News for hackers. Stuff that matters.

A comment on NIST declares the age of SMS-based 2-factor authentication over. Parent comment

Re:NIST declares the age of SMS-based 2-factor authenticatio... by scrollaway on Tuesday July 26, 2016 @03:53AM (#12163986)
TOTP is a standard. It just works, and it always does, even if you don't have internet on your phone. Even if you don't have reception. Even if you're out of credit. Even if you're out of the country. Even if your telecom provider hates you. Authy is TOTP. Google Authenticator is TOTP. They are all interchangeable. You can use FreeOTP if you don't want to deal with those: https://fedorahosted.org/freeotp/

Steam is SMS, and I heard they now have a shitty custom 2fa but what you're describing is services that don't use an established standard, which is compatible with hundreds of established clients. SMS isn't merely nonstandard (and now deprecated), it's more expensive for both the user (requires an active sim card) and the server (requires sending SMS to numbers all over the world).

[ Parent | on HN ]
Re:NIST declares the age of SMS-based 2-factor authenticatio... by _puk on Tuesday July 26, 2016 @05:35AM (#12164404)
The argument I've heard for why steam requires a custom 2fa is to do with trading on the marketplace [1]

The custom component makes sure that marketplace activity is valid (somewhat like the custom banking dongles you get that require both your pin and some transaction identifier).

They'd be better off allowing the option of standard TOTP auth for login, so users can use a standard authenticator app, and then layer on a custom app for trading if needed.

1: http://steamcommunity.com/discussions/forum/0/49463187366895...

[ Parent | on HN ]
Re:NIST declares the age of SMS-based 2-factor authenticatio... by WorldMaker on Tuesday July 26, 2016 @12:28PM (#12166769)
Right their needs don't really justify a custom 2FA at all. Security through obscurity isn't all that much of an advantage and bundling the trade approvals and 2FA into the same app is maybe nicer for some users, but technically unnecessary. If anything it just scans as Valve's traditional NIH syndrome being exhibited here.
[ Parent | on HN ]
Re:NIST declares the age of SMS-based 2-factor authenticatio... by scrollaway on Tuesday July 26, 2016 @05:49AM (#12164453)
Can you elaborate? I don't use the marketplace; how does the custom component achieve any of that?
[ Parent | on HN ]
Re:NIST declares the age of SMS-based 2-factor authenticatio... by asuffield on Tuesday July 26, 2016 @05:48AM (#12164452)
Detail: Google Authenticator is TOTP or HOTP, depending on how the service owner set it up.
[ Parent | on HN ]