5 ms·

Slack encourages 2-factor authentication: > Download and install either the Google Authenticator or Duo Mobile apps on your phone or tablet. Hey Slack, I don'

Slack encourages 2-factor authentication: > Download and install either the Google Authenticator or Duo Mobile apps on your phone or tablet. Hey Slack, I don't have a smartphone. What am I supposed to do?

ocdtrekkie 12y ago
Slack is from the startup culture. Do not expect any support for people who are not "up with the times" and crud.
caractacus 12y ago
If security is that important to you, buy one. A cheap Android tablet isn't exactly going to break the bank, is it?
- larsiusprime 12y ago
  There are plenty of security reasons not to buy a smartphone.
jakobegger 12y ago
Get an OTP app for your laptop. It's an open standard.
jmtulloss 12y ago
These usually fall back to regular text messages.
nevir 12y ago
https://www.authy.com/ https://www.authy.com/ https://chrome.google.com/webstore/detail/authenticator/bhghoamapcdpbohphigoooaddinpkbai https://chrome.google.com/webstore/detail/authenticator/bhgh... https://code.google.com/p/winauth/ https://code.google.com/p/winauth/ and others, I'm sure
vilda 12y ago
Buy some small and cheap one, no SIM card needed.
larsiusprime 12y ago
While I appreciate all the downvotes and "get with the times" comments, a significant portion of the population does not have a smartphone, assuming everyone has a smartphone or will instantly know what to do when presented with official instructions that only mention smartphones/tablets seems like a bit of a security oversight on Slack's part, no? Those pointing out PC-enabled authentication apps: thanks. That's USEFUL feedback!
- drcoopster 12y ago
  The vast majority of the population that comprises Slack customers will have a smartphone.
  - larsiusprime 12y ago
    And only focusing on the "vast majority" is a GREAT security solution. There is some significant, non-zero number of people who use Slack and do not own a smart device. I am one of them. (reasons for choosing not to own a smart device are many and I will not go into them here) I'm not trying to rake them over the coals, just point out this is a very real blind-spot and they should promptly update the notice with instructions for people who don't have smart-phones.
    - geofft 12y ago
      Can you expand just enough on the reasons for not owning a smartphone, so we can give constructive advice? I don't want to suggest things like "buy a Yubikey" or "buy a tablet or iPod Touch with no cell radio" if you're objecting to buying new things, for instance. I think it's hard to give generic advice about this situation.
- smcguinness 12y ago
  Smartphone - 58% of all US adults source - http://www.pewinternet.org/data-trend/mobile/cell-phone-and-smartphone-ownership-demographics/ http://www.pewinternet.org/data-trend/mobile/cell-phone-and-...
- 12y ago
geofft 12y ago
Lots of options. * You can buy a hardware token. https://www.duosecurity.com/product/methods/hardware-tokens https://www.duosecurity.com/product/methods/hardware-tokens * You can have Duo call/text you every time you want to log in. * You can use some other device you have that runs a mobile OS. I had Duo set up on my wifi-only iPad while I was using a feature phone for a few months a year ago. (I eventually gave up on that and got a smartphone, though.) * You can buy a used/cheap smartphone, iPod Touch, or similar, install either the Google Authenticator or Duo app, and not use mobile service at all. You just need a bit of wifi to enroll. * You can write an OATH client as a J2ME MIDlet. When I was using a feature phone, I spent some time figuring out how to compile J2ME apps in 2015, by piecing together ten-year-old tutorials. It works fine; if you want me to dig up details let me know. (Alternatively, someone may have written one already, but I didn't search very hard.) * You can, technically, run an OATH client on your computer. But at that point, you take responsibility for your two-factor auth being slightly less than two-factor.
- tracker1 12y ago
  To you last point... it's funny the number of companies that are using virtual 2fa clients on their laptops for VPN connections because they wanted to save money on hardware tokens. kind of negates the second half of 2fa.
  - homakov 12y ago
    It doesn't. The only case when it's worse is when your laptop is stolen and you don't know about that - very unlikely for corporate laptops
    - tracker1 12y ago
      Or, monitoring software on your computer, the origin of which now has access to the computer, your password, and the token generator.
      - homakov 12y ago
samstave 12y ago
Get an abacus!
jahewson 12y ago
Buy a smartphone. You can get a Huawei on eBay for $20. You don't even need a sim or a contract, just connect to wifi and download the Authenticator app.
homakov 12y ago
You can use http://gauth.apps.gbraad.nl/ http://gauth.apps.gbraad.nl/ on another computer or on same machine (wouldn't protect if computer is stolen, otherwise the same)

ocdtrekkie 12y ago

Slack is from the startup culture. Do not expect any support for people who are not "up with the times" and crud.

