4 ms·
I think Aardwolf point is: if you have 2 different service providers (let's say DropBox and Google) authenticate you with an OTP generated from a single OTP see
by matthiasb 14y ago
I think Aardwolf point is: if you have 2 different service providers (let's say DropBox and Google) authenticate you with an OTP generated from a single OTP seed, they would need to share that seed on the server side and they won't. Today, I have one OTP generator for Google and one for DropBox.
- jgrahamc 14y agoYes, but that's not what Authy (and RFC 4226 in general) are expecting. They are allowing multiple seeds in the same app. So, you use one app and get different OTP for different sites.
- matthiasb 14y agoThe article mentions "Matthew Prince protected his Google Apps account with a second code that would be sent to his phone—so the hackers got his cell account". It means the phone was not secure enough to protect these codes. A dedicated hardware token is more secure, but if you have to carry 10 devices on your keychain, this is not very elegant and annoying.
- jgrahamc 14y agoMatthew Prince is my boss and I know what happened there. He was not using the type of system I am talking about (based on the RFC) but a system that does a voice call or SMS.
- stcredzero 14y agoFunny, but I have one app for both Google and Dropbox. (Google Authenticator)