fits both your requirements.

namesilo.com is the best domain registrar I've used. No upsells, dirt cheap, great API, and 2fa.

There's Dynadot: http://www.dynadot.com/domain/security.html

Also NearlyFreeSpeech, though the domain selection is very limited, as it's primarily a hosting company: https://blog.nearlyfreespeech.net/2014/02/28/price-cuts-more...

This could do with a column for Yubikey support.

Reply on news.ycombinator.com