Authy (YC W12) launches two-factor auth as a service

Re:Authy (YC W12) launches two-factor auth as a service by stcredzero on Thursday August 02, 2012 @02:25PM (#4330181)

I want interaction-free TFA in my phone. I want to be able to walk up to a computer, put in my username and maybe a PIN, and subsequently have every website log me in because the browser knows my phone is on the same LAN as the browser or is in NFC or Bluetooth range.

But I would especially want this if the TFA is running on a separate system from the main CPU in my smartphone, only sharing radio/networking hardware at most. This wouldn't be foolproof, but if my smartphone OS company can patch security holes in a timely manner and deliver the patches on-air, then this is good enough for me.

If Authy can deliver the 2nd factor automatically from my iPhone to my other devices through Bonjour, I will rave favorably about them to everyone who will listen.

[ Parent | on HN ]

Re:Authy (YC W12) launches two-factor auth as a service by semenko on Thursday August 02, 2012 @02:36PM (#4330239)

I wouldn't be surprised if Google has tried this.

Remember their short-lived QR code-based logon system?

http://www.theverge.com/2012/1/17/2714263/google-experiment-...

http://www.zdnet.com/blog/igeneration/googles-qr-code-log-in...

[ Parent | on HN ]

Re:Authy (YC W12) launches two-factor auth as a service by drivebyacct2 on Thursday August 02, 2012 @03:20PM (#4330483)

This is a horrifying prospect. One that you would trust a LAN, two that you would want any external device to QUERY the credentials and access the creds of another device.

Horrifying. There are so many better ways of providing zero interaction auth that is secure: BrowserID, NFC (smartphones that can thus do asymmetric encryption), the QR experiment Google did.

Even if you just tweaked your idea to do something along the lines of what Google did... You go to a browser, type gmail.com, enter your email address. They push an event via GCM and your phone asks if you trust the computer that just asked for auth. You click "YES". Similar flow, but no where near as horrifying.

[ Parent | on HN ]

Re:Authy (YC W12) launches two-factor auth as a service by stcredzero on Friday August 03, 2012 @05:44AM (#4333304)

> This is a horrifying prospect. One that you would trust a LAN, two that you would want any external device to QUERY the credentials and access the creds of another device.

I'm horrified that people jump to such stupid conclusions. There is no need for one machine to query credentials of the phone or vice versa. The browser just sends out a signal and the phone can supply the 2nd factor to the server.

[ Parent | on HN ]