4 ms·

Wow, there is quite a competition in authentication right now. A week ago I only knew about Google Authenticator, and now I already found about: * Authy * Duo

by M4v3R 13y ago

Wow, there is quite a competition in authentication right now. A week ago I only knew about Google Authenticator, and now I already found about: * Authy * Duo Security * GetProve * MePIN * LaunchKey * And now SnowShoe Stamp (it's a physical object you need for authentication) All these have quite different goals, but strive to solve one problem - secure authentication. It will be interesting to watch how this develops. PS. From all these I personally like Authy the most, but for my use case (many auths throughout the day from many users) it's too expensive. 20,000 API calls (for $99/mo plan) may seem a lot, but having only 500 users doing 4 auths per day will use it up already. EDIT: Actually, the ideal solution would be to have an open source implementation of Authy, that you could deploy on your own web server, complete with corresponding iOS/Android Apps. One can dream...

bowmessage 13y ago
I'm being pedantic, but 500 * 4 != 20000
- M4v3R 13y ago
  5*400 = 2,000, a day. Multiply this by 30 days and you already have 60,000 auths per month, while only 20,000 are in the $99 plan.
timothy89 13y ago
Here's one more: AlterEgo (https://alteregoapp.com https://alteregoapp.com)
Spearchucker 13y ago
GridSure[1] is (was) another one. They've just gone into liquidation. Their story is yet another example of what appears to be a great idea, killed by being closed. If something like this is going to work it needs to be widely available, cheap if not free, and obviously, easy (UX and dev), while being secure. http://www.gridsure-security.co.uk/ http://www.gridsure-security.co.uk/
mbq 13y ago
Something a bit different, but worth mentioning: http://barada.sourceforge.net/ http://barada.sourceforge.net/
VLM 13y ago
"an open source implementation of Authy" Something like http://www.norlin.se/blog/pam-module-for-sending-one-time-passwords-otp-via-sms/ http://www.norlin.se/blog/pam-module-for-sending-one-time-pa... An alternative not exactly what you asked for, but does meet the "free and uses a (android) phone" criteria: http://barada.sourceforge.net/ http://barada.sourceforge.net/ I've never messed around with PAM other than the usual kerberos / ldap / afs_session stuff, and some researching. I did have the interesting idea that I could use one of the uncountable zillions of OTP implementations to generate a massive list of OTP tokens for a user (me). Then the server emails / sms or whatever precisely one OTP per hour. That solves the "I'll spend any time and money to avoid having to carry a paper printout of OTP keys". Although in a cost benefit analysis, for $100/month I think I could justify carrying around a piece of paper... You could short circuit the OTP paper printout by simply (automatically?) shoving the whole list into your dropbox/evernote/email/whatever as a text file. One obvious problem with sending a SMS every time user tries to log in, is if a swarm of 10000 zombie windows machines in China all decide to brute force your root (assuming you even allow direct root, or allow password auth as opposed to key auth) then even if you use some rate limiting to block each IP at 3 attempts, that still going to try to send 30000 SMS messages to the poor admin. So its hardly unique in the world of security to say "be careful", but... "be careful".

by M4v3R 13y ago

bowmessage 13y ago

I'm being pedantic, but 500 * 4 != 20000

M4v3R 13y ago
5*400 = 2,000, a day. Multiply this by 30 days and you already have 60,000 auths per month, while only 20,000 are in the $99 plan.

timothy89 13y ago

Here's one more: AlterEgo (https://alteregoapp.com https://alteregoapp.com)

Spearchucker 13y ago

GridSure[1] is (was) another one. They've just gone into liquidation. Their story is yet another example of what appears to be a great idea, killed by being closed. If something like this is going to work it needs to be widely available, cheap if not free, and obviously, easy (UX and dev), while being secure. http://www.gridsure-security.co.uk/ http://www.gridsure-security.co.uk/

mbq 13y ago

Something a bit different, but worth mentioning: http://barada.sourceforge.net/ http://barada.sourceforge.net/

VLM 13y ago

"an open source implementation of Authy" Something like http://www.norlin.se/blog/pam-module-for-sending-one-time-passwords-otp-via-sms/ http://www.norlin.se/blog/pam-module-for-sending-one-time-pa... An alternative not exactly what you asked for, but does meet the "free and uses a (android) phone" criteria: http://barada.sourceforge.net/ http://barada.sourceforge.net/ I've never messed around with PAM other than the usual kerberos / ldap / afs_session stuff, and some researching. I did have the interesting idea that I could use one of the uncountable zillions of OTP implementations to generate a massive list of OTP tokens for a user (me). Then the server emails / sms or whatever precisely one OTP per hour. That solves the "I'll spend any time and money to avoid having to carry a paper printout of OTP keys". Although in a cost benefit analysis, for $100/month I think I could justify carrying around a piece of paper... You could short circuit the OTP paper printout by simply (automatically?) shoving the whole list into your dropbox/evernote/email/whatever as a text file. One obvious problem with sending a SMS every time user tries to log in, is if a swarm of 10000 zombie windows machines in China all decide to brute force your root (assuming you even allow direct root, or allow password auth as opposed to key auth) then even if you use some rate limiting to block each IP at 3 attempts, that still going to try to send 30000 SMS messages to the poor admin. So its hardly unique in the world of security to say "be careful", but... "be careful".