6 ms·

I think it's fair to say that any major service should be offering two factor authentication. Amazon does, Google does, Dropbox does, Facebook does. Why not App

by Osmium 14y ago

I think it's fair to say that any major service should be offering two factor authentication. Amazon does, Google does, Dropbox does, Facebook does. Why not Apple too? Why not Twitter? Somewhat related, if anyone wants to get two factor auth working for their OS X login, instructions are at the bottom of this page: https://code.google.com/p/google-authenticator/wiki/PamModuleInstructions https://code.google.com/p/google-authenticator/wiki/PamModul... Though I can't speak to how well it works (if at all) it at least makes me hopeful someone will implement it more sensibly at a later date...

eridius 14y ago
I don't think TFA works well for securing mobile devices, because the entire premise is that it sends the second authentication token to your mobile device.
- duaneb 14y ago
  Ideally it would be a yubikey or something not attached to your phone anyway.
- robmil 14y ago
  Even then, it would be better than the status quo — you'd need physical access to my phone to access my Apple account, preventing the kind of remote attacks that were made famous recently.
kmfrk 14y ago
I'm sure it's not there for usability reasons. That is no excuse for not providing basic TFA for users who know how important it is, however miserable the user experience may be.
malbiniak 14y ago
I'd be very leery of running any unofficial two factor authentication. Heck, even 1Password urged their users to wait out the initial Dropbox TFA rollout. http://blog.agilebits.com/2012/08/27/dropbox-two-step-authentication-1password/ http://blog.agilebits.com/2012/08/27/dropbox-two-step-authen...
rdl 14y ago
There are better ways to do "two factor authentication" than TOTP/HOTP, if you control the client device. Apple could much more properly do something with embedded keys on the iPhone (and next-gen Macs), in addition to passwords, email, and KBA. I'd consider it acceptable if Apple restricted some actions to Apple client devices, if you've got an apple client device registered, at least as an option. Twitter is unforgivable, though. They have a fucking mobile client and are pushing that hard (at the expense of their developers). They are fairly neutral and non-hated by both Apple and Google (and probably Microsoft and RIM too). They are pushing Twitter logins to services. They borged one of the best cryptographic software developers (Moxie). They have users in places like Syria where compromise of an account can lead to torture and death. It would be so obvious to turn the Twitter mobile client into a key management app and security tool, both for Twitter and for services using Twitter login. (Facebook could do the same, modulo some hate from Google and Apple).
- Firehed 14y ago
  If you control the client device, it's not really suitable as a second factor in a two-factor authentication system. To elaborate: on a PIN debit payment, for example, there are two factors - something you have (the debit card) and something you[1] know (the PIN). In the case of authorizing the purchase of an app, you obviously have physical access to the device, or else you wouldn't be able to get to the checkout screen. For an actual second factor in a MFA scheme, it would be necessary to have a _different_ device that only the user with authority to make a purchase would have access to. One could argue that if the device is PIN-locked, this is sufficient; however, in this case, you're replacing a physical factor (having the device) with a knowledge factor (knowing the unlock code). Combined with the account password [2], you still only have one-factor auth, it's just two steps. This is like most banking logins: there's a single authentication factor - knowledge - but two different pieces of data are necessary. Worse yet, that "mother's maiden name"-type info tends to be a) relatively easy to access as an unauthorized user and b) used to authorize password reset, thereby reducing the security of a possibly-great password down to your facebook account's privacy settings. Suffice to say, proper MFA support when the device often used as the physical factor is part of what's being authenticated is non-trivial, and almost by definition requires additional hardware. Perhaps some sort of NFC/RFID tag that you'd keep in your wallet, or a less clumsy equivalent of an RSA keyfob (which is where TOTP came from in the first place). But the key takeaway here is that you cannot use the device being authenticated as part of the authentication scheme. [1] and only you, I hope! otherwise there's no point. [2] or worse, not, as some have suggested for free or even paid apps
BryantD 14y ago
Duo Security has a tested module for OS X: https://www.duosecurity.com/docs/duounix https://www.duosecurity.com/docs/duounix This doesn't help at all for Apple ID, though.
Firehed 14y ago
Where is MFA support on Facebook? That's something I'd like to enable...
- psherman 14y ago
  I don't have this activated myself, but I assume that Osmium is referring to this setting: Account Settings > Security > Login Approvals
  - Firehed 14y ago
    Ah, very cool - did not know that existed. Thanks!

