3 ms·

Why do I have to install Google Authenticator some sort of other app for 2factor here? Why can't you send me a text like everyone else does? EDIT: Slack respon

by dmazin 12y ago

Why do I have to install Google Authenticator some sort of other app for 2factor here? Why can't you send me a text like everyone else does? EDIT: Slack responded that they do not support SMS yet.

deleted 12y ago
[deleted]
deleted 12y ago
[deleted]
dragonwriter 12y ago
Because SMS is not even remotely a secure communication channel, and the point of two factors is proof of possession of two different classes of things (that you have some device and that you know some secret), and using an insecure channel to send a message weakens the proof of the have half of that, in much the same way as using a weak or published password weakens the know half. Ideally, you want as strong as practical proofs of each half within the constraints set by UX considerations.
- BrainInAJar 12y ago
  > Because SMS is not even remotely a secure communication channel Neither is 2FA, it's a key stored completely unencrypted in both your phone and the the host's db.
  - dragonwriter 12y ago
    That's not particularly weak as proof to the person who controls the DB that you have access to the phone, which is what the device factor of a 2FA scheme is intended to prove, since you have to have access to either the DB or the phone to get the key. Conversely, SMS's weakness is in the communication channel, which can be compromised without compromising the things for which the factor is intended as proof.
    - BrainInAJar 12y ago
      Phones get hacked too. If you ever access a site with your phone, it's not two factor auth. Malware can read your 2FA key and read your password as you type it in.
      - mirashii 12y ago
        And thus why we have Yubikeys and other hardware tokens.
scott_karana 12y ago
Why not both? Google's pioneering approach (TOTP, SMS, automated phonecalls, and offline backup codes) is so thorough that I've been disappointed by almost every other implementation.
andrewchilds 12y ago
Because you can't trust SMS-based two-factor authentication. http://en.wikipedia.org/wiki/Multi-factor_authentication#SMS_one-time_password http://en.wikipedia.org/wiki/Multi-factor_authentication#SMS... http://webcache.googleusercontent.com/search?q=cache:UiwfUalgd6MJ:www.emptyage.com/post/28679875595/yes-i-was-hacked-hard+&cd=1&hl=en&ct=clnk&gl=us http://webcache.googleusercontent.com/search?q=cache:UiwfUal...
- tedunangst 12y ago
  How does Google Authenticator prevent malware on my phone from approving a login?
  - c22 12y ago
    That's outside the scope of the tool. You're supposed to prevent malware from compromising your phone. At the very least this scheme requires an attacker to implant malware on your phone as opposed to just monitoring/intercepting communications to and from it.
cheshire137 12y ago
That's my big complaint, too. Just do like Github and send me a text message. I don't want some additional company's app as a dependency.
nemothekid 12y ago
You can write your own TOTP application - its open source and works offline, you don't need Google Authenticator, there are dozens of applications available.

by dmazin 12y ago

Why do I have to install Google Authenticator some sort of other app for 2factor here? Why can't you send me a text like everyone else does? EDIT: Slack responded that they do not support SMS yet.

deleted 12y ago

[deleted]

deleted 12y ago

[deleted]

dragonwriter 12y ago

Because SMS is not even remotely a secure communication channel, and the point of two factors is proof of possession of two different classes of things (that you have some device and that you know some secret), and using an insecure channel to send a message weakens the proof of the have half of that, in much the same way as using a weak or published password weakens the know half. Ideally, you want as strong as practical proofs of each half within the constraints set by UX considerations.

BrainInAJar 12y ago
> Because SMS is not even remotely a secure communication channel Neither is 2FA, it's a key stored completely unencrypted in both your phone and the the host's db.
- dragonwriter 12y ago
  That's not particularly weak as proof to the person who controls the DB that you have access to the phone, which is what the device factor of a 2FA scheme is intended to prove, since you have to have access to either the DB or the phone to get the key. Conversely, SMS's weakness is in the communication channel, which can be compromised without compromising the things for which the factor is intended as proof.
  - BrainInAJar 12y ago
    Phones get hacked too. If you ever access a site with your phone, it's not two factor auth. Malware can read your 2FA key and read your password as you type it in.
    - mirashii 12y ago
      And thus why we have Yubikeys and other hardware tokens.

scott_karana 12y ago

Why not both? Google's pioneering approach (TOTP, SMS, automated phonecalls, and offline backup codes) is so thorough that I've been disappointed by almost every other implementation.

andrewchilds 12y ago

Because you can't trust SMS-based two-factor authentication. http://en.wikipedia.org/wiki/Multi-factor_authentication#SMS_one-time_password http://en.wikipedia.org/wiki/Multi-factor_authentication#SMS... http://webcache.googleusercontent.com/search?q=cache:UiwfUalgd6MJ:www.emptyage.com/post/28679875595/yes-i-was-hacked-hard+&cd=1&hl=en&ct=clnk&gl=us http://webcache.googleusercontent.com/search?q=cache:UiwfUal...

tedunangst 12y ago
How does Google Authenticator prevent malware on my phone from approving a login?
- c22 12y ago
  That's outside the scope of the tool. You're supposed to prevent malware from compromising your phone. At the very least this scheme requires an attacker to implant malware on your phone as opposed to just monitoring/intercepting communications to and from it.

cheshire137 12y ago

That's my big complaint, too. Just do like Github and send me a text message. I don't want some additional company's app as a dependency.

nemothekid 12y ago

You can write your own TOTP application - its open source and works offline, you don't need Google Authenticator, there are dozens of applications available.