7 ms·
Authy: One token to rule them all
- asveikau 14y agoCan someone put a moratorium on startup names that end in "-y" or "-ly"? After a few of these it gets irritating. Maybe the next one will be called "obnoxiously".
- TylerE 14y ago<Insert XKCD cartoon about new standards here>
- lazerwalker 14y agoAuthy, Google, and Dropbox all adhere to the same pre-existing open standard. This just lets you generate different auth keys for different tokens from the same app, instead of having to have multiple native apps (Dropbox, Google Authenticator, etc) to each generate their own key using the same algorithm.
- danielpal 14y agoEXACTLY!
- drivebyacct2 14y agoNot to discredit Authy here, given they're admirably embracing the open standard, but Google Authenticator happily takes any OTP code.
- shinratdr 14y agoBut their iOS app is 1000x uglier. Swapped my Google Auth credentials into Authy as soon as I realized I had the option.
- scottmp10 14y agoIs this "condoned" by Google or does Authy just emulate the algorithm that Google uses? If they are just implementing their own version, then what secret info do they need for the algorithm?
- danielpal 14y agoBoth Authy and Google are based on open standards: Specifically: http://tools.ietf.org/html/rfc6238 http://tools.ietf.org/html/rfc6238 So you can add support as long as you support the standard. When you scan the QR Code with you camera we read a secret key and store it inside your phone securely.
- scottmp10 14y agoOk that makes sense, thanks.
- dtjohnnymonkey 14y agoI'm reading RFC 6238 and it looks like it's based on a single shared secret: > Basically, the output of the HMAC-SHA-1 calculation is truncated to > obtain user-friendly values: > > HOTP(K,C) = Truncate(HMAC-SHA-1(K,C)) > > where Truncate represents the function that can convert an HMAC-SHA-1 > value into an HOTP value. K and C represent the shared secret and > counter value; Does that mean it's formally/theoretically equivalent to simply having two separate passwords?
- danielpal 14y agoAbsolutly not. It's one secret seed but you use the time to generate different One Time Passwords every 10 seconds, which means you never reuse passwords. This would be the equivalent of having 2 passwords, one of which you change every-time you use it and it's fully random.
- dtjohnnymonkey 14y agoSo just to rephrase it to make sure I understand, it's more secure because even if the OTP is compromised, the entire system is not compromised, is that correct? However, if the original secret is compromised (K), then could an attacker easily generate OTPs?
- spindritf 14y agoI may be dense but if you back up the tokens and protect that online backup with a password, don't you eliminate the second factor? Now the attacker just needs to get two passwords (to the backup at Authy and to whatever account) so it's reduced to just something you (may) know.
- danielpal 14y agoNot at all. The attacker would need to get the encryption key and also access to the Authy Backup. Then they also need the password for your account. That said, backups are optional, you can skip them and your account will remain on your phone only.
- scottmp10 14y agoNo they don't need the encryption key just like you don't if you get a new phone. They just need to know your password, send it to Authy, and Authy will decrypt the backup and send it to them. Edit: I can't reply to the comments on this but they contain the exact procedure an attacker would have to go through, which, if correct, is much more difficult than just knowing the password.
- danielpal 14y agoThat's not at all how backups work. In order for a hacker to download the and decrypt the account they would need to: 1. Access to your e-mail to click a link confirming you changed your cellphone. 2. Access to your phone # to be able to get the SMS message with the registration key. 3. The encryption key you used. If they can do all 3 they would get access to your account. If you feel that the level of security there is not good enough for you, you can disable the backups and key will never ever leave your phone
- X-Istence 14y agoI like how there is a nice catch-22 there ... I may need access to my OTP to gain access to 1, yet I need access to 1 to get access to my OTP.
- nbashaw 14y agoJust FYI, the images look terribly stretched on my iPhone
- danielpal 14y agoHm, which iPhone do you have? Is it a 3GS? We use very detailed images etc that just don't look great on non-retina display. Retina images will look great.
- bcambel 14y agoYou better replace your development error pages with proper 404 Take a look at http://blog.authy.com/feed http://blog.authy.com/feed
- danielpal 14y agoThanks!. We're using Blossome, a blog engine I wrote for developers: https://github.com/danpal/blossome https://github.com/danpal/blossome I've been meaning to add lots of features, I jsut haven't had the time. This holiday vacations I am going to the beach, so I'll be hacking on Blossome there a lot.
