5 ms·

This is interesting for a few reasons: 1) I'm surprised it didn't happen sooner. There are a few turn-key two-factor auth solutions, and I expect having this a

This is interesting for a few reasons: 1) I'm surprised it didn't happen sooner. There are a few turn-key two-factor auth solutions, and I expect having this added security is a major benefit for their customers. 2) I'm surprised they chose to use Google Authenticator. The favourite in this space seems to be Authy; off the top of my head Cloudflare and DNSimple both use them. Any thoughts on the pros and cons?

seanponeil 14y ago
Most people who care about two factor already have Google Authenticator installed on their phone. Having the user install another app is tedious and a lot of users won't enable two factor because of it.
- pc86 14y ago
  I think most people who care about it would either (a) already have Authy installed, or (b) care enough that downloading another app isn't going to prevent them. When it's opt-in you're really not going to get a lot of people saying "Okay, I guess I'll do it if you make it really easy for me." It's either important or it's not. Most folks on HN would probably say it is and enable it as a matter of course, especially for a service with as much business value as Stripe.
  - chimeracoder 14y ago
    > I think most people who care about it would either (a) already have Authy installed, or (b) care enough that downloading another app isn't going to prevent them. I care, and I have Google Authenticator installed but not Authy. In fact, it's because I care that I don't have Authy installed - from their comments on HackerNews yesterday, I didn't get much confidence that the Authy folks understand security enough for me to trust them with something this important.
    - Firehed 14y ago
      Guy who brought up several of the concerns in yesterday's thread here - and I'm in the same situation. Actually, I went so far as to download the app just to see if I could crack the backups I was criticizing (i.e., are they actually using a key strengthening algorithm or was the founder just straight-up lying after all of the concern was made public), but when I couldn't get past an SMS-based login-wall to test, most of my initial fears were confirmed. My concerns and irritations about Google Authenticator also still stand; they half-implemented the spec[1] and have potentially limited everyone's security as a result. However, they didn't misimplement it, so they just limited the gains rather than actually made things worse. I think the QRCode to import the key is, uh, less safe than it could be, but assuming someone hasn't gone and posted screenshots of it to the internet or scanned it with multiple devices, it's not too bad. I started building a replacement a couple weekends ago to address some of these issues (though primarily because it hasn't been updated to support retina displays, never mind iPhone5), so Authy's timing is rather unfortunate as I've been in the thick of the spec and care deeply about security (I work for WePay; yes, we also have a public rollout of 2FA in the works, it's in internal beta right now). My plan is to give it away for free, if not open-source it completely. [1] the flexible options for the number of digits, time window, and hashing algorithm are all hardcoded in GA, despite their TOTP implementation actually supporting the full spec. The UI simply ignores all fields beside the label and secret, presumably because they decided to make a screen-wide counter rather than entry-wide. Why it's still forced to SHA1 and 6 digits is beyond me.
      - chimeracoder 14y ago
        > Authy's timing is rather unfortunate as I've been in the thick of the spec and care deeply about security (I work for WePay; yes, we also have a public rollout of 2FA in the works, it's in internal beta right now). My plan is to give it away for free, if not open-source it completely. I'd be very interested in this, Authy's timing notwithstanding. I think my email is in my profile - please let me know if/when you have something available (whether in beta or general release).
        Firehed 14y ago
  - boucher 14y ago
    Authy now supports Google Authenticator based systems.
apawloski 14y ago
There were concerns raised yesterday [1] about the way Authy backs up tokens. The founder's comments initially raised some major flags about their crypto usage [2], but later on they backtracked and indicated that they are in fact using a logical implementation [3]. The major pro is their seed length, which is significantly longer than Google Authenticator. The major con is you have to trust that they are using a secure system. [1]https://news.ycombinator.com/item?id=4916983 https://news.ycombinator.com/item?id=4916983 [2]https://news.ycombinator.com/item?id=4917283 https://news.ycombinator.com/item?id=4917283 [3]https://news.ycombinator.com/item?id=4917488 https://news.ycombinator.com/item?id=4917488
- chimeracoder 14y ago
  > The major con is you have to trust that they are using a secure system. From my discussion with the founder on that HackerNews thread yesterday (and his other comments on the thread), it seemed clear that they didn't have a good enough understanding of the space - both the technical security requirements and the existing solutions. If you're not clear on what problem you're trying to solve, I doubt that you understand the domain well enough to solve it properly - at least when it comes to security. Security is one field where 80% of the way isn't "good enough" - in fact, 80% may be worse than nothing at all.
  - dcu 14y ago
    Take it easy men, He already stated he was wrong. Do not punish him for wanting to answer fast and be open with the Hacker News community.
    - chimeracoder 14y ago
      > He already stated he was wrong. Do not punish him for wanting to answer fast and be open with the Hacker News community. First, he was way off the mark on a number of unrelated elements, not just the key-strengthening algorithm. While it's good that he owned up to his mistake, it's clear from his wording that he was shaky on the actual principles of security and encryption, not just My standards for a security-sensitive product are far higher than for anything else. Any person in any position of authority should have a very clear understanding of the security fundamentals being used. The last thing I want in a 2FA application is for an overeager PM to make a decision that inadvertently compromises the security of the product, in a well-meaning attempt to improve the UI, branding, monetization, etc.
cstejerean 14y ago
Google (obviously), Dropbox and AWS all support Google Authenticator, although Google Authenticator is just one client you can use on the client side. On the server side, one reason to run this in house is not having to depend on the availability and security of a 3rd party for something as fundamental as logging in.
nwh 14y ago
I can't even get Authy to install. I put in my mobile number (why?) and it tells me I haven't registered, with absolutely no indication of what to do now. http://imgur.com/CGeeS.jpg http://imgur.com/CGeeS.jpg
dschep 14y ago
2) Because they're using RFC 6238 TOTPs and Google Authenticator is a good client for it that people are comfortable with.
ProblemFactory 14y ago
> 2) I'm surprised they chose to use Google Authenticator. The favourite in this space seems to be Authy; off the top of my head Cloudflare and DNSimple both use them. Any thoughts on the pros and cons? Briefly looking at Authy, it seems they do make things reasonably easy. But the pro sides of Google Authenticator is that it's just an Open-Source app implementing open standards. It doesn't require any third parties or network communication to work, and you can add it even to unix logins or SSH.
rdl 14y ago
The favorite in this space is still sadly RSA's shitty SecurID physical tokens (in enterprise). For free/startup/saas things, it's RFC compliant HOTP/TOTP. Authy is one (not quite compatible) implementation of that, plus a management system. Google Authenticator is the #1 client I see on people's phones, even though it's kind of a zombie project at Google (from what I can tell).