caractacus 12y ago

If security is that important to you, buy one. A cheap Android tablet isn't exactly going to break the bank, is it?

larsiusprime 12y ago
There are plenty of security reasons not to buy a smartphone.

jakobegger 12y ago

Get an OTP app for your laptop. It's an open standard.

jmtulloss 12y ago

These usually fall back to regular text messages.

nevir 12y ago

https://www.authy.com/ https://www.authy.com/ https://chrome.google.com/webstore/detail/authenticator/bhghoamapcdpbohphigoooaddinpkbai https://chrome.google.com/webstore/detail/authenticator/bhgh... https://code.google.com/p/winauth/ https://code.google.com/p/winauth/ and others, I'm sure

vilda 12y ago

Buy some small and cheap one, no SIM card needed.

larsiusprime 12y ago

While I appreciate all the downvotes and "get with the times" comments, a significant portion of the population does not have a smartphone, assuming everyone has a smartphone or will instantly know what to do when presented with official instructions that only mention smartphones/tablets seems like a bit of a security oversight on Slack's part, no? Those pointing out PC-enabled authentication apps: thanks. That's USEFUL feedback!

drcoopster 12y ago
The vast majority of the population that comprises Slack customers will have a smartphone.
- larsiusprime 12y ago
  And only focusing on the "vast majority" is a GREAT security solution. There is some significant, non-zero number of people who use Slack and do not own a smart device. I am one of them. (reasons for choosing not to own a smart device are many and I will not go into them here) I'm not trying to rake them over the coals, just point out this is a very real blind-spot and they should promptly update the notice with instructions for people who don't have smart-phones.
  - geofft 12y ago
    Can you expand just enough on the reasons for not owning a smartphone, so we can give constructive advice? I don't want to suggest things like "buy a Yubikey" or "buy a tablet or iPod Touch with no cell radio" if you're objecting to buying new things, for instance. I think it's hard to give generic advice about this situation.
smcguinness 12y ago
Smartphone - 58% of all US adults source - http://www.pewinternet.org/data-trend/mobile/cell-phone-and-smartphone-ownership-demographics/ http://www.pewinternet.org/data-trend/mobile/cell-phone-and-...
12y ago

geofft 12y ago

Lots of options. * You can buy a hardware token. https://www.duosecurity.com/product/methods/hardware-tokens https://www.duosecurity.com/product/methods/hardware-tokens * You can have Duo call/text you every time you want to log in. * You can use some other device you have that runs a mobile OS. I had Duo set up on my wifi-only iPad while I was using a feature phone for a few months a year ago. (I eventually gave up on that and got a smartphone, though.) * You can buy a used/cheap smartphone, iPod Touch, or similar, install either the Google Authenticator or Duo app, and not use mobile service at all. You just need a bit of wifi to enroll. * You can write an OATH client as a J2ME MIDlet. When I was using a feature phone, I spent some time figuring out how to compile J2ME apps in 2015, by piecing together ten-year-old tutorials. It works fine; if you want me to dig up details let me know. (Alternatively, someone may have written one already, but I didn't search very hard.) * You can, technically, run an OATH client on your computer. But at that point, you take responsibility for your two-factor auth being slightly less than two-factor.

tracker1 12y ago
To you last point... it's funny the number of companies that are using virtual 2fa clients on their laptops for VPN connections because they wanted to save money on hardware tokens. kind of negates the second half of 2fa.
- homakov 12y ago
  It doesn't. The only case when it's worse is when your laptop is stolen and you don't know about that - very unlikely for corporate laptops
  - tracker1 12y ago
    Or, monitoring software on your computer, the origin of which now has access to the computer, your password, and the token generator.
    - homakov 12y ago

samstave 12y ago

Get an abacus!

jahewson 12y ago

Buy a smartphone. You can get a Huawei on eBay for $20. You don't even need a sim or a contract, just connect to wifi and download the Authenticator app.

homakov 12y ago

You can use http://gauth.apps.gbraad.nl/ http://gauth.apps.gbraad.nl/ on another computer or on same machine (wouldn't protect if computer is stolen, otherwise the same)