3 ms·
After seeing this article I was able to add Google Authenticator as an authentication scheme for login.gov Perhaps the author of this article somehow mis-int
by chrispeel 7y ago
After seeing this article I was able to add Google Authenticator as an authentication scheme for login.gov Perhaps the author of this article somehow mis-interpreted the interaction with login.gov.
Of course there are far too many organizations which use text messages for authentication, as the article points out.
- itake 7y agoMy bet is they a victim to phishing
- tialaramex 7y agoLogin.gov wants them to stop using their "personal key" which was essentially another password. It didn't offer them Google Authenticator because they already /have/ Google Authenticator. It wants every user to have TWO (or more) second factors available, because "two is one and one is none". If we tell users to have one second factor, they will forget it and then why did we bother building a second factor system? So they need to pick another second factor they DON'T already have. They've apparently decided they don't want to write down 10 codes (fine) and they don't own a FIDO security key (I guess maybe they're poor?) so that only leaves SMS unless you have government ID. The correct thing to do here if you care about Security is to buy at least two different FIDO Security keys and use those. Each of your FIDO keys counts as a different method. If you have a shiny enough Android phone (maybe only Pixel series?) you can use that (in Windows). A new enough Windows PC might work too. But the tiny dedicated Security Keys are relatively affordable, you can get ones compatible with most plausible devices (iPhones, Linux PCs, whatever) and easy to reason about like real keys are. Has anybody stolen my FIDO key? No, it is here in my pocket. OK.