3 ms·
I'm sort of a caveman about this, but I prefer physical 2fa tokens for a lot of things. It would be nice if you could accept user input of a seed (in case I've
by rdl 12y ago
I'm sort of a caveman about this, but I prefer physical 2fa tokens for a lot of things. It would be nice if you could accept user input of a seed (in case I've bought a gemalto or something online) and want to register it.
- borski 12y agoThis is actually a great idea. Do you know of anyone that actually does this?
- rdl 12y agoAWS IAM, which is kind of the gold standard in configurable xaas authentication roles (although maybe a but overly complex). I'm looking to emulate them on this (ie shamelessly copy) whenever I have an auth system for a similarly complex multi user system to spec or implement. I also think there are other forms of 2fa besides totp/hotp which are worth adding, and the general amazon strategy of "multiple levels of logged in stet per user" for various actions on their retail shopping site has much broader applicability too. In general I think Amazon has done an exceptional job here across multiple products.
- yurisagalov 12y agoNot a bad idea, I'll file it as a feature request and see if we can do it in some easy-to-use fashion. The AWS example you mention in the thread below is good, but AWS is super complicated for a random user to use :\
- rdl 12y agoYeah, the thing IAM is missing is "sensible defaults", i.e. pre-populated templates. They have this, but it's not the default. I suspect there's probably a career (for a while) in being an IAM/VPC/etc. configuration specialist.
- sk5t 12y agoAs long as you don't mind using the service provider's seed value, Yubikey can do OATH TOTP. http://www.yubico.com/applications/internet-services/gmail/ http://www.yubico.com/applications/internet-services/gmail/