Hacker News Reader

Comment by feld | Hacker News Reader

What is the reason for all of these 2FA apps? This is completely unnecessary. If you're going to offer 2FA, please offer at least the following:

  * TOTP
  * Yubikey
  * SMS

If you want to partner with someone and ram unnecessary apps down our throats, optionally add the following:

  * Authy
  * RSA
  * etc

I have places where I want 2FA but I will not install the Authy app, so I go without. Sorry. Let me use TOTP or my Yubikey.

View on HN

What makes Yubikey part of the "default" set but not Authy or RSA?

This seems awfully like "If you're going to offer 2FA, at least offer all the tools I like, before you offer any tools that I don't like".

It's also worth noting that Authy's app supports TOTP, last I looked.

Because Yubikey is very reasonably priced and they're very open about their design... and don't require you provide any identifying information to own one.

Well, except, you have to buy one from somewhere, and I believe they are only officially being sold through their own site or Amazon. So you are providing your identifying information to some party before even getting the device.

You do realise that with authy you're just registering TOTP stuff right? It's not on the same level as what you're mentioning. It's like complaining about having to use Firefox instead of google.com

Then why do they need an account or my phone number to do TOTP?

Yes, that's definitely unfortunate. I don't remember it being required with older versions of the Authy app. I really hate forced cloud service integration, especially in applications that deal with sensitive material.

they don't, but they want to have a way to verify who you are for things like the sync feature. Even if you don't want to use the feature.

This is a pretty good example of not doing something because it represents a minority and would make onboarding more difficult for their actual value-add.

Because Cloudflare requires Authy, not TOTP. It's a pain in my ass because Cloudflare doesn't have sub-accounts and I have more than one person managing a Cloudflare account, but Authy is locked to one device. So as a result I can't turn on two-factor on my Cloudflare account.

I don't understand this rage. I've used Authy with regular TOTP services, and in some cases where I was explicitly told to use something else like Google Authenticator. Unless this changes, I don't see any reason to stop using Authy.

s/Yubikey/U2F/

(But I will use my Yubikey for U2F)

I also refuse to install Authy. I really, really do not like their creeping, creepy intrusiveness and the profiling it enables. I get the feeling that people don't actually understand Authy beyond "Hey, it backs up my secrets to the cloud. Cool!"

I recently had to renew my Google Authenticator tokens and I was tempted by Authy but the setup/onboarding sent me away screaming. Then I remembered the NEO can handle this (well except for Amazon tokens). Can't wait for U2F NFC to be standardized.

This precisely. I commend Authy for trying to make 2FA for a wide audience, but security is not easy. Training users is the correct approach.

Give an option for those who deeply care about their security. If you're going to grab the industry by the balls and capture the attention of major industry players at least stick to your core values and offer an advanced/expert option for those of us who want to stay out of your system but still use 2FA.

Reply on news.ycombinator.com