4 ms·

I don't get it why standard TOTP is suddenly Google something. Afaik, it has nothing at all to do with Google. Except adding Google something make it sound bett

I don't get it why standard TOTP is suddenly Google something. Afaik, it has nothing at all to do with Google. Except adding Google something make it sound better? Maybe if I use TOTP app with my iPhone then i get really cool Apple iAuth?

zobzu 13y ago
It's called OATH btw :) (the standard that is)
- corin_ 13y ago
  That's the organisation behind the standard, not the standard.
dlitz 13y ago
Google Authenticator only offers a subset of standard TOTP, and it also offers a very similar subset of HOTP. - Option of TOTP or HOTP ("time-based" or "counter-based") - SHA1 only - 6-digit codes only - 30-second time step only (TOTP) - Base32-encoded keys only "Google Authenticator" also implies that the secret is stored on your phone, where it's far more susceptible to remote compromise than if it were stored in a dedicated hardware TOTP token. Personally, my preference for SSH two-factor authentication is to just use standard pubkey authentication, but only allow keys that have been placed into PIN-protected, tamper-resistant hardware. The crypto is stronger, it doesn't involve some obscure PAM module, and the attack surface is smaller (since you can avoid invoking PAM at all until after authentication succeeds).
- ciderpunx 13y ago
  > The crypto is stronger, it doesn't involve some obscure PAM module, and the attack surface is smaller (since you can avoid invoking PAM at all until after authentication succeeds). And your ability to access to your hardware isn't dependent on an external organisation. I mean its not unheard of for Google to close down accounts from time to time. I wouldn't want my keys in somebody elses safe...
  - sveiss 13y ago
    The keys aren't stored on Google's servers, only locally on your phone. Closing your Google account wouldn't affect them.

4 ms·

I don't get it why standard TOTP is suddenly Google something. Afaik, it has nothing at all to do with Google. Except adding Google something make it sound bett

by Sami_Lehtinen 13y ago

zobzu 13y ago
It's called OATH btw :) (the standard that is)
- corin_ 13y ago
  That's the organisation behind the standard, not the standard.
dlitz 13y ago
Google Authenticator only offers a subset of standard TOTP, and it also offers a very similar subset of HOTP. - Option of TOTP or HOTP ("time-based" or "counter-based") - SHA1 only - 6-digit codes only - 30-second time step only (TOTP) - Base32-encoded keys only "Google Authenticator" also implies that the secret is stored on your phone, where it's far more susceptible to remote compromise than if it were stored in a dedicated hardware TOTP token. Personally, my preference for SSH two-factor authentication is to just use standard pubkey authentication, but only allow keys that have been placed into PIN-protected, tamper-resistant hardware. The crypto is stronger, it doesn't involve some obscure PAM module, and the attack surface is smaller (since you can avoid invoking PAM at all until after authentication succeeds).
- ciderpunx 13y ago
  > The crypto is stronger, it doesn't involve some obscure PAM module, and the attack surface is smaller (since you can avoid invoking PAM at all until after authentication succeeds). And your ability to access to your hardware isn't dependent on an external organisation. I mean its not unheard of for Google to close down accounts from time to time. I wouldn't want my keys in somebody elses safe...
  - sveiss 13y ago
    The keys aren't stored on Google's servers, only locally on your phone. Closing your Google account wouldn't affect them.