5 ms·

I don't want 2FA for absolutely everything. I want to authenticate once.

• valarauca1 12y ago
  Then your laziness is important to you then your security.
  • freehunter 12y ago
    It's a fair point though. At some point you're putting too much of a barrier on everything. You can have security and convenience at the same time, we just haven't done it yet. However, I have 2FA turned on with GMail and I authenticate basically once, then it remembers my PC and I don't have to authenticate again for a long time.
    • nzealand 12y ago
      It remembers the second authorization on all your devices?
      • freehunter 12y ago
        On my iPhone and my desktop (at home and work).
  • sp332 12y ago
    I have ssh-agent for SSH. Can we get something similar for websites?
    • nzadrozny 12y ago
      Actually, I was recently pointed at Joyent's node-http-signature[1], which is pretty clever. It can sign an HTTP request using one's SSH keys. Handy for a CLI client for a HTTP API. I've done a couple of HTTP auth schemes for my dayjob and am thinking of using something like this for my next. 1. https://github.com/joyent/node-http-signature/blob/master/http_signing.md https://github.com/joyent/node-http-signature/blob/master/ht...
      • mlatu 12y ago
        http://blog.cryptographyengineering.com/2012/12/the-anatomy-of-bad-idea.html http://blog.cryptographyengineering.com/2012/12/the-anatomy-... as long as we need to depend on javascript for crypto there will not be a secure way to do such things. im saying this because you can not safely assume the integrity of your crypto system to be intact if you have to download it with the page it's used on. thats about the same as always having to download your ssh client first from the server you are connecting to. someone could tinker with that download and give you something that uses the attacker as a proxy to connect to your server of choice and while you notice nothing, that malware would upload your private key. same thing could happen when you use some sort of crypto implemented in javascript. lets talk about this when someone made it possible to have a website instruct the browser to make a call to a crypto library or some such
        • TheDong 12y ago
          He did not say web or browser. He said nodejs. Node can call native crypto libraries, but also is not subject to the mitm issue. Please read up on what "nodejs" is before lambasting it with an oft repeated security trope.
          • nzadrozny 12y ago
            > He did not say web or browser. He said nodejs. Indeed; more generally, I said CLI. TLDR of the previous link: it's an interesting general-purpose take on using ssh public/private keys (and methods) to sign and authenticate HTTP requests.
  • nodata 12y ago
    No, as sp332 says, I want something like ssh-agent for the web.
    • nzadrozny 12y ago
      Seems like the closest we've got is OAuth with your Google/Facebook/GitHub/Twitter account.