6 ms·

2 Factor Authentication, 2 Factor Authentication, 2 Factor Authentication! I've had 2 factor authentication enabled on my gmail account for over a year now, an

by codeka 13y ago

2 Factor Authentication, 2 Factor Authentication, 2 Factor Authentication! I've had 2 factor authentication enabled on my gmail account for over a year now, and once you get past the initial setup phase, it's really not that inconvenient. I have even been able to train my parents to use 2 factor auth, I just need to get them using a password manager now...

dba7dba 13y ago
I agree. However for people just not interested in tech stuff, teaching them how to use 2 factor authentication is pretty hard. I tried writing out the tutorial for friends but realized it's pretty daunting for regular users. What if Google started charging people (only ones with credit card on file which means they are in place with necessary infrastructure) $5 a year for NOT using 2 factor authentication... I guess I can dream...
zzleeper 13y ago
What happens if I'm i) outside the country, so no SMS for me, ii) outside cell tower coverage but with wifi (happens every day for me inside buildings), or I got my cellphone stolen for instance. How does 2fauth works in that case? (Just wondering, as the above are the reasons I decided not to use it)
- blairbeckwith 13y ago
  Authentication apps like Google Authenticator or Authy work without any data service of any kind. Most services provide backup codes you can print out and keep in your wallet or another safe spot in case you lose or destroy your device.
  - modeless 13y ago
    You can print two copies of your backup codes, keep one in your wallet and one at home. You don't have to worry too much about them getting stolen because they are useless without your password. You can also generate a new set of backup codes at any time, which invalidates the old ones.
    - deleted 13y ago
      [deleted]
- bbernoulli 13y ago
  With google's 2FA, you can print out codes ahead of time that can each be used once in place of the SMS'd code. Bring some of those with you, perhaps...
- celticjames 13y ago
  In google's case, you can print out a set of auth codes for times when you don't have your phone.
- potatolicious 13y ago
  2-factor authentication does not require the second factor every time. It typically only asks for the second factor if the device is unrecognized, or the usage pattern is unfamiliar. So, your laptop that's logged into GMail will stay logged in when you're out of the country. Unless you explicitly log out, it will stay this way. I enter maybe one two-factor auth code a week, if that. So: i) Prepare ahead and log into your services. ii) Walk to the nearest window, get the code, and go back to your desk. iii) Replace your phone - you keep your number - request the auth key again. None of these are completely seamless of course, but the idea is that all of the above happen rarely enough, and are mitigable enough, that it's far better than the alternative: getting pwned. There are also second factors in the form of mobile apps, which eliminate the need for SMS, so as long as you have data/WiFi you're set. There are also ones that don't need data at all (see: the Battle.net Authenticator, which is basically a RSA key on your phone), but require more substantial initial setup.
  - sp332 13y ago
    All the 2-factor entry boxes I've seen make the "trust" optional. If you want to be asked every time, just uncheck the box.
  - nl 13y ago
    This advice isn't incorrect, but it isn't entirely accurate either. The Google Authenticator mobile app doesn't require data, so that meets the OP's requirements perfectly (ie, no SMS or data). Use that, print out the one-time use codes and keep them in your wallet.
- axus 13y ago
  With gmail, you get 10 one-time use codes, which you can keep on a small slip of paper. So if you need to register on someone else's computer, you can use one of the codes and cross it off. If you lose the codes but not your device, you can print out new ones.
- Macha 13y ago
  As far as I know's Google's authenticator app works by using a PRNG being seeded with a unique code for your account that's transferred when you first setup the authenticator and the current time. The app certainly works without a network connection. AS for theft, you have backup codes which you should store securely (in a Truecrypt file with multiple backups or something), which allow you to log into your account once per code.
