Authy (YC W12) launches two-factor auth as a service

http://techcrunch.com/2012/08/02/y-combinator-backed-startup-authy-wants-to-help-you-prevent-a-dropbox-style-security-snafu/

by danielpal • 14 years ago

93 33 14 years ago

techcrunch.com

aresant2• 14 years ago

Brilliant timing for launch w/the recent DropBox debacle - did the Authy team push launch to draft on that story?

klint2• 14 years ago

No, I was already talking to them about the story. They just lucked out on the timing.

aresant2• 14 years ago

Awesome, love getting the details on these things given my own experiences w/PR and how timing specific press opportunities can be.

Would make an interesting follow-up to understand how they pitched TC / how the DropBox timing impacted publication (if at all). Either way thanks for responding.

debacle2• 14 years ago

Doesn't Twilio already offer 90% of this functionality?

> queue jokes about Microsoft security

Cue, not queue.

sjwalter• 14 years ago

If you're able to build the solution using Twilio (or anything else), then I'm pretty sure Authy isn't for you. I think it's clear that their eventual product is going to be a simple, drop-in that enables two-factor on your mom's knitting forum.

debacle2• 14 years ago

Unless my mom's knitting forum also is an online trading platform, why do they need two factor auth? And how likely is it that their software of choice doesn't have a Twilio plugin?

gliese13372• 14 years ago

I'd think the biggest draw would be not developer ease as much as end-user ease. This way, an end user with an Authy account would only have to give their phone number out once, to Authy, or install one app from Authy, and automatically be able to use two-factor authentication on any site that supports it. It's like OpenID for the second half of two-factor auth.

klint2• 14 years ago

Thanks, fixed it.

tpr1m• 14 years ago

I wish them luck, since two-factor auth is something which should be implemented more often.

stcredzero2• 14 years ago

I want interaction-free TFA in my phone. I want to be able to walk up to a computer, put in my username and maybe a PIN, and subsequently have every website log me in because the browser knows my phone is on the same LAN as the browser or is in NFC or Bluetooth range.

But I would especially want this if the TFA is running on a separate system from the main CPU in my smartphone, only sharing radio/networking hardware at most. This wouldn't be foolproof, but if my smartphone OS company can patch security holes in a timely manner and deliver the patches on-air, then this is good enough for me.

If Authy can deliver the 2nd factor automatically from my iPhone to my other devices through Bonjour, I will rave favorably about them to everyone who will listen.

semenko2• 14 years ago

I wouldn't be surprised if Google has tried this.

Remember their short-lived QR code-based logon system?

http://www.theverge.com/2012/1/17/2714263/google-experiment-...

http://www.zdnet.com/blog/igeneration/googles-qr-code-log-in...

drivebyacct2• 14 years ago

This is a horrifying prospect. One that you would trust a LAN, two that you would want any external device to QUERY the credentials and access the creds of another device.

Horrifying. There are so many better ways of providing zero interaction auth that is secure: BrowserID, NFC (smartphones that can thus do asymmetric encryption), the QR experiment Google did.

Even if you just tweaked your idea to do something along the lines of what Google did... You go to a browser, type gmail.com, enter your email address. They push an event via GCM and your phone asks if you trust the computer that just asked for auth. You click "YES". Similar flow, but no where near as horrifying.

stcredzero2• 14 years ago

> This is a horrifying prospect. One that you would trust a LAN, two that you would want any external device to QUERY the credentials and access the creds of another device.

I'm horrified that people jump to such stupid conclusions. There is no need for one machine to query credentials of the phone or vice versa. The browser just sends out a signal and the phone can supply the 2nd factor to the server.

mehuln• 14 years ago

Considering all the security issues these days, this is just awesome. Democratization of 2-factor security is really needed. Congrats to Daniel and team!

semenko2• 14 years ago

Very neat service. The Duo Security team also has a similar product with a lot of features: http://www.duosecurity.com/

They make the X-Ray Android vulnerability scanner (http://www.xray.io/)

rdl• 14 years ago

Duo is more mature, but seems to be positioned more as an enterprise alternative to hardware tokens. They seem to charge per user per month, somewhere around $2, which would be crazy for someone like Facebook with a billion users.

fsckin2• 14 years ago

I don't want another token application.

I already have FOUR two-factor-auth apps on my phone, each with multiple tokens:

Google

RSA

Blizzard

SWTOR

If I can add all the above tokens into your app, I would consider using it. Otherwise... well, good luck with that.

danielpal• 14 years ago

I hear you. I designed authy so that 1 token would work accross sites for this same reason.

Unfortunately its not technically possible for us to allow you to install RSA, Google in our App, as that would mean we would need access to their private seed, which they don't allow.

fsckin2• 14 years ago

Is it really not possible?

Here is an example of a third party Blizzard app: http://code.google.com/p/winauth/

blake8086• 14 years ago

Are you sure? http://en.wikipedia.org/wiki/Google_Authenticator

winry• 14 years ago

That logo looks a lot like Shazam's logo.

dcu2• 14 years ago

now that big companies have been hacked, it's the time to start looking for solutions like Authy to prevent phishing attacks.

jumby• 14 years ago

or you can just implement a google authenticator & HOTP for your own site. it's open source and a billion libraries exist

dcu2• 14 years ago

in the other hand, Authy has few libraries (opensource too), one nice, simple and easy to use app (0 config), and 1 token for all apps.

kirillzubovsky• 14 years ago

I think this is really cool. Authy guys are making 2-factor authentication main stream, which is incredible. I've used them before on some sites and the process is as easy as you would want it to be. Great job!

Authy (YC W12) launches two-factor auth as a service

Related Stories