Re:Two Factor Auth List
by jug6ernaut on Monday March 17, 2014 @12:03PM
(#7415898)
While this is all good(and it is, no sarcasm intended).
What I really want/care about is banking sites/companies. If this website could also compile a list for these institutions that would be awesome. It truly amazes me how most major banks lack 2fa.
Re:Two Factor Auth List
by jmspring on Monday March 17, 2014 @03:48PM
(#7417594)
A long while back, American Express through it's Blue card line actually proposed the use of a card reader and physical token (the card for internet purchases). It never took off.
I feel that I should point out that nearly every UK banking site uses 2fa for transactions, and many as an option for login. This only comes with chip & pin.
Re:Two Factor Auth List
by joe_inferno on Monday March 17, 2014 @05:16PM
(#7418154)
I setup a bank account in Germany in 2007 that issued me a hardware token generator (I forget the name of the bank). It was my first experience with 2 factor auth, and I'm a little surprised that I have yet to see it implemented with banks in the US.
Re:Two Factor Auth List
by luchs on Monday March 17, 2014 @05:44PM
(#7418324)
Today, these usually work by transmitting some code via a flickering field on the website. You insert your bank card into the generator, hold it to your screen and type the number it shows on the device.
Re:Two Factor Auth List
by jonesetc on Monday March 17, 2014 @03:37PM
(#7417522)
You are right, but the end of that article alluded to a bit of an interchangeability.
> They're adding support in the next few weeks for Google Authenticator tokens to their system as well. That way you can use Authy's great UI to access your Google codes through one app.
So I got looking, and it looks like now you can always use Authy for google authenticator tokens [1].
It's only a few lines of code and other than having sync'ed clocks does not require any other running services. At one point I implemented it as a second factor for my most important servers that I ssh to so that my IP would be unlocked for 45 minutes after the initial connection.
Re:Two Factor Auth List
by hoov on Monday March 17, 2014 @12:12PM
(#7415954)
That's exactly what I was going to say. I finally put 2FA on my Dropbox account a while ago. Scanned the QR code in Authy, and everything worked just ifne.
Re:Two Factor Auth List
by torbjorn on Monday March 17, 2014 @05:12PM
(#7418124)
I use two factor authentication apps on my phone to generate my one time passwords. This works great for me but I always wonder what I will do if I lose my phone.
I've backed up the authenticator apps. I am correct in assuming I can restore the one time password generators from the back-ups? Is there anything else I should do?
Re:Two Factor Auth List
by rahimnathwani on Monday March 17, 2014 @09:20PM
(#7419353)
If you have a phone and a tablet, install Google Authenticator and Authy on each, and scan the QR code with each app (a total of 4 times). As long as the clocks are in sync it will work fine, and protects access in case of:
- loss of 1 device, and
- one of the apps not being available (e.g. during a stuck iOS app update)
Re:Two Factor Auth List
by kramerc on Monday March 17, 2014 @05:33PM
(#7418249)
I have used Titanium Backup to restore Google Authenticator and Battle.net Mobile Authenticator onto a different device and both apps have retained my accounts with no problem at all. So yes, you are correct in assuming that you can restore OTP generators from backups.
Re:Two Factor Auth List
by da_n on Monday March 17, 2014 @07:08PM
(#7418740)
I can also confirm this. AS well as local, I have set Titanium Backup to send an additional (encrypted) backup to a cloud storage service as well (in my case Google Drive). I have restored from Titanium Backup many times with different ROMS and different phones.
Re:Two Factor Auth List
by mercnet on Monday March 17, 2014 @11:38AM
(#7415699)
I tried to setup Facebook Two Factor Auth and it says: "Make sure you have the latest version of the Facebook app on your device." According to your site, Facebook supports Google Auth but I am clueless on how to set this up without installing the FB android app.
Re:Two Factor Auth List
by dunham on Monday March 17, 2014 @04:34PM
(#7417913)
Evernote's documentation says they "recommend" Google Authenticator, but I've never managed to set it up because their setup process requires SMS. (Is the TOTP support premium only?)
This is a great resource. However, the SMS column might require some expansion as although some of the companies on this list support SMS two-factor auth, they don't support it outside of the US. Paypal, for example, does not support Finland (checked last week).
Re:Two Factor Auth List
by markhall on Monday March 17, 2014 @11:21AM
(#7415545)
Great site. Is there a way (as a user) to mandate two-factor authentication on sites that don't natively offer it? I recognize that the obvious answer is no, but I'm curious to know if anyone has tried workarounds.
Re:Two Factor Auth List
by amalag on Monday March 17, 2014 @03:14PM
(#7417356)
Sites didn't have a standard to follow and not everyone has the resources of Google to roll their own. Now that the Fido Alliance has big names on it, I hope to see companies use it.
Re:Two Factor Auth List
by caio1982 on Monday March 17, 2014 @04:38PM
(#7417947)
That's a great resource! The first step before increased security is to increase awareness. Big service providers must be put on spot about two factor authentication IMHO.
Re:Two Factor Auth List
by bradleybuda on Monday March 17, 2014 @02:21PM
(#7416955)
Even non-SAML sites can get 2FA support via Google Auth -our company Meldium (https://www.meldium.com/) now supports over 1,000 web apps, while there are only a few dozen major SaaS apps with SAML support.
Neat idea for a site.
What I really want/care about is banking sites/companies. If this website could also compile a list for these institutions that would be awesome. It truly amazes me how most major banks lack 2fa.
An article on such -- http://bits.blogs.nytimes.com/2008/12/05/a-credit-card-loses...
That said, their own site (at least when I last changed my password) had some fairly silly password rule restrictions like no punctuation.
The German Wikipedia has some pictures: http://de.wikipedia.org/wiki/Transaktionsnummer#chipTAN_comf...
I just went to send a web-form email to my bank about it, and got this error:
> Input contains invalid characters. e.g. angle bracket, quotes, slashes, semicolon.
If a web form doesn't allow basic punctuation, I don't hold out much hope for a two-factor authentication system.
It gives off an impression that it's bad that they don't have their own custom solution to 2FA.
2. https://library.linode.com/linode-manager-security for the dev section.
> They're adding support in the next few weeks for Google Authenticator tokens to their system as well. That way you can use Authy's great UI to access your Google codes through one app.
So I got looking, and it looks like now you can always use Authy for google authenticator tokens [1].
http://blog.authy.com/authenticator
It's only a few lines of code and other than having sync'ed clocks does not require any other running services. At one point I implemented it as a second factor for my most important servers that I ssh to so that my IP would be unlocked for 45 minutes after the initial connection.
There's also HOTP.
- loss of 1 device, and - one of the apps not being available (e.g. during a stuck iOS app update)
amazon supports MFA, but the site seems to not know that...
The Amazon they list above it is for the consumer store which AFAIK doesn't support MFA yet.
Also NearlyFreeSpeech, though the domain selection is very limited, as it's primarily a hosting company: https://blog.nearlyfreespeech.net/2014/02/28/price-cuts-more...