  - ubercow13 13y ago
    Why not print them out and put them in your wallet, like Google suggests. It's probably safer.
    - tvladeck 13y ago
      my solution is to have them in an encrypted evernote note
- darkhorn 13y ago
  When you are activating 2-factor authentication it gives you around 10 codes that you need to write down or print, to a wallet or under your freezer ets. However in university when I sit to a computer everytime I have to open a new clean Windows session, it leads me to enter 2-factor 4-5 a day. Thus I don't use it.
Goopplesoft 13y ago
Yup, exactly why I made https://GAuthify.com https://GAuthify.com, keep it standard via Google Authenticator and allow other options like SMS, Voice and Email. If you want to add it to your app and can't afford it, shoot support and email and I'll try to set you up with a discount/free-er account.
- nodesocket 13y ago
  GAuthify is great. Super easy to implement (libraries in almost all major languages), and supports auth mechanisms via (GA, SMS, Voice, and E-Mail).
srikrishnan 13y ago
I had twitter's 2 factor auth set up. Guess what? I was once logged out and couldn't login again. It just stopped working. I enter the code I receive over SMS and I go back to the login screen. I tweeted to @twitter from a signed in device and tried to get help for days. No response. Finally ended up dis-associating my phone number from twitter via an SMS and haven't gone back to 2-factor auth again.
hawkharris 13y ago
I'm with you on 2 factor auth, but I'm not sure about the password manager. I've always felt like putting all your passwords in one place defeats the purpose of memorizing separate, secure passwords (or, better yet, pass phrases).
- sbov 13y ago
  The purpose of separate, secure passwords is because otherwise all it takes is 1 website out there to be insecure to compromise all your logins. If your computer is compromised you already lost, regardless of whether you use a password manager or not.
  - hawkharris 13y ago
    If a person accesses your phone or laptop, he or she will not necessarily have access to all your credentials for various services and for other devices. But if all this info is stored in one place, in a password manager, the scope of the potential data breach suddenly grows.
    - sliverstorm 13y ago
      They don't suddenly have access, if your password manager is secure and your master password is strong. That's one of the nice things about password managers. You reduce the number of potential points of failure from many to one. Why is this good? Think of Thermopylae. You increase the stakes, but you also dramatically improve your ability to fight back.
- jacalata 13y ago
  The purpose of memorizing the passwords is a) so you always have access to them b) so they are safe The idea is that password managers should meet both these goals as well.
hadem 13y ago
For those who are curious, information for Google's 2-step verification process can be found here: http://www.google.com/landing/2step http://www.google.com/landing/2step
tfe 13y ago
Does anyone maintain a list of sites/services that support two factor auth? I'd like to be able to go through a list and make sure I have it enabled for all services where I have an account. All the articles I've found are at least a couple months old.
tlrobinson 13y ago
Agreed. 2FA is still rare enough that if a service you use offers 2FA, that's a sign you should probably use it.
eduardordm 13y ago
Certainly a good - and probably the best - option right now. But maybe there are simpler alternatives. Maybe passwords shoudn't mean anything, just like losing a key on a busy street is not exactly a security threat to its owner, password leaks shouldn't be harmful. Maybe the problem is not how passwords are stored or encrypted but how meaninful our 'ids' are - and how they are attached to that password.
deleted 13y ago
[deleted]
mwww 13y ago
2FA will make password managers obsolete.
bobbles 13y ago
In addition, for those using a Windows PC in a remote location (such as travelling and visiting an internet cafe) a simple step you can take to help avoid this issue is to use the on-screen keyboard. It's available as an accessibility option, but you can also open it using "Windows Key + R", and then type "osk" Of course, you should take care to shield your screen while you type the password, or use a combination of mouse+keyboard when entering it.