by Osmium 14y ago

eridius 14y ago

I don't think TFA works well for securing mobile devices, because the entire premise is that it sends the second authentication token to your mobile device.

duaneb 14y ago
Ideally it would be a yubikey or something not attached to your phone anyway.
robmil 14y ago
Even then, it would be better than the status quo — you'd need physical access to my phone to access my Apple account, preventing the kind of remote attacks that were made famous recently.

kmfrk 14y ago

I'm sure it's not there for usability reasons. That is no excuse for not providing basic TFA for users who know how important it is, however miserable the user experience may be.

malbiniak 14y ago

I'd be very leery of running any unofficial two factor authentication. Heck, even 1Password urged their users to wait out the initial Dropbox TFA rollout. http://blog.agilebits.com/2012/08/27/dropbox-two-step-authentication-1password/ http://blog.agilebits.com/2012/08/27/dropbox-two-step-authen...

rdl 14y ago

There are better ways to do "two factor authentication" than TOTP/HOTP, if you control the client device. Apple could much more properly do something with embedded keys on the iPhone (and next-gen Macs), in addition to passwords, email, and KBA. I'd consider it acceptable if Apple restricted some actions to Apple client devices, if you've got an apple client device registered, at least as an option. Twitter is unforgivable, though. They have a fucking mobile client and are pushing that hard (at the expense of their developers). They are fairly neutral and non-hated by both Apple and Google (and probably Microsoft and RIM too). They are pushing Twitter logins to services. They borged one of the best cryptographic software developers (Moxie). They have users in places like Syria where compromise of an account can lead to torture and death. It would be so obvious to turn the Twitter mobile client into a key management app and security tool, both for Twitter and for services using Twitter login. (Facebook could do the same, modulo some hate from Google and Apple).

Firehed 14y ago
If you control the client device, it's not really suitable as a second factor in a two-factor authentication system. To elaborate: on a PIN debit payment, for example, there are two factors - something you have (the debit card) and something you[1] know (the PIN). In the case of authorizing the purchase of an app, you obviously have physical access to the device, or else you wouldn't be able to get to the checkout screen. For an actual second factor in a MFA scheme, it would be necessary to have a _different_ device that only the user with authority to make a purchase would have access to. One could argue that if the device is PIN-locked, this is sufficient; however, in this case, you're replacing a physical factor (having the device) with a knowledge factor (knowing the unlock code). Combined with the account password [2], you still only have one-factor auth, it's just two steps. This is like most banking logins: there's a single authentication factor - knowledge - but two different pieces of data are necessary. Worse yet, that "mother's maiden name"-type info tends to be a) relatively easy to access as an unauthorized user and b) used to authorize password reset, thereby reducing the security of a possibly-great password down to your facebook account's privacy settings. Suffice to say, proper MFA support when the device often used as the physical factor is part of what's being authenticated is non-trivial, and almost by definition requires additional hardware. Perhaps some sort of NFC/RFID tag that you'd keep in your wallet, or a less clumsy equivalent of an RSA keyfob (which is where TOTP came from in the first place). But the key takeaway here is that you cannot use the device being authenticated as part of the authentication scheme. [1] and only you, I hope! otherwise there's no point. [2] or worse, not, as some have suggested for free or even paid apps

BryantD 14y ago

Duo Security has a tested module for OS X: https://www.duosecurity.com/docs/duounix https://www.duosecurity.com/docs/duounix This doesn't help at all for Apple ID, though.

Firehed 14y ago

Where is MFA support on Facebook? That's something I'd like to enable...

psherman 14y ago
I don't have this activated myself, but I assume that Osmium is referring to this setting: Account Settings > Security > Login Approvals
- Firehed 14y ago
  Ah, very cool - did not know that existed. Thanks!