3 ms·

Well, only if the person has 2FA set up in their Google account, which most people don't in my experience. That aside, do you have a recommendation for auth th

Well, only if the person has 2FA set up in their Google account, which most people don't in my experience. That aside, do you have a recommendation for auth that provides good privacy while also having wide adoption and ease of integration similar to Google or Facebook auth? And also 2FA of course. If there are no options then I think our problem is bigger than this particular dev's ideology.

hedora 4y ago
Username and password: Factor #1 - Thing you have: encrypted password vault. Factor #2 - Thing you know: password to said vault. Of course, this is only 2FA from the user's perspective. Meddling websites cannot ensure that you didn't memorize their password, or write it down unencrypted.
- thealchemistdev 4y ago
  Multifactor authentication is a combination of 2 or more of the following factors. - Something you know: password. - Something you have: your phone or a physical key. - Something you are: Biometrics (finger-print, eye pattern, gait of your walk, etc.) Using 2 passwords, such as the case of knowing the password to your vault of passwords, is only 1 factor.
  - alexchamberlain 4y ago
    I think the GP was implying that the vault would store a random string, which would be unreasonable for anyone to possibly guess. This isn't either of the factors - just a proof you had both of them. The 2 factors are then the vault itself and the vaults password. It should be noted, though, this is significantly weaker than "real" 2FA, as normally that would involve some sort of challenge, rather than just storing a hard secret.
askvictor 4y ago
Google have enabled 2FA by default.
deleted 4y ago
[deleted]
cmeacham98 4y ago
It's not that difficult to roll your own secure auth, this website is halfway there. Add TOTP and Webauthn and they're basically done (there's plenty of good libraries out there for both). They also really should switch from bcrypt to something more modern like argon2, but bcrypt is a lot better than the unsalted MD5 I've seen in a lot of places.

hedora 4y ago

Username and password: Factor #1 - Thing you have: encrypted password vault. Factor #2 - Thing you know: password to said vault. Of course, this is only 2FA from the user's perspective. Meddling websites cannot ensure that you didn't memorize their password, or write it down unencrypted.

thealchemistdev 4y ago
Multifactor authentication is a combination of 2 or more of the following factors. - Something you know: password. - Something you have: your phone or a physical key. - Something you are: Biometrics (finger-print, eye pattern, gait of your walk, etc.) Using 2 passwords, such as the case of knowing the password to your vault of passwords, is only 1 factor.
- alexchamberlain 4y ago
  I think the GP was implying that the vault would store a random string, which would be unreasonable for anyone to possibly guess. This isn't either of the factors - just a proof you had both of them. The 2 factors are then the vault itself and the vaults password. It should be noted, though, this is significantly weaker than "real" 2FA, as normally that would involve some sort of challenge, rather than just storing a hard secret.

askvictor 4y ago

Google have enabled 2FA by default.

deleted 4y ago

[deleted]

cmeacham98 4y ago

It's not that difficult to roll your own secure auth, this website is halfway there. Add TOTP and Webauthn and they're basically done (there's plenty of good libraries out there for both). They also really should switch from bcrypt to something more modern like argon2, but bcrypt is a lot better than the unsalted MD5 I've seen in a lot of places.