4 ms·

The more I read about this, the more I think that 2-factor authentication is the future, whether it's using robocalls / texted codes sent to mobile phones, or j

The more I read about this, the more I think that 2-factor authentication is the future, whether it's using robocalls / texted codes sent to mobile phones, or just a security token. It's easier to just add one of the 3 types of authentication* to the mix rather than wrapping yet another layer of complexity around a single one of them. * (what you have, what you are, what you know)

Wingman4l7 14y ago
As far as personal security tokens go, I recently came across the YubiKey, which provides 2-factor auth using OTPs. It looks very promising, but I haven't used it myself, so I can't provide any anecdata on it.
mckoss 14y ago
Google authenticator is great; can be used on many sites (gmail, last pass, aws) and is based on an open standard that is to implement on your own servers.
jm3 14y ago
Duo Security, from some of the Open{BSD,SSH} guys, offers a nice two-factor auth layer that's pluggable into any web or online service; push notifications, SMS, or voice. Similar to Google Authenticator except that Duo isn't limited to Google supported services (although they did take an investment from Google Ventures).
K2h 14y ago
I have been reading the list of 2 factor at lastpass [1] and in addition to mentioning the yubikey, it talks about the grid multifactor [2] - probably about on par with what was used in WW2 but it seems extremely simple, low tech solution to multifactor that doesn't require computers, phones or electronics - solving that problem of 'something you know' + 'something you have' [1] http://helpdesk.lastpass.com/security-options/ http://helpdesk.lastpass.com/security-options/ [2] http://helpdesk.lastpass.com/security-options/grid-multifactor-authentication/ http://helpdesk.lastpass.com/security-options/grid-multifact...
- Wingman4l7 14y ago
  Sounds like you're referring to a one-time pad[1], which is what that grid looks like. Google's 2-factor auth has a simpler version of this -- they just give you 10 or so one-time passwords. I like the grid; it seems to have a much longer potential "lifetime" of use. [1]: http://en.wikipedia.org/wiki/One-time_pad http://en.wikipedia.org/wiki/One-time_pad
romaniv 14y ago
I hope not. Two-factor auth ties you down to a cellphone (or physical token) while giving you only marginal improvement in real-life usage scenarios. (You are not going to enter a new token every time you check your email or Facebook.) We have higher-level problems with authentication that need to be solved.
- Wingman4l7 14y ago
  I never said I liked it, I just thought that's where we might be headed. =/ As far as that goes, Google's 2-factor auth mitigates this a bit, with its "keep this auth instance valid for X days" option. (They also have a new "permanently auth this computer by adding it to a trusted list" option, which IMO defeats the point.)

Wingman4l7 14y ago

As far as personal security tokens go, I recently came across the YubiKey, which provides 2-factor auth using OTPs. It looks very promising, but I haven't used it myself, so I can't provide any anecdata on it.

mckoss 14y ago

Google authenticator is great; can be used on many sites (gmail, last pass, aws) and is based on an open standard that is to implement on your own servers.

jm3 14y ago

Duo Security, from some of the Open{BSD,SSH} guys, offers a nice two-factor auth layer that's pluggable into any web or online service; push notifications, SMS, or voice. Similar to Google Authenticator except that Duo isn't limited to Google supported services (although they did take an investment from Google Ventures).

K2h 14y ago

I have been reading the list of 2 factor at lastpass [1] and in addition to mentioning the yubikey, it talks about the grid multifactor [2] - probably about on par with what was used in WW2 but it seems extremely simple, low tech solution to multifactor that doesn't require computers, phones or electronics - solving that problem of 'something you know' + 'something you have' [1] http://helpdesk.lastpass.com/security-options/ http://helpdesk.lastpass.com/security-options/ [2] http://helpdesk.lastpass.com/security-options/grid-multifactor-authentication/ http://helpdesk.lastpass.com/security-options/grid-multifact...

Wingman4l7 14y ago
Sounds like you're referring to a one-time pad[1], which is what that grid looks like. Google's 2-factor auth has a simpler version of this -- they just give you 10 or so one-time passwords. I like the grid; it seems to have a much longer potential "lifetime" of use. [1]: http://en.wikipedia.org/wiki/One-time_pad http://en.wikipedia.org/wiki/One-time_pad

romaniv 14y ago

I hope not. Two-factor auth ties you down to a cellphone (or physical token) while giving you only marginal improvement in real-life usage scenarios. (You are not going to enter a new token every time you check your email or Facebook.) We have higher-level problems with authentication that need to be solved.

Wingman4l7 14y ago
I never said I liked it, I just thought that's where we might be headed. =/ As far as that goes, Google's 2-factor auth mitigates this a bit, with its "keep this auth instance valid for X days" option. (They also have a new "permanently auth this computer by adding it to a trusted list" option, which IMO defeats the point.)