- nacs 14y agoBottom of the error page says "You're seeing this error because you have enabled the show_exceptions setting." Might want to just turn that off now and hack around with Blossome in-depth later ;)
- mannkind 14y agoLooks like the someone from Authy is reading this thread so here goes... Feedback: * Registration is a bit complex; all texts to my phone (with the exception of the registration code) are completely useless as the real info is sent to my email address * Why is my backup encryption key in plain text? A dual-password field with sameness-checks would be better. * Restoring from backup is... painful. - I cannot just reregister my phone, I have to go through a reset process online. Ok, fine. I got texts to my phone instantly but the reset email took almost 15 minutes to reach me. - The app crashes tapping any "GA" item other than the first one. - I have to type in my encryption key for each "GA" item and the app crashes each and every time. - The first time I tried to restore authy, after typing in my encryption key to recover the first "GA" item, the app crashed and wouldn't let me recover any of the other items... I had to do the whole process all over again. * Aside from the above, the app looks and works so much better than Google Authenticator on my iPhone (5). Especially considering I'll be able to recover my tokens when switching phones -- Google Authenticator completely screws this up (broken phone? Get a replacement phone from Apple? Upgrade? All your tokens in Google Authenticator are lost, even if you recover from backup).
- danielpal 14y ago#1. Agree. Although non-technical people do find them useful. You yourself are just a bit more technical and have a better grasp. Problem is some of our users didn't even know how to install an App etc. We are thinking of ways of making registration easier. #2. Because you only have to enter it once and it's a complex field, you should see what you are typing. #3. App shouldn't crash. The reason you have to go through the online process is mostly for security, you wouldn't want it to be just super easy. The other problems seem like bugs.? We'll fix those, can you e-mail me at support@authy.com, i'd like to get repro steps. #4 Thanks!. Let's get the above fixed.
- kmfrk 14y agoAll your tokens in Google Authenticator are lost, even if you recover from backup So restoring from an iCloud back-up won't save my bacon in this case?
- 14y ago
- kmfrk 14y agoI don't know if likening yourselves to Sauron will assuage our caution to adopt your tool. :)
- seanponeil 14y agoLooks like the back button is broken on the Android app. I can't hit the back button and leave the app from the registration Activity.
- martinced 14y agoWhat could possibly go wrong when using a device that is connected to the Internet as a 2nd form factor? That's not just a criticism of this app: all the apps that advertize a device that is connected to the Internet as a "2nd form factor" is using deception to lure people in. There's no way this is "Two-Factor" in the same way that a physical RSA token is "Two-Factor".
- SCdF 14y agoI'm not sure what you mean here. Everything is stored locally, so it's not like it's going off to a website to get your token. Are you saying that because the device is networked it is by definition vulnerable to hackers and so cannot be a high quality 2FA device? If so I completely agree, except to point out that if I use a couple of banks (some are better for cards, some are better for savings), and Google and I play WoW and I (insert other service that uses 2FA here) then that's going to be a lot of physical doo-dads I have to keep track of. It's an unfortunate reality, but having all these things attached to one 'smart' device is the only real way of making them viable after you get more than one.
- marshray 14y agoKeep in mind that you're usually expected to enter the OTP generated by the RSA token into the same web browser that sees your password. It just makes it so the attacker has to exploit the stolen credentials right away, instead of storing them for later use. I think there's some value in that though.
- SCdF 14y agoThis is interesting, I've never considered using an alternative app for google 2fa tokens.. mostly because the app Just Works. It's literally one tap and it shows the token I need to type into the website, I'm not sure how it could get any simpler. Since the authy guys seem to be around, if the only 2fa I have is on my Google accounts, what is the advantage of using Authy over the standard Google Authenticator app (on Android, fwiw)?
- freshhawk 14y agoSeems like a complicated way to turn two factor off while leaking information to yet another 3rd party.
- asfdfdasfafdsss 14y agoThere is only one semi-reliable auth method: deep body scan + DNA + mitochondrial RNA + retina scan fuzzy match. Passwords and 2 factor auth suck. And so will embedded/mark IDs, which I will never, ever use. This is a good idea- everyone worth their salt wants a third-party single auth service, perhaps one that we pay an annual fee for, however this ain't it yet. You should not piggyback. Don't.
- cynix 14y agoNow if it can import all my RSA key fobs...