News for hackers. Stuff that matters.
Re:How to add Two-Factor Authentication to your website with... by philsnow on Thursday April 11, 2013 @04:57PM (#5534740)
Specifically, if you set things up as in the linked article, no traffic or other information is going to Google (unless you think that the Google Authenticator app is leaking info to Google for whatever reason). Specifically, Google doesn't see how many logins your app gets.

If you're trying to sneak up on a market, or if for some reason you're trying to hide from Google the number of active users you have, you might see this as an advantage.

Re:How to add Two-Factor Authentication to your website with... by fusiongyro on Thursday April 11, 2013 @05:06PM (#5534805)
I might consider it an advantage if Google isn't able to snuff out my user's accounts/access with impunity. I don't understand the technology enough to know whether that is the case, but I wouldn't rely on Google for authentication at this point for this reason.
Re:How to add Two-Factor Authentication to your website with... by jf on Thursday April 11, 2013 @05:12PM (#5534848)
TOTP is surprisingly easy to understand and implement. I do my best to explain how it works in the "Understanding TOTP" section of this article. Take a look at that section and let me know if it makes sense.
Re:How to add Two-Factor Authentication to your website with... by fusiongyro on Thursday April 11, 2013 @05:21PM (#5534898)
What's ambiguous about it is whether or not I need a Google account (and whether Google having taken away that account, I can still log into your service). The "Understanding TOTP" section seems to be saying that you don't and they can't, in which case there's nothing to object to.
Re:How to add Two-Factor Authentication to your website with... by jf on Thursday April 11, 2013 @07:04PM (#5535416)
Great feedback, thanks. I've updated the "Adding Google Authenticator" section with a note that should make that less ambiguous.
Re:How to add Two-Factor Authentication to your website with... by js4all on Friday April 12, 2013 @05:42PM (#5541237)
That's a valid point, if you don't rely on Webmaster tools and analytics. If you do, they can extract this information anyway.