News for hackers. Stuff that matters.

A comment on NIST declares the age of SMS-based 2-factor authentication over. Parent comment

Re:NIST declares the age of SMS-based 2-factor authenticatio... by _puk on Tuesday July 26, 2016 @05:35AM (#12164404)
The argument I've heard for why steam requires a custom 2fa is to do with trading on the marketplace [1]

The custom component makes sure that marketplace activity is valid (somewhat like the custom banking dongles you get that require both your pin and some transaction identifier).

They'd be better off allowing the option of standard TOTP auth for login, so users can use a standard authenticator app, and then layer on a custom app for trading if needed.

1: http://steamcommunity.com/discussions/forum/0/49463187366895...

[ Parent | on HN ]
Re:NIST declares the age of SMS-based 2-factor authenticatio... by WorldMaker on Tuesday July 26, 2016 @12:28PM (#12166769)
Right their needs don't really justify a custom 2FA at all. Security through obscurity isn't all that much of an advantage and bundling the trade approvals and 2FA into the same app is maybe nicer for some users, but technically unnecessary. If anything it just scans as Valve's traditional NIH syndrome being exhibited here.
[ Parent | on HN ]
Re:NIST declares the age of SMS-based 2-factor authenticatio... by scrollaway on Tuesday July 26, 2016 @05:49AM (#12164453)
Can you elaborate? I don't use the marketplace; how does the custom component achieve any of that?
[ Parent | on HN ]