Guest9821 13y ago
I gave up on Google yesterday, when I tried to log-in to my account, from home, with the correct username and password, and they decided to lock me out. They said it was a 'new location', and to recover, I needed to know the answer to my 5 year old security question. That wasn't possible, so the other option was entering the month my account was created. The month? I can narrow it down to a 3 year window at best. Needless to say, recovery failed, and I can no longer access my account, because Google just decided I'm not me.
- mafro 13y ago
  Another lesson people need to learn is to keep their security information up to date! Google (and others) periodically prompt you to do this. I suppose it gets treated much like regularly changing your password though.. Saying that, I'm sorry to hear you got locked out! How inconvenient.
  - Guest9821 13y ago
    I have my passwords secure, and use Keepass. The database is backed up on my Truecrypt external drives, in case my laptop is stolen, and I lose the database file. I figure my job is to protect my username and password, so that's exactly what I do, secure them, and have backups. What I don't expect is getting locked out of my account when I have the valid username and password to login. Also, Google provides zero support. I generate them at least $20k a year in profits off advertising, and I lose my Gmail account for no reason. Anyway, I'm done with them, and switching to alternatives.
    - xycombinator 13y ago
      I keep all security questions and answers in Keepass. If you had done that would you have been locked out?
ampersandy 13y ago
Facebook just gave a talk at an HN London meetup recently about exactly this topic: http://vimeo.com/80460475#t=11m48s http://vimeo.com/80460475#t=11m48s . The gist is that 2FA doesn't work because people don't enable it, but you can protect accounts by detecting anomalous behaviour on logins.
dnKK 13y ago
I've been on 2-factor auth for a while, but only switched to a password manager after my "default" password got hacked in that Adobe incident some weeks back. (KeePassX!)
ajcarpy2005 13y ago
I enabled 2 Factor Authentication some time ago and know I am much more secure now. As for password managers, I think it would be cool if the browser &/or websites could figure out a way to launch a default password manager installed on the computer (or in the cloud?) and auto-populate a strong password and enter it into the manger. Way more people would use best practices if they were virtually automatic.
XorNot 13y ago
I don't care for two-factor authentication because I use a password manager. What I'd like is the option to use a one-time-password when I'm sitting at a computer I don't trust.
- salehenrahman 13y ago
  Two-factor authentication might partially be the answer to that. You still provide your own password, except that a second password is generated when you request to be logged in. At least that how I think it works.
- yaix 13y ago
  That would be much more useful. My password is strong enough, but I would never use an computer other than my own to log into Gmail or any other important account. One-time passwords would be a good thing to have. Maybe possible with 2-factor-auth, but it would still require me to input my password on an untrusted device. No.
- Zecc 13y ago
  So if I understand this, this is how it would work. At any time you'd have two passwords: one regular, which you use every day; and one for one-time-use only, which you keep around in case of need. When sitting at an untrusted computer, you use your one-time-use password. This proves your identity, but also immediately expires your one-time-use password. Next time you want to generate a usable one-time-password you'll have to login with your regular password again. Is that it?
  - XorNot 13y ago
    More like the OTP token would be on my smartphone or some other device, so I can generate passwords as needed that are guaranteed to be unique. But they don't require my normal password to be entered at all. I'd accept punching in my real password or a code on my phone to generate the smart token, since the time required to brute force something like that would be give me plenty of time to revoke it's authorization.
cheald 13y ago
I got my dad to start using 2FA by using a CUDA password cracker to brute-force his password in about 30 seconds. Nothing quite like a hands-on demo.

