3 ms·
An increasing number of websites are now offering their own authentication app, which uses a secure back channel to push authentication requests down to the use
by ttul 5y ago
An increasing number of websites are now offering their own authentication app, which uses a secure back channel to push authentication requests down to the user’s device.
While it’s a pain to have a dozen authentication apps on your phone, IMHO this method is just as secure as a hardware module while being much more convenient.
I’m sure that there is a start up that recently announced itself here on hacker news that is creating a universal authentication app that will allow any website to authenticate users in this way. Great idea.
- withinboredom 5y agoAuthy?
- donmcronald 5y agoHow does that help? If I put my credentials into a phishing site and then get a prompt on my phone to approve a login, why wouldn’t I click approve? Plus, then the attacker often gets a cookie showing their device passed 2FA.
- ttul 5y agoThe newest authenticators make a fingerprint of your browser and use that to select a random number that they show you in the app, along with other "controls". You have to pick the correct number, which of course the attacker will not have.
- chrisbolt 5y agoAnd what’s the recovery method for the authentication app? If it involves SMS...
- ttul 5y agoThe best practice is a piece of paper with backup codes on it. And if you don't store that properly, you're out of luck. Nothing is perfect, but paper in a safe is pretty good. The cryptocurrency world has introduced titanium backup code holders, where the code letters are literally etched into titanium. Bullet proof, fire proof, etc..