Re:The Definitive Guide To Website Authentication
by tptacek on Monday August 08, 2011 @01:47PM
(#2860886)
It's not tied to a Google account, it has a better end-user experience, a better developer experience, and an extremely credible team behind it. That said, if you were using Google Auth and I assessed your application, I wouldn't ding you for using it.
Re:The Definitive Guide To Website Authentication
by ceejayoz on Monday August 08, 2011 @10:13PM
(#2862492)
Google Authenticator isn't tied to a Google account, and developing for it involves implementing a single algorithm.
Re:The Definitive Guide To Website Authentication
by drivebyacct2 on Monday August 08, 2011 @02:04PM
(#2860975)
Well the Google Authenticator application is just an implementation. I can use any TOTP generator to get access to my Google Account, or alternatively if I use the PAM module they've provided, I can use whatever I want to generate my codes to log in to my Linux machine. It just so happens that they use this mechanism for their two factor auth for Google Accounts.
I definitely hear you on the better user/dev experience. That's very clear from the variety of methods and slick screenshots they've got.
Looks like Duo has more options for receiving the code as well as the ability to enable manual approve/deny for another user role. It also looks like a private service I have to rely on though.