3 ms·

What is the reason for all of these 2FA apps? This is completely unnecessary. If you're going to offer 2FA, please offer at least the following: * TOTP * Y

by feld 12y ago

What is the reason for all of these 2FA apps? This is completely unnecessary. If you're going to offer 2FA, please offer at least the following: * TOTP * Yubikey * SMS If you want to partner with someone and ram unnecessary apps down our throats, optionally add the following: * Authy * RSA * etc I have places where I want 2FA but I will not install the Authy app, so I go without. Sorry. Let me use TOTP or my Yubikey.

rtpg 12y ago
You do realise that with authy you're just registering TOTP stuff right? It's not on the same level as what you're mentioning. It's like complaining about having to use Firefox instead of google.com
- feld 12y ago
  Then why do they need an account or my phone number to do TOTP?
  - mmebane 12y ago
    Yes, that's definitely unfortunate. I don't remember it being required with older versions of the Authy app. I really hate forced cloud service integration, especially in applications that deal with sensitive material.
  - rtpg 12y ago
    they don't, but they want to have a way to verify who you are for things like the sync feature. Even if you don't want to use the feature. This is a pretty good example of not doing something because it represents a minority and would make onboarding more difficult for their actual value-add.
- deleted 12y ago
  [deleted]
- deleted 12y ago
  [deleted]
- A_COMPUTER 12y ago
  Because Cloudflare requires Authy, not TOTP. It's a pain in my ass because Cloudflare doesn't have sub-accounts and I have more than one person managing a Cloudflare account, but Authy is locked to one device. So as a result I can't turn on two-factor on my Cloudflare account.
eddieroger 12y ago
I don't understand this rage. I've used Authy with regular TOTP services, and in some cases where I was explicitly told to use something else like Google Authenticator. Unless this changes, I don't see any reason to stop using Authy.
akerl_ 12y ago
What makes Yubikey part of the "default" set but not Authy or RSA? This seems awfully like "If you're going to offer 2FA, at least offer all the tools I like, before you offer any tools that I don't like". It's also worth noting that Authy's app supports TOTP, last I looked.
- feld 12y ago
  Because Yubikey is very reasonably priced and they're very open about their design... and don't require you provide any identifying information to own one.
  - mynameisvlad 12y ago
    Well, except, you have to buy one from somewhere, and I believe they are only officially being sold through their own site or Amazon. So you are providing your identifying information to some party before even getting the device.
fluidcruft 12y ago
s/Yubikey/U2F/ (But I will use my Yubikey for U2F) I also refuse to install Authy. I really, really do not like their creeping, creepy intrusiveness and the profiling it enables. I get the feeling that people don't actually understand Authy beyond "Hey, it backs up my secrets to the cloud. Cool!" I recently had to renew my Google Authenticator tokens and I was tempted by Authy but the setup/onboarding sent me away screaming. Then I remembered the NEO can handle this (well except for Amazon tokens). Can't wait for U2F NFC to be standardized.
- feld 12y ago
  This precisely. I commend Authy for trying to make 2FA for a wide audience, but security is not easy. Training users is the correct approach. Give an option for those who deeply care about their security. If you're going to grab the industry by the balls and capture the attention of major industry players at least stick to your core values and offer an advanced/expert option for those of us who want to stay out of your system but still use 2FA.

by feld 12y ago

rtpg 12y ago

You do realise that with authy you're just registering TOTP stuff right? It's not on the same level as what you're mentioning. It's like complaining about having to use Firefox instead of google.com

feld 12y ago
Then why do they need an account or my phone number to do TOTP?
- mmebane 12y ago
  Yes, that's definitely unfortunate. I don't remember it being required with older versions of the Authy app. I really hate forced cloud service integration, especially in applications that deal with sensitive material.
- rtpg 12y ago
  they don't, but they want to have a way to verify who you are for things like the sync feature. Even if you don't want to use the feature. This is a pretty good example of not doing something because it represents a minority and would make onboarding more difficult for their actual value-add.
deleted 12y ago
[deleted]
deleted 12y ago
[deleted]
A_COMPUTER 12y ago
Because Cloudflare requires Authy, not TOTP. It's a pain in my ass because Cloudflare doesn't have sub-accounts and I have more than one person managing a Cloudflare account, but Authy is locked to one device. So as a result I can't turn on two-factor on my Cloudflare account.

eddieroger 12y ago

I don't understand this rage. I've used Authy with regular TOTP services, and in some cases where I was explicitly told to use something else like Google Authenticator. Unless this changes, I don't see any reason to stop using Authy.

akerl_ 12y ago

What makes Yubikey part of the "default" set but not Authy or RSA? This seems awfully like "If you're going to offer 2FA, at least offer all the tools I like, before you offer any tools that I don't like". It's also worth noting that Authy's app supports TOTP, last I looked.

feld 12y ago
Because Yubikey is very reasonably priced and they're very open about their design... and don't require you provide any identifying information to own one.
- mynameisvlad 12y ago
  Well, except, you have to buy one from somewhere, and I believe they are only officially being sold through their own site or Amazon. So you are providing your identifying information to some party before even getting the device.

fluidcruft 12y ago

s/Yubikey/U2F/ (But I will use my Yubikey for U2F) I also refuse to install Authy. I really, really do not like their creeping, creepy intrusiveness and the profiling it enables. I get the feeling that people don't actually understand Authy beyond "Hey, it backs up my secrets to the cloud. Cool!" I recently had to renew my Google Authenticator tokens and I was tempted by Authy but the setup/onboarding sent me away screaming. Then I remembered the NEO can handle this (well except for Amazon tokens). Can't wait for U2F NFC to be standardized.

feld 12y ago
This precisely. I commend Authy for trying to make 2FA for a wide audience, but security is not easy. Training users is the correct approach. Give an option for those who deeply care about their security. If you're going to grab the industry by the balls and capture the attention of major industry players at least stick to your core values and offer an advanced/expert option for those of us who want to stay out of your system but still use 2FA.