seanponeil 14y ago

Most people who care about two factor already have Google Authenticator installed on their phone. Having the user install another app is tedious and a lot of users won't enable two factor because of it.

pc86 14y ago
I think most people who care about it would either (a) already have Authy installed, or (b) care enough that downloading another app isn't going to prevent them. When it's opt-in you're really not going to get a lot of people saying "Okay, I guess I'll do it if you make it really easy for me." It's either important or it's not. Most folks on HN would probably say it is and enable it as a matter of course, especially for a service with as much business value as Stripe.
- chimeracoder 14y ago
  > I think most people who care about it would either (a) already have Authy installed, or (b) care enough that downloading another app isn't going to prevent them. I care, and I have Google Authenticator installed but not Authy. In fact, it's because I care that I don't have Authy installed - from their comments on HackerNews yesterday, I didn't get much confidence that the Authy folks understand security enough for me to trust them with something this important.
  - Firehed 14y ago
    Guy who brought up several of the concerns in yesterday's thread here - and I'm in the same situation. Actually, I went so far as to download the app just to see if I could crack the backups I was criticizing (i.e., are they actually using a key strengthening algorithm or was the founder just straight-up lying after all of the concern was made public), but when I couldn't get past an SMS-based login-wall to test, most of my initial fears were confirmed. My concerns and irritations about Google Authenticator also still stand; they half-implemented the spec[1] and have potentially limited everyone's security as a result. However, they didn't misimplement it, so they just limited the gains rather than actually made things worse. I think the QRCode to import the key is, uh, less safe than it could be, but assuming someone hasn't gone and posted screenshots of it to the internet or scanned it with multiple devices, it's not too bad. I started building a replacement a couple weekends ago to address some of these issues (though primarily because it hasn't been updated to support retina displays, never mind iPhone5), so Authy's timing is rather unfortunate as I've been in the thick of the spec and care deeply about security (I work for WePay; yes, we also have a public rollout of 2FA in the works, it's in internal beta right now). My plan is to give it away for free, if not open-source it completely. [1] the flexible options for the number of digits, time window, and hashing algorithm are all hardcoded in GA, despite their TOTP implementation actually supporting the full spec. The UI simply ignores all fields beside the label and secret, presumably because they decided to make a screen-wide counter rather than entry-wide. Why it's still forced to SHA1 and 6 digits is beyond me.
    - chimeracoder 14y ago
      > Authy's timing is rather unfortunate as I've been in the thick of the spec and care deeply about security (I work for WePay; yes, we also have a public rollout of 2FA in the works, it's in internal beta right now). My plan is to give it away for free, if not open-source it completely. I'd be very interested in this, Authy's timing notwithstanding. I think my email is in my profile - please let me know if/when you have something available (whether in beta or general release).
      - Firehed 14y ago
- boucher 14y ago
  Authy now supports Google Authenticator based systems.

