Hacker News new | past | comments | ask | show | jobs | submit login

Authy also has a Desktop agent that can link with the phone's OTP. It doesn't work on Linux though.



Authy desktop is definitely a step in the right direction in terms of UX on desktop. However, I dislike that I still need to manually search for the correct 2FA entry and copy/paste the code into the browser. I mentioned in another comment [1] that I am working on a project called Two Factor Buddy (2FB) that integrates directly with the browser and automates the entry of 2FA codes entirely. IMO, a much more pleasant UX.

Also, I do not like that Authy cloud backup relies on user provided passwords because users are notoriously, insanely, ridiculously bad at creating secure passwords. If an attacker gets ahold of the encrypted secret via Authy's servers, then they can work on brute forcing it locally. IMO, the ideal is to have a simple process to sync 2FA secrets between all of your trusted devices either directly and out of band (no servers used at all), or via the web using pub/priv keys, which would be significantly more secure than a user provided password for encryption. The key is to make sure it is still insanely simple to use, though.

[1] https://news.ycombinator.com/item?id=15692691




Consider applying for YC's Spring batch! Applications are open till Feb 11.

Guidelines | FAQ | Lists | API | Security | Legal | Apply to YC | Contact

Search: