4 ms·

Similarly, I've been impressed by Duo's mobile applications.[1] They offer a push authentication capability, so you only have to click "accept" or "deny" in th

by oostevo 12y ago

Similarly, I've been impressed by Duo's mobile applications.[1] They offer a push authentication capability, so you only have to click "accept" or "deny" in the app on your phone. They've also got code generation and a hardware token as backups. In practice, I can usually authenticate through the phone in 2ish seconds. Clef does look like an awfully nice user experience, though. [1] https://www.duosecurity.com/product/methods/duo-mobile https://www.duosecurity.com/product/methods/duo-mobile

harshreality 12y ago
Duo, Clef, or SMS 2-factor all have the same caveat: they require internet or SMS availability on one of your devices, not just the computer/device you're logging in on. I don't want my ability to use a system conditioned on whether my phone can connect to the internet, or whether I have a laptop with internet connectivity and a camera that can take a picture of my phone's screen. TOTP 2-factor and FIDO* are better for that reason. Clef sounds almost exactly like a software (totally app-based) FIDO implementation without a separate password other than the PIN you'd enter into the FIDO app. FIDO needs browser support, though; Clef can't do it that way, so it requires a data back-channel to Clef servers. * (once it catches on... tokens exist, and Chrome/chromium 39 and above supports it, but MS has only announced it for Win10, FF hasn't implemented it yet, and hardly any major sites support it other than Google)
- jessepollak 12y ago
  Clef actually doesn't require internet on the secondary device. We just shipped offline mode a few weeks ago: it's not as seamless as the primary flow, but it works well and solves the problem. Turn on airplane mode, sync the wave and let me know what you think.
  - harshreality 12y ago
    So in that mode it's a proprietary alternative to FIDO that requires a camera to image the phone's screen? A lot of work has gone into the FIDO spec to make sure it can be used across a wide range of environments. I don't see the utility of buying into a proprietary 2-factor system that seems to be solving the same problem. If you added u2f-hid support to eliminate the hack of transmitting data via pictures and cameras, wouldn't your system behave exactly like FIDO? Isn't the natural progression for a company like Duo or Clef to pivot to being a managed FIDO 2-factor service, for organizations that want central management of 2-factor auth without creating their own management system?
  - G650 12y ago
    Good stuff Jesse. Excited to see where this goes.
- toast0 12y ago
  With Duo, in addition to the online request acceptance, you can also get a code from the phone without being online, and type that into wherever to finish logging in.
- jfroma 12y ago
  Same with some OTP solutions that works only through SMS, for instance BofA safepass can only send sms to phones in the US.
deleted 12y ago
[deleted]
malandrew 12y ago
Duo has been awesome. I hit my login screen, enter password, send notification and hit accept on my phone. Ridiculously easy. The only problem is when you phone battery is dead.
jfroma 12y ago
It is the best use of push notifications I've seen.
freehunter 12y ago
I've got a bit of a sore spot when it comes to Duo Security. I was working at an enterprise a little less than a year ago when we got an email from Duo Security saying they had analyzed a password dump from the Adobe breech. They wanted to let us know that several accounts tied to our organization were contained in the dump and used that to try to sell their solution. It didn't help that their email addresses didn't have the same domain as their website, and the addresses they emailed us from didn't have the same domain as the address they asked us to respond to. I grabbed an address from their website and asked if this email was legit or a phishing attempt and it took quite a long time to get a response. By that time, no one at the company had any patience left for Duo. You don't sell to enterprises by acting shady.

by oostevo 12y ago

harshreality 12y ago

Duo, Clef, or SMS 2-factor all have the same caveat: they require internet or SMS availability on one of your devices, not just the computer/device you're logging in on. I don't want my ability to use a system conditioned on whether my phone can connect to the internet, or whether I have a laptop with internet connectivity and a camera that can take a picture of my phone's screen. TOTP 2-factor and FIDO* are better for that reason. Clef sounds almost exactly like a software (totally app-based) FIDO implementation without a separate password other than the PIN you'd enter into the FIDO app. FIDO needs browser support, though; Clef can't do it that way, so it requires a data back-channel to Clef servers. * (once it catches on... tokens exist, and Chrome/chromium 39 and above supports it, but MS has only announced it for Win10, FF hasn't implemented it yet, and hardly any major sites support it other than Google)

jessepollak 12y ago
Clef actually doesn't require internet on the secondary device. We just shipped offline mode a few weeks ago: it's not as seamless as the primary flow, but it works well and solves the problem. Turn on airplane mode, sync the wave and let me know what you think.
- harshreality 12y ago
  So in that mode it's a proprietary alternative to FIDO that requires a camera to image the phone's screen? A lot of work has gone into the FIDO spec to make sure it can be used across a wide range of environments. I don't see the utility of buying into a proprietary 2-factor system that seems to be solving the same problem. If you added u2f-hid support to eliminate the hack of transmitting data via pictures and cameras, wouldn't your system behave exactly like FIDO? Isn't the natural progression for a company like Duo or Clef to pivot to being a managed FIDO 2-factor service, for organizations that want central management of 2-factor auth without creating their own management system?
- G650 12y ago
  Good stuff Jesse. Excited to see where this goes.
toast0 12y ago
With Duo, in addition to the online request acceptance, you can also get a code from the phone without being online, and type that into wherever to finish logging in.
jfroma 12y ago
Same with some OTP solutions that works only through SMS, for instance BofA safepass can only send sms to phones in the US.

deleted 12y ago

[deleted]

malandrew 12y ago

Duo has been awesome. I hit my login screen, enter password, send notification and hit accept on my phone. Ridiculously easy. The only problem is when you phone battery is dead.

jfroma 12y ago

It is the best use of push notifications I've seen.

freehunter 12y ago

I've got a bit of a sore spot when it comes to Duo Security. I was working at an enterprise a little less than a year ago when we got an email from Duo Security saying they had analyzed a password dump from the Adobe breech. They wanted to let us know that several accounts tied to our organization were contained in the dump and used that to try to sell their solution. It didn't help that their email addresses didn't have the same domain as their website, and the addresses they emailed us from didn't have the same domain as the address they asked us to respond to. I grabbed an address from their website and asked if this email was legit or a phishing attempt and it took quite a long time to get a response. By that time, no one at the company had any patience left for Duo. You don't sell to enterprises by acting shady.