[tor-talk] Tor-Friendly Two-Factor Authentication?
Allen
allenpmd at gmail.com
Sat Jun 11 02:13:37 UTC 2016
On Fri, Jun 10, 2016 at 9:58 PM, Scott Arciszewski <scott at paragonie.com>
wrote:
> * FIDO U2F requires users to purchase separate hardware devices which,
> while cheap, aren't already in the arsenal of most netizens
>
How about developing a simple 2FA app for a smartphone? Maybe a smartphone
could emulate a FIDO U2F? Alternately, I remember some of the first 2FA
devices were fobs that displayed a 6 digit code that changed every 15
seconds or so, based a pseudorandom generator that had a secret seed value
that was known by the server. A simple smartphone app design might be to
give the user a pseudorandom seed when they create their account, the user
inputs the seed into the app on their phone, and then when they want to
login they have to enter a 6-8 digit code displayed by their smartphone
app. Maybe some apps like that already exist...
More information about the tor-talk
mailing list