5 ms·

There are a few advantages you're not mentioning: 1) This is two factor authentication. I don't trust any of my really "essential" accounts like GMail or Coinb

by habosa 13y ago

There are a few advantages you're not mentioning: 1) This is two factor authentication. I don't trust any of my really "essential" accounts like GMail or Coinbase without two factor. And all of the problems you mentioned around needing your phone are common to nearly all two-factor auth solutions. 2) More secure password. You won't be susceptible to many brute-force based hacking methods because your password won't be in any rainbow tables or anything like that.

icebraining 13y ago
This is not two factor authentication, since it eliminates one of the factors (the password). Gmail's doesn't, so that is two factor auth.
- habosa 13y ago
  Clef app has a PIN. And my phone has a lock screen password.
  - icebraining 13y ago
    No, because you're not authenticating to the service. Think about what would happen if your phone gets owned by some malware that escalates to root. It can simply log the PIN, extract the key and then login as it wishes. That's because the phone is the single factor for the service. Compare that with the auth against, say, Gmail, where even if a malware were to own the Authenticator, it still couldn't login as you, since your password goes directly to the service.
PakG1 13y ago
I finally installed Google Authenticator on my phone yesterday because Digital Ocean utilizes it. It's great. Like RSA stuff, only more convenient. And hopefully given the response of Google's security people to NSA activity, more secure than the RSA stuff. This thing basically looks like a more automated version of Google Authenticator. Cool, but meh, would it really change my life? But maybe it would make a difference for the same market that feels like the iPhone 5s's fingerprint scanner is way more convenient than previous security mechanisms on the iPhone and so can never go back. I dunno.
- Zikes 13y ago
  Google's Authenticator 2FA system is based on an open standard [1], and can even be implemented on your own/other web sites. Given the open nature of the standard, that can be considered an additional safeguard against NSA exposure. [1] http://en.wikipedia.org/wiki/Google_Authenticator http://en.wikipedia.org/wiki/Google_Authenticator
- Corrado 13y ago
  May I suggest you try the Authy[1] app for your phone. Its much prettier than GA, has a PIN screen lock, and can save your encrypted credentials in case you lose your phone. Plus, if you run OS X it will sync to your computer's clipboard via Bluetooth. [1] https://www.authy.com/ https://www.authy.com/
  - PakG1 13y ago
    While this is cool, I don't think I can replace GA with this because GA is the one implemented by the services I use, yeah? I can only use this for services that implement this.
    - sgjennings 13y ago
      Authy's app works with Google Authenticator-compatible sites. Authy also has its own two-factor system, but you're not required to use it.
bskap 13y ago
How is this two factor? As near as I can tell, it replaces your password (something you know) with your phone (something you have). It doesn't add a second factor to the auth.
- res0nat0r 13y ago
  Two factor auth is defined as something you know plus something you have. Two-step verification (also known as two-factor authentication) is a process involving two stages to verify the identity of an entity trying to access services in a computer or in a network. This is a special case of a multi-factor authentication which involves the presentation of two or more of the three authentication factors: a knowledge factor, a possession factor, and an inherence factor.
  - NateDad 13y ago
    Their point was, there's only one factor here: something you have. There's no password you give the site. So it's one factor. It is probably significantly safer than just a password, since nigerian hackers can't steal your phone from a huge poorly secured database.... but it's still just one factor.
thedufer 13y ago
> all of the problems you mentioned around needing your phone are common to nearly all two-factor auth solutions. Not true. From his list of problems, TOTP does not require the Clef servers (or any third-party server), nor does it require your phone camera or (more importantly) phone networking to be working. And to make the comparison fair, you have to realize that this is not two-factor. There's only one factor (something you have) since there isn't a password requirement.

by habosa 13y ago

icebraining 13y ago

This is not two factor authentication, since it eliminates one of the factors (the password). Gmail's doesn't, so that is two factor auth.

habosa 13y ago
Clef app has a PIN. And my phone has a lock screen password.
- icebraining 13y ago
  No, because you're not authenticating to the service. Think about what would happen if your phone gets owned by some malware that escalates to root. It can simply log the PIN, extract the key and then login as it wishes. That's because the phone is the single factor for the service. Compare that with the auth against, say, Gmail, where even if a malware were to own the Authenticator, it still couldn't login as you, since your password goes directly to the service.

PakG1 13y ago

I finally installed Google Authenticator on my phone yesterday because Digital Ocean utilizes it. It's great. Like RSA stuff, only more convenient. And hopefully given the response of Google's security people to NSA activity, more secure than the RSA stuff. This thing basically looks like a more automated version of Google Authenticator. Cool, but meh, would it really change my life? But maybe it would make a difference for the same market that feels like the iPhone 5s's fingerprint scanner is way more convenient than previous security mechanisms on the iPhone and so can never go back. I dunno.

Zikes 13y ago
Google's Authenticator 2FA system is based on an open standard [1], and can even be implemented on your own/other web sites. Given the open nature of the standard, that can be considered an additional safeguard against NSA exposure. [1] http://en.wikipedia.org/wiki/Google_Authenticator http://en.wikipedia.org/wiki/Google_Authenticator
Corrado 13y ago
May I suggest you try the Authy[1] app for your phone. Its much prettier than GA, has a PIN screen lock, and can save your encrypted credentials in case you lose your phone. Plus, if you run OS X it will sync to your computer's clipboard via Bluetooth. [1] https://www.authy.com/ https://www.authy.com/
- PakG1 13y ago
  While this is cool, I don't think I can replace GA with this because GA is the one implemented by the services I use, yeah? I can only use this for services that implement this.
  - sgjennings 13y ago
    Authy's app works with Google Authenticator-compatible sites. Authy also has its own two-factor system, but you're not required to use it.

bskap 13y ago

How is this two factor? As near as I can tell, it replaces your password (something you know) with your phone (something you have). It doesn't add a second factor to the auth.

res0nat0r 13y ago
Two factor auth is defined as something you know plus something you have. Two-step verification (also known as two-factor authentication) is a process involving two stages to verify the identity of an entity trying to access services in a computer or in a network. This is a special case of a multi-factor authentication which involves the presentation of two or more of the three authentication factors: a knowledge factor, a possession factor, and an inherence factor.
- NateDad 13y ago
  Their point was, there's only one factor here: something you have. There's no password you give the site. So it's one factor. It is probably significantly safer than just a password, since nigerian hackers can't steal your phone from a huge poorly secured database.... but it's still just one factor.

thedufer 13y ago

> all of the problems you mentioned around needing your phone are common to nearly all two-factor auth solutions. Not true. From his list of problems, TOTP does not require the Clef servers (or any third-party server), nor does it require your phone camera or (more importantly) phone networking to be working. And to make the comparison fair, you have to realize that this is not two-factor. There's only one factor (something you have) since there isn't a password requirement.