4 ms·

I already have 4 different fobs on my keychain (not counting my YubiKey for LastPass). I'm not quite sure what I'll do when every website has one and I'll need

by fintler 13y ago

I already have 4 different fobs on my keychain (not counting my YubiKey for LastPass). I'm not quite sure what I'll do when every website has one and I'll need 20 of them. It also doesn't help that they're all unlabeled. Edit: I just realized I actually have 6 fobs, but I only keep 4 on my keychain.

calebegg 13y ago
Lots of sites use RFC 6238 -- Github probably would too. Then you can just use Google Authenticator (or similar) to manage them.
- mdaniel 13y ago
  I was so disappointed that Twitter's TFA didn't choose to go with the mechanism you mentioned. Is there a compelling reason not to use it?
  - Sealy 13y ago
    Because they wanted to annoy Kim Dotcom.
    - mdaniel 13y ago
      I'm sorry, I don't get the joke. Does he break into people's Twitter accounts?
zokier 13y ago
I suspect that smartphones will be the future of authentication, for better or worse. It would be neat if you could tap your phone at your computer to authenticate with actually secure crypto handshake over NFC. Most likely we'll be stuck on google-authenticator -like stuff, which feels bit of a kludge in comparison.
- fintler 13y ago
  I work in an environment where radios and cameras of any kind aren't allowed (not an unreasonable policy for where I work). So, I'll be stuck with the fobs for a bit. The trend of everything moving towards smartphones limits my options. However, YubiKey OTP works well, so it's not a big issue -- I just hope more competition pops up. Also, personally I trust fobs more than my smartphone. My smartphone is a device which is always connected to a network. I don't want to be one remote exploit and a password leak away from having every credential I control compromised.
chatmasta 13y ago
Of all the sites to have two factor authentication, GitHub is probably the most important, maybe even more so than email clients. If your email is compromised, you are the only one who suffers directly. But if a large repo gets compromised, every single user of that repo could be compromised. I imagine there is some widely distributed auto updating desktop software that depends on GitHub repos. Imagine if one of those repos was suddenly changed to include a key logger for example. A lot more than one person would suffer.

by fintler 13y ago

calebegg 13y ago

Lots of sites use RFC 6238 -- Github probably would too. Then you can just use Google Authenticator (or similar) to manage them.

mdaniel 13y ago
I was so disappointed that Twitter's TFA didn't choose to go with the mechanism you mentioned. Is there a compelling reason not to use it?
- Sealy 13y ago
  Because they wanted to annoy Kim Dotcom.
  - mdaniel 13y ago
    I'm sorry, I don't get the joke. Does he break into people's Twitter accounts?

zokier 13y ago

I suspect that smartphones will be the future of authentication, for better or worse. It would be neat if you could tap your phone at your computer to authenticate with actually secure crypto handshake over NFC. Most likely we'll be stuck on google-authenticator -like stuff, which feels bit of a kludge in comparison.

fintler 13y ago
I work in an environment where radios and cameras of any kind aren't allowed (not an unreasonable policy for where I work). So, I'll be stuck with the fobs for a bit. The trend of everything moving towards smartphones limits my options. However, YubiKey OTP works well, so it's not a big issue -- I just hope more competition pops up. Also, personally I trust fobs more than my smartphone. My smartphone is a device which is always connected to a network. I don't want to be one remote exploit and a password leak away from having every credential I control compromised.

chatmasta 13y ago

Of all the sites to have two factor authentication, GitHub is probably the most important, maybe even more so than email clients. If your email is compromised, you are the only one who suffers directly. But if a large repo gets compromised, every single user of that repo could be compromised. I imagine there is some widely distributed auto updating desktop software that depends on GitHub repos. Imagine if one of those repos was suddenly changed to include a key logger for example. A lot more than one person would suffer.