Hacker News Reader

Comment by cheshire137 | Hacker News Reader

Looks like they require Google Authenticator or Duo Mobile app to do two-factor auth. I'm not interested. Why can't they be like Github and just send me a text message? I don't want a dependency on some other company's product to make Slack more secure.

View on HN

I hate to break it to you but SMS is some other company's product. Google Authenticator is not a cloud service; it's simply an implementation of the TOTP RFC and there are others available if you hate Google so much that you don't trust a purely local app written by them.

An open source one at that!

https://github.com/google/google-authenticator/

Google Authenticator is a free-standing app with no dependency on you having a Google account whatsoever. It doesn't even have Google account integration as an optional feature. It also uses algorithms documented in public RFCs, and there are about a thousand compatible, alternative, implementations because it's so damn trivial. Stop whinging.

Those are only two examples of apps that support TOTP[0]. TOTP is a standard with many implementing apps, including free and open source that will accomplish the same thing. The two apps listed on the website are just well known examples.

[0] http://en.wikipedia.org/wiki/Time-based_One-time_Password_Al...

Google Authenticator relies on an open algorithm for one time passwords. It has been implemented by many apps, and it's so simple you can do it yourself. So it doesn't require you to rely on other company's product.

SMS is far more insecure than Google Authenticator. Also, you can use other apps like authy if you don't want to use Google Authenticator for whatever reason.

You can use any other TOTP-based application instead of Google Authenticator. Plus, unlike SMS, it works offline.

> I don't want a dependency on some other company's product to make Slack more secure.

How is dependency on SMS not dependency on some other company's product?

SMS is the worst kind of 2fa, better not use it at all.

You can use other apps such as Authy too.

Wish Clef would integrate with Google Authenticator, https://getclef.com/

Feels like a much nicer way to provide the "something I have" part of authentication.

Reply on news.ycombinator.com