Hacker News Reader

Hacker News

Comment by larsiusprime | Hacker News Reader

Full thread

larsiusprime

Slack encourages 2-factor authentication:

> Download and install either the Google Authenticator or Duo Mobile apps on your phone or tablet.

Hey Slack, I don't have a smartphone. What am I supposed to do?

View on HN

Lots of options.

* You can buy a hardware token. https://www.duosecurity.com/product/methods/hardware-tokens

* You can have Duo call/text you every time you want to log in.

* You can use some other device you have that runs a mobile OS. I had Duo set up on my wifi-only iPad while I was using a feature phone for a few months a year ago. (I eventually gave up on that and got a smartphone, though.)

* You can buy a used/cheap smartphone, iPod Touch, or similar, install either the Google Authenticator or Duo app, and not use mobile service at all. You just need a bit of wifi to enroll.

* You can write an OATH client as a J2ME MIDlet. When I was using a feature phone, I spent some time figuring out how to compile J2ME apps in 2015, by piecing together ten-year-old tutorials. It works fine; if you want me to dig up details let me know. (Alternatively, someone may have written one already, but I didn't search very hard.)

* You can, technically, run an OATH client on your computer. But at that point, you take responsibility for your two-factor auth being slightly less than two-factor.

To you last point... it's funny the number of companies that are using virtual 2fa clients on their laptops for VPN connections because they wanted to save money on hardware tokens. kind of negates the second half of 2fa.

It doesn't. The only case when it's worse is when your laptop is stolen and you don't know about that - very unlikely for corporate laptops

Or, monitoring software on your computer, the origin of which now has access to the computer, your password, and the token generator.

No, if your computer is infected (=monitoring software) there's no difference because token is transaction-agnostic. 2fa won't help

If you have a hardware token, not on the computer.. and use that as part of your VPN, if your computer is compromised, your account won't be able to be used to reconnect to VPN while you are afk without that hardware token... if the software/key are on the machine, they have your password, and the generator for 2fa... they don't even need your machine anymore... that is definitely less secure.

I have a Nokia 1020 Windows Phone. There is a Duo app for it, but it's single account. Duo hasn't updated their WP app since 2012.

I also have a Windows Phone. There's an official Microsoft 2FA app that I use instead of Google Authenticator or Duo, including now for multiple Slack accounts. http://www.windowsphone.com/en-us/store/app/authenticator/e7...

Slack was nice enough to point this out too. Works perfectly with the QRCode.

While I appreciate all the downvotes and "get with the times" comments, a significant portion of the population does not have a smartphone, assuming everyone has a smartphone or will instantly know what to do when presented with official instructions that only mention smartphones/tablets seems like a bit of a security oversight on Slack's part, no?

Those pointing out PC-enabled authentication apps: thanks. That's USEFUL feedback!

The vast majority of the population that comprises Slack customers will have a smartphone.

And only focusing on the "vast majority" is a GREAT security solution. There is some significant, non-zero number of people who use Slack and do not own a smart device. I am one of them. (reasons for choosing not to own a smart device are many and I will not go into them here)

I'm not trying to rake them over the coals, just point out this is a very real blind-spot and they should promptly update the notice with instructions for people who don't have smart-phones.

Can you expand just enough on the reasons for not owning a smartphone, so we can give constructive advice? I don't want to suggest things like "buy a Yubikey" or "buy a tablet or iPod Touch with no cell radio" if you're objecting to buying new things, for instance.

I think it's hard to give generic advice about this situation.

Smartphone - 58% of all US adults

source - http://www.pewinternet.org/data-trend/mobile/cell-phone-and-...

It's totally fine to use web based otp generator. Don't listen to others, you don't need a smartphone.

https://www.authy.com/

https://chrome.google.com/webstore/detail/authenticator/bhgh...

https://code.google.com/p/winauth/

and others, I'm sure

If security is that important to you, buy one. A cheap Android tablet isn't exactly going to break the bank, is it?

There are plenty of security reasons not to buy a smartphone.

Get an OTP app for your laptop. It's an open standard.

You can use http://gauth.apps.gbraad.nl/ on another computer or on same machine (wouldn't protect if computer is stolen, otherwise the same)

Buy a smartphone. You can get a Huawei on eBay for $20. You don't even need a sim or a contract, just connect to wifi and download the Authenticator app.

These usually fall back to regular text messages.

Buy some small and cheap one, no SIM card needed.

Get an abacus!

Slack is from the startup culture. Do not expect any support for people who are not "up with the times" and crud.

Reply on news.ycombinator.com