by codeka 13y ago

dba7dba 13y ago

I agree. However for people just not interested in tech stuff, teaching them how to use 2 factor authentication is pretty hard. I tried writing out the tutorial for friends but realized it's pretty daunting for regular users. What if Google started charging people (only ones with credit card on file which means they are in place with necessary infrastructure) $5 a year for NOT using 2 factor authentication... I guess I can dream...

zzleeper 13y ago

What happens if I'm i) outside the country, so no SMS for me, ii) outside cell tower coverage but with wifi (happens every day for me inside buildings), or I got my cellphone stolen for instance. How does 2fauth works in that case? (Just wondering, as the above are the reasons I decided not to use it)

blairbeckwith 13y ago
Authentication apps like Google Authenticator or Authy work without any data service of any kind. Most services provide backup codes you can print out and keep in your wallet or another safe spot in case you lose or destroy your device.
- modeless 13y ago
  You can print two copies of your backup codes, keep one in your wallet and one at home. You don't have to worry too much about them getting stolen because they are useless without your password. You can also generate a new set of backup codes at any time, which invalidates the old ones.
  - deleted 13y ago
    [deleted]
bbernoulli 13y ago
With google's 2FA, you can print out codes ahead of time that can each be used once in place of the SMS'd code. Bring some of those with you, perhaps...
celticjames 13y ago
In google's case, you can print out a set of auth codes for times when you don't have your phone.
potatolicious 13y ago
2-factor authentication does not require the second factor every time. It typically only asks for the second factor if the device is unrecognized, or the usage pattern is unfamiliar. So, your laptop that's logged into GMail will stay logged in when you're out of the country. Unless you explicitly log out, it will stay this way. I enter maybe one two-factor auth code a week, if that. So: i) Prepare ahead and log into your services. ii) Walk to the nearest window, get the code, and go back to your desk. iii) Replace your phone - you keep your number - request the auth key again. None of these are completely seamless of course, but the idea is that all of the above happen rarely enough, and are mitigable enough, that it's far better than the alternative: getting pwned. There are also second factors in the form of mobile apps, which eliminate the need for SMS, so as long as you have data/WiFi you're set. There are also ones that don't need data at all (see: the Battle.net Authenticator, which is basically a RSA key on your phone), but require more substantial initial setup.
- sp332 13y ago
  All the 2-factor entry boxes I've seen make the "trust" optional. If you want to be asked every time, just uncheck the box.
- nl 13y ago
  This advice isn't incorrect, but it isn't entirely accurate either. The Google Authenticator mobile app doesn't require data, so that meets the OP's requirements perfectly (ie, no SMS or data). Use that, print out the one-time use codes and keep them in your wallet.
axus 13y ago
With gmail, you get 10 one-time use codes, which you can keep on a small slip of paper. So if you need to register on someone else's computer, you can use one of the codes and cross it off. If you lose the codes but not your device, you can print out new ones.
Macha 13y ago
As far as I know's Google's authenticator app works by using a PRNG being seeded with a unique code for your account that's transferred when you first setup the authenticator and the current time. The app certainly works without a network connection. AS for theft, you have backup codes which you should store securely (in a Truecrypt file with multiple backups or something), which allow you to log into your account once per code.
- ubercow13 13y ago
  Why not print them out and put them in your wallet, like Google suggests. It's probably safer.
  - tvladeck 13y ago
    my solution is to have them in an encrypted evernote note
darkhorn 13y ago
When you are activating 2-factor authentication it gives you around 10 codes that you need to write down or print, to a wallet or under your freezer ets. However in university when I sit to a computer everytime I have to open a new clean Windows session, it leads me to enter 2-factor 4-5 a day. Thus I don't use it.

Goopplesoft 13y ago

Yup, exactly why I made https://GAuthify.com https://GAuthify.com, keep it standard via Google Authenticator and allow other options like SMS, Voice and Email. If you want to add it to your app and can't afford it, shoot support and email and I'll try to set you up with a discount/free-er account.

nodesocket 13y ago
GAuthify is great. Super easy to implement (libraries in almost all major languages), and supports auth mechanisms via (GA, SMS, Voice, and E-Mail).

srikrishnan 13y ago

I had twitter's 2 factor auth set up. Guess what? I was once logged out and couldn't login again. It just stopped working. I enter the code I receive over SMS and I go back to the login screen. I tweeted to @twitter from a signed in device and tried to get help for days. No response. Finally ended up dis-associating my phone number from twitter via an SMS and haven't gone back to 2-factor auth again.

hawkharris 13y ago

I'm with you on 2 factor auth, but I'm not sure about the password manager. I've always felt like putting all your passwords in one place defeats the purpose of memorizing separate, secure passwords (or, better yet, pass phrases).

sbov 13y ago
The purpose of separate, secure passwords is because otherwise all it takes is 1 website out there to be insecure to compromise all your logins. If your computer is compromised you already lost, regardless of whether you use a password manager or not.
- hawkharris 13y ago
  If a person accesses your phone or laptop, he or she will not necessarily have access to all your credentials for various services and for other devices. But if all this info is stored in one place, in a password manager, the scope of the potential data breach suddenly grows.
  - sliverstorm 13y ago
    They don't suddenly have access, if your password manager is secure and your master password is strong. That's one of the nice things about password managers. You reduce the number of potential points of failure from many to one. Why is this good? Think of Thermopylae. You increase the stakes, but you also dramatically improve your ability to fight back.
jacalata 13y ago
The purpose of memorizing the passwords is a) so you always have access to them b) so they are safe The idea is that password managers should meet both these goals as well.

hadem 13y ago

For those who are curious, information for Google's 2-step verification process can be found here: http://www.google.com/landing/2step http://www.google.com/landing/2step

tfe 13y ago

Does anyone maintain a list of sites/services that support two factor auth? I'd like to be able to go through a list and make sure I have it enabled for all services where I have an account. All the articles I've found are at least a couple months old.

tlrobinson 13y ago

Agreed. 2FA is still rare enough that if a service you use offers 2FA, that's a sign you should probably use it.