apawloski 14y ago

There were concerns raised yesterday [1] about the way Authy backs up tokens. The founder's comments initially raised some major flags about their crypto usage [2], but later on they backtracked and indicated that they are in fact using a logical implementation [3]. The major pro is their seed length, which is significantly longer than Google Authenticator. The major con is you have to trust that they are using a secure system. [1]https://news.ycombinator.com/item?id=4916983 https://news.ycombinator.com/item?id=4916983 [2]https://news.ycombinator.com/item?id=4917283 https://news.ycombinator.com/item?id=4917283 [3]https://news.ycombinator.com/item?id=4917488 https://news.ycombinator.com/item?id=4917488

chimeracoder 14y ago
> The major con is you have to trust that they are using a secure system. From my discussion with the founder on that HackerNews thread yesterday (and his other comments on the thread), it seemed clear that they didn't have a good enough understanding of the space - both the technical security requirements and the existing solutions. If you're not clear on what problem you're trying to solve, I doubt that you understand the domain well enough to solve it properly - at least when it comes to security. Security is one field where 80% of the way isn't "good enough" - in fact, 80% may be worse than nothing at all.
- dcu 14y ago
  Take it easy men, He already stated he was wrong. Do not punish him for wanting to answer fast and be open with the Hacker News community.
  - chimeracoder 14y ago
    > He already stated he was wrong. Do not punish him for wanting to answer fast and be open with the Hacker News community. First, he was way off the mark on a number of unrelated elements, not just the key-strengthening algorithm. While it's good that he owned up to his mistake, it's clear from his wording that he was shaky on the actual principles of security and encryption, not just My standards for a security-sensitive product are far higher than for anything else. Any person in any position of authority should have a very clear understanding of the security fundamentals being used. The last thing I want in a 2FA application is for an overeager PM to make a decision that inadvertently compromises the security of the product, in a well-meaning attempt to improve the UI, branding, monetization, etc.

cstejerean 14y ago

Google (obviously), Dropbox and AWS all support Google Authenticator, although Google Authenticator is just one client you can use on the client side. On the server side, one reason to run this in house is not having to depend on the availability and security of a 3rd party for something as fundamental as logging in.

nwh 14y ago

I can't even get Authy to install. I put in my mobile number (why?) and it tells me I haven't registered, with absolutely no indication of what to do now. http://imgur.com/CGeeS.jpg http://imgur.com/CGeeS.jpg

dschep 14y ago

2) Because they're using RFC 6238 TOTPs and Google Authenticator is a good client for it that people are comfortable with.

ProblemFactory 14y ago

> 2) I'm surprised they chose to use Google Authenticator. The favourite in this space seems to be Authy; off the top of my head Cloudflare and DNSimple both use them. Any thoughts on the pros and cons? Briefly looking at Authy, it seems they do make things reasonably easy. But the pro sides of Google Authenticator is that it's just an Open-Source app implementing open standards. It doesn't require any third parties or network communication to work, and you can add it even to unix logins or SSH.

rdl 14y ago

The favorite in this space is still sadly RSA's shitty SecurID physical tokens (in enterprise). For free/startup/saas things, it's RFC compliant HOTP/TOTP. Authy is one (not quite compatible) implementation of that, plus a management system. Google Authenticator is the #1 client I see on people's phones, even though it's kind of a zombie project at Google (from what I can tell).