4 ms·

We've been using Duo Security for two factor ssh auth[0] for a number of years. Its quite easy to setup and gives you push notifications to your phone. Its awes

by helper 11y ago

We've been using Duo Security for two factor ssh auth[0] for a number of years. Its quite easy to setup and gives you push notifications to your phone. Its awesome. [0]: https://www.duosecurity.com/docs/duounix https://www.duosecurity.com/docs/duounix

jaryd 11y ago
The push notifications and tap to accept (no transcribing 6 digit codes!) is game changing. +1 for Duo!
teraflop 11y ago
Duo's PAM module arguably violates the "MFA is only useful, if all parts of it can be enforced server-side!" principle from this blog post. The authentication does happen on a server, but it's a server controlled by Duo, not by you. The PAM module simply makes an API request and authorizes a user iff Duo says they should be authorized. (Hopefully you'll have configured things so that Duo's approval and a password are both required for login, so this isn't a catastrophic break in security, but it's still a little worrying. And what about when your Internet connection, or Duo's, is having problems? As I write this comment, HTTPS connections to www.duosecurity.com are throwing errors because they've installed a certificate for *.test.duosecurity.com. [1]) I prefer Google's pam_google_authenticator module. Like the Android/iOS app, it doesn't have any external service dependencies; all it assumes is reasonable clock synchrony. [1]: https://www.ssllabs.com/ssltest/analyze.html?d=www.duosecurity.com https://www.ssllabs.com/ssltest/analyze.html?d=www.duosecuri...
- sterlingduo 11y ago
  Sterling Windmill from Duo Security here. We experienced a brief issue today resulting from the deployment of an incorrect SSL certificate to our public website. One benefit of the conscious decision to segregate our public website from other services is that this event had no impact on end user authentication. Feel free to reach out to support@duosecurity.com with any questions regarding this or anything else!
uN8yahg 11y ago
Hi. I live in a dangerous city. What if I lost my phone?
- JupiterMoon 11y ago
  Encrypt it? Don't store credentials on it unless you really need to? Make rotating keys and passwords easy in the event of losing it?
- chrisper 11y ago
  You can disable the phone in the Duo Admin Portal.

by helper 11y ago

jaryd 11y ago

The push notifications and tap to accept (no transcribing 6 digit codes!) is game changing. +1 for Duo!

teraflop 11y ago

Duo's PAM module arguably violates the "MFA is only useful, if all parts of it can be enforced server-side!" principle from this blog post. The authentication does happen on a server, but it's a server controlled by Duo, not by you. The PAM module simply makes an API request and authorizes a user iff Duo says they should be authorized. (Hopefully you'll have configured things so that Duo's approval and a password are both required for login, so this isn't a catastrophic break in security, but it's still a little worrying. And what about when your Internet connection, or Duo's, is having problems? As I write this comment, HTTPS connections to www.duosecurity.com are throwing errors because they've installed a certificate for *.test.duosecurity.com. [1]) I prefer Google's pam_google_authenticator module. Like the Android/iOS app, it doesn't have any external service dependencies; all it assumes is reasonable clock synchrony. [1]: https://www.ssllabs.com/ssltest/analyze.html?d=www.duosecurity.com https://www.ssllabs.com/ssltest/analyze.html?d=www.duosecuri...

sterlingduo 11y ago
Sterling Windmill from Duo Security here. We experienced a brief issue today resulting from the deployment of an incorrect SSL certificate to our public website. One benefit of the conscious decision to segregate our public website from other services is that this event had no impact on end user authentication. Feel free to reach out to support@duosecurity.com with any questions regarding this or anything else!

uN8yahg 11y ago

Hi. I live in a dangerous city. What if I lost my phone?

JupiterMoon 11y ago
Encrypt it? Don't store credentials on it unless you really need to? Make rotating keys and passwords easy in the event of losing it?
chrisper 11y ago
You can disable the phone in the Duo Admin Portal.