4 ms·

Duo, Clef, or SMS 2-factor all have the same caveat: they require internet or SMS availability on one of your devices, not just the computer/device you're loggi

Duo, Clef, or SMS 2-factor all have the same caveat: they require internet or SMS availability on one of your devices, not just the computer/device you're logging in on. I don't want my ability to use a system conditioned on whether my phone can connect to the internet, or whether I have a laptop with internet connectivity and a camera that can take a picture of my phone's screen. TOTP 2-factor and FIDO* are better for that reason. Clef sounds almost exactly like a software (totally app-based) FIDO implementation without a separate password other than the PIN you'd enter into the FIDO app. FIDO needs browser support, though; Clef can't do it that way, so it requires a data back-channel to Clef servers. * (once it catches on... tokens exist, and Chrome/chromium 39 and above supports it, but MS has only announced it for Win10, FF hasn't implemented it yet, and hardly any major sites support it other than Google)

jessepollak 12y ago
Clef actually doesn't require internet on the secondary device. We just shipped offline mode a few weeks ago: it's not as seamless as the primary flow, but it works well and solves the problem. Turn on airplane mode, sync the wave and let me know what you think.
- harshreality 12y ago
  So in that mode it's a proprietary alternative to FIDO that requires a camera to image the phone's screen? A lot of work has gone into the FIDO spec to make sure it can be used across a wide range of environments. I don't see the utility of buying into a proprietary 2-factor system that seems to be solving the same problem. If you added u2f-hid support to eliminate the hack of transmitting data via pictures and cameras, wouldn't your system behave exactly like FIDO? Isn't the natural progression for a company like Duo or Clef to pivot to being a managed FIDO 2-factor service, for organizations that want central management of 2-factor auth without creating their own management system?
- G650 12y ago
  Good stuff Jesse. Excited to see where this goes.
toast0 12y ago
With Duo, in addition to the online request acceptance, you can also get a code from the phone without being online, and type that into wherever to finish logging in.
jfroma 12y ago
Same with some OTP solutions that works only through SMS, for instance BofA safepass can only send sms to phones in the US.

jessepollak 12y ago

Clef actually doesn't require internet on the secondary device. We just shipped offline mode a few weeks ago: it's not as seamless as the primary flow, but it works well and solves the problem. Turn on airplane mode, sync the wave and let me know what you think.

harshreality 12y ago
So in that mode it's a proprietary alternative to FIDO that requires a camera to image the phone's screen? A lot of work has gone into the FIDO spec to make sure it can be used across a wide range of environments. I don't see the utility of buying into a proprietary 2-factor system that seems to be solving the same problem. If you added u2f-hid support to eliminate the hack of transmitting data via pictures and cameras, wouldn't your system behave exactly like FIDO? Isn't the natural progression for a company like Duo or Clef to pivot to being a managed FIDO 2-factor service, for organizations that want central management of 2-factor auth without creating their own management system?
G650 12y ago
Good stuff Jesse. Excited to see where this goes.

toast0 12y ago

With Duo, in addition to the online request acceptance, you can also get a code from the phone without being online, and type that into wherever to finish logging in.

jfroma 12y ago

Same with some OTP solutions that works only through SMS, for instance BofA safepass can only send sms to phones in the US.