eduardordm 13y ago

Certainly a good - and probably the best - option right now. But maybe there are simpler alternatives. Maybe passwords shoudn't mean anything, just like losing a key on a busy street is not exactly a security threat to its owner, password leaks shouldn't be harmful. Maybe the problem is not how passwords are stored or encrypted but how meaninful our 'ids' are - and how they are attached to that password.

deleted 13y ago

[deleted]

mwww 13y ago

2FA will make password managers obsolete.

bobbles 13y ago

In addition, for those using a Windows PC in a remote location (such as travelling and visiting an internet cafe) a simple step you can take to help avoid this issue is to use the on-screen keyboard. It's available as an accessibility option, but you can also open it using "Windows Key + R", and then type "osk" Of course, you should take care to shield your screen while you type the password, or use a combination of mouse+keyboard when entering it.

Guest9821 13y ago

I gave up on Google yesterday, when I tried to log-in to my account, from home, with the correct username and password, and they decided to lock me out. They said it was a 'new location', and to recover, I needed to know the answer to my 5 year old security question. That wasn't possible, so the other option was entering the month my account was created. The month? I can narrow it down to a 3 year window at best. Needless to say, recovery failed, and I can no longer access my account, because Google just decided I'm not me.

mafro 13y ago
Another lesson people need to learn is to keep their security information up to date! Google (and others) periodically prompt you to do this. I suppose it gets treated much like regularly changing your password though.. Saying that, I'm sorry to hear you got locked out! How inconvenient.
- Guest9821 13y ago
  I have my passwords secure, and use Keepass. The database is backed up on my Truecrypt external drives, in case my laptop is stolen, and I lose the database file. I figure my job is to protect my username and password, so that's exactly what I do, secure them, and have backups. What I don't expect is getting locked out of my account when I have the valid username and password to login. Also, Google provides zero support. I generate them at least $20k a year in profits off advertising, and I lose my Gmail account for no reason. Anyway, I'm done with them, and switching to alternatives.
  - xycombinator 13y ago
    I keep all security questions and answers in Keepass. If you had done that would you have been locked out?

ampersandy 13y ago

Facebook just gave a talk at an HN London meetup recently about exactly this topic: http://vimeo.com/80460475#t=11m48s http://vimeo.com/80460475#t=11m48s . The gist is that 2FA doesn't work because people don't enable it, but you can protect accounts by detecting anomalous behaviour on logins.

dnKK 13y ago

I've been on 2-factor auth for a while, but only switched to a password manager after my "default" password got hacked in that Adobe incident some weeks back. (KeePassX!)

ajcarpy2005 13y ago

I enabled 2 Factor Authentication some time ago and know I am much more secure now. As for password managers, I think it would be cool if the browser &/or websites could figure out a way to launch a default password manager installed on the computer (or in the cloud?) and auto-populate a strong password and enter it into the manger. Way more people would use best practices if they were virtually automatic.

XorNot 13y ago

I don't care for two-factor authentication because I use a password manager. What I'd like is the option to use a one-time-password when I'm sitting at a computer I don't trust.

salehenrahman 13y ago
Two-factor authentication might partially be the answer to that. You still provide your own password, except that a second password is generated when you request to be logged in. At least that how I think it works.
yaix 13y ago
That would be much more useful. My password is strong enough, but I would never use an computer other than my own to log into Gmail or any other important account. One-time passwords would be a good thing to have. Maybe possible with 2-factor-auth, but it would still require me to input my password on an untrusted device. No.
Zecc 13y ago
So if I understand this, this is how it would work. At any time you'd have two passwords: one regular, which you use every day; and one for one-time-use only, which you keep around in case of need. When sitting at an untrusted computer, you use your one-time-use password. This proves your identity, but also immediately expires your one-time-use password. Next time you want to generate a usable one-time-password you'll have to login with your regular password again. Is that it?
- XorNot 13y ago
  More like the OTP token would be on my smartphone or some other device, so I can generate passwords as needed that are guaranteed to be unique. But they don't require my normal password to be entered at all. I'd accept punching in my real password or a code on my phone to generate the smart token, since the time required to brute force something like that would be give me plenty of time to revoke it's authorization.

cheald 13y ago

I got my dad to start using 2FA by using a CUDA password cracker to brute-force his password in about 30 seconds. Nothing quite like a hands-on demo.