Two Factor Auth List

by davis • 12 years ago

104 43 12 years ago

markhall• 12 years ago

Great site. Is there a way (as a user) to mandate two-factor authentication on sites that don't natively offer it? I recognize that the obvious answer is no, but I'm curious to know if anyone has tried workarounds.

mercnet• 12 years ago

I tried to setup Facebook Two Factor Auth and it says: "Make sure you have the latest version of the Facebook app on your device." According to your site, Facebook supports Google Auth but I am clueless on how to set this up without installing the FB android app.

sp3322• 12 years ago

Head to https://www.facebook.com/settings?tab=security&section=code_... and click "Set up another way to get security codes."

gergles• 12 years ago

You should probably rename Google Auth to "TOTP" since that's what is actually supported.

Neat idea for a site.

nacs2• 12 years ago

Agreed. I don't see why they list Google Auth and Authy separately when they both support the same TOTP system.

richbradshaw• 12 years ago

Authy also supports (it's own?) TFA system that is incompatible with the google app.

brady8• 12 years ago

If it works with Google Auth, it also works with Authy - same algorithm.

hoov• 12 years ago

That's exactly what I was going to say. I finally put 2FA on my Dropbox account a while ago. Scanned the QR code in Authy, and everything worked just ifne.

martiuk• 12 years ago

I would change custom to not show red if it doesn't exist.

It gives off an impression that it's bad that they don't have their own custom solution to 2FA.

thrush• 12 years ago

There are sites that allow you to add 2FA to practically any site. Okta for example has this feature.

mmaha• 12 years ago

+1. Any SAML enabled (or WS-FED) site can be integrated with Okta to offer 2FA.

bradleybuda• 12 years ago

Even non-SAML sites can get 2FA support via Google Auth -our company Meldium (https://www.meldium.com/) now supports over 1,000 web apps, while there are only a few dozen major SaaS apps with SAML support.

jug6ernaut• 12 years ago

While this is all good(and it is, no sarcasm intended).

What I really want/care about is banking sites/companies. If this website could also compile a list for these institutions that would be awesome. It truly amazes me how most major banks lack 2fa.

alexchamberlain• 12 years ago

I feel that I should point out that nearly every UK banking site uses 2fa for transactions, and many as an option for login. This only comes with chip & pin.

joe_inferno• 12 years ago

I setup a bank account in Germany in 2007 that issued me a hardware token generator (I forget the name of the bank). It was my first experience with 2 factor auth, and I'm a little surprised that I have yet to see it implemented with banks in the US.

jmspring• 12 years ago

A long while back, American Express through it's Blue card line actually proposed the use of a card reader and physical token (the card for internet purchases). It never took off.

An article on such -- http://bits.blogs.nytimes.com/2008/12/05/a-credit-card-loses...

That said, their own site (at least when I last changed my password) had some fairly silly password rule restrictions like no punctuation.

coffeecheque• 12 years ago

I agree. Banking login options are far from the most secure. My phpBB login passwords are much, much more secure than my banking.

I just went to send a web-form email to my bank about it, and got this error:

Input contains invalid characters. e.g. angle bracket, quotes, slashes, semicolon.

If a web form doesn't allow basic punctuation, I don't hold out much hope for a two-factor authentication system.

batman0219• 12 years ago

or http://evanhahn.com/2fa/

IgorPartola2• 12 years ago

Random: I really like how simple the Google Authenticator's TOTP algorithm is: https://github.com/tadeck/onetimepass/blob/master/onetimepas...

It's only a few lines of code and other than having sync'ed clocks does not require any other running services. At one point I implemented it as a second factor for my most important servers that I ssh to so that my IP would be unlocked for 45 minutes after the initial connection.

StavrosK2• 12 years ago

Nitpick: It's not Google's, it's an open standard (OATH): http://tools.ietf.org/html/rfc6238

There's also HOTP.

IgorPartola2• 12 years ago

You are right, I should have elaborated. Just like most people, I first learned about it from using the Google Authenticator app.

jonesetc2• 12 years ago

1. I thought Google auth and Authy were interchangeable.

2. https://library.linode.com/linode-manager-security for the dev section.

nav1• 12 years ago

Authy use their own system, but the app also supports TOTP.

sp3322• 12 years ago

Not sure of the details, but according to https://blog.cloudflare.com/choosing-a-two-factor-authentica... they are not (always) interchangeable.

jonesetc2• 12 years ago

You are right, but the end of that article alluded to a bit of an interchangeability.

They're adding support in the next few weeks for Google Authenticator tokens to their system as well. That way you can use Authy's great UI to access your Google codes through one app.

So I got looking, and it looks like now you can always use Authy for google authenticator tokens [1].

http://blog.authy.com/authenticator

amalag• 12 years ago

Sites didn't have a standard to follow and not everyone has the resources of Google to roll their own. Now that the Fido Alliance has big names on it, I hope to see companies use it.

malandrew• 12 years ago

Is there a decent hacker-friendly domain name provider that supports 2FA?

cr3ative• 12 years ago

gandi.net fits both your requirements.

deftnerd• 12 years ago

namesilo.com is the best domain registrar I've used. No upsells, dirt cheap, great API, and 2fa.

footpath• 12 years ago

There's Dynadot: http://www.dynadot.com/domain/security.html

Also NearlyFreeSpeech, though the domain selection is very limited, as it's primarily a hosting company: https://blog.nearlyfreespeech.net/2014/02/28/price-cuts-more...

dunham• 12 years ago

Evernote's documentation says they "recommend" Google Authenticator, but I've never managed to set it up because their setup process requires SMS. (Is the TOTP support premium only?)

caio1982• 12 years ago

That's a great resource! The first step before increased security is to increase awareness. Big service providers must be put on spot about two factor authentication IMHO.

torbjorn• 12 years ago

I use two factor authentication apps on my phone to generate my one time passwords. This works great for me but I always wonder what I will do if I lose my phone. I've backed up the authenticator apps. I am correct in assuming I can restore the one time password generators from the back-ups? Is there anything else I should do?

kramerc• 12 years ago

I have used Titanium Backup to restore Google Authenticator and Battle.net Mobile Authenticator onto a different device and both apps have retained my accounts with no problem at all. So yes, you are correct in assuming that you can restore OTP generators from backups.

da_n• 12 years ago

I can also confirm this. AS well as local, I have set Titanium Backup to send an additional (encrypted) backup to a cloud storage service as well (in my case Google Drive). I have restored from Titanium Backup many times with different ROMS and different phones.

rahimnathwani• 12 years ago

If you have a phone and a tablet, install Google Authenticator and Authy on each, and scan the QR code with each app (a total of 4 times). As long as the clocks are in sync it will work fine, and protects access in case of:

- loss of 1 device, and - one of the apps not being available (e.g. during a stuck iOS app update)

deanclatworthy• 12 years ago

This is a great resource. However, the SMS column might require some expansion as although some of the companies on this list support SMS two-factor auth, they don't support it outside of the US. Paypal, for example, does not support Finland (checked last week).

DomBlack• 12 years ago

This could do with a column for Yubikey support.

mindstab• 12 years ago

http://aws.amazon.com/iam/details/mfa/

amazon supports MFA, but the site seems to not know that...

nacs2• 12 years ago

Thats for AWS which is listed as supported further down the page as Amazon Web Services under the "Developer" section.

The Amazon they list above it is for the consumer store which AFAIK doesn't support MFA yet.

Two Factor Auth List

Related Stories