News for hackers. Stuff that matters.

A comment on Authy (YC W12) launches two-factor auth as a service. Parent comment

Re:Authy (YC W12) launches two-factor auth as a service by drivebyacct2 on Thursday August 02, 2012 @03:20PM (#4330483)
This is a horrifying prospect. One that you would trust a LAN, two that you would want any external device to QUERY the credentials and access the creds of another device.

Horrifying. There are so many better ways of providing zero interaction auth that is secure: BrowserID, NFC (smartphones that can thus do asymmetric encryption), the QR experiment Google did.

Even if you just tweaked your idea to do something along the lines of what Google did... You go to a browser, type gmail.com, enter your email address. They push an event via GCM and your phone asks if you trust the computer that just asked for auth. You click "YES". Similar flow, but no where near as horrifying.

[ Parent | on HN ]
Re:Authy (YC W12) launches two-factor auth as a service by stcredzero on Friday August 03, 2012 @05:44AM (#4333304)
> This is a horrifying prospect. One that you would trust a LAN, two that you would want any external device to QUERY the credentials and access the creds of another device.

I'm horrified that people jump to such stupid conclusions. There is no need for one machine to query credentials of the phone or vice versa. The browser just sends out a signal and the phone can supply the 2nd factor to the server.

[ Parent | on HN ]