This is great. More companies should do this and build it in as a recommended security feature. If you use rails, you can use the two factor auth gem we built: https://github.com/tinfoil/devise-two-factor
Also, for a list of services that provide 2FA, check out http://twofactorauth.org. It's a pretty extensive list, and hopefully more companies start adding 2FA.
I'm sort of a caveman about this, but I prefer physical 2fa tokens for a lot of things. It would be nice if you could accept user input of a seed (in case I've bought a gemalto or something online) and want to register it.
Not a bad idea, I'll file it as a feature request and see if we can do it in some easy-to-use fashion. The AWS example you mention in the thread below is good, but AWS is super complicated for a random user to use :\
AWS IAM, which is kind of the gold standard in configurable xaas authentication roles (although maybe a but overly complex).
I'm looking to emulate them on this (ie shamelessly copy) whenever I have an auth system for a similarly complex multi user system to spec or implement.
I also think there are other forms of 2fa besides totp/hotp which are worth adding, and the general amazon strategy of "multiple levels of logged in stet per user" for various actions on their retail shopping site has much broader applicability too.
In general I think Amazon has done an exceptional job here across multiple products.
2FA should IMHO be standard and not make headlines!
On the other hand and with the latest Synology private cloud hacks, I am not sure if 2FA makes that much of a difference for private cloud servers. 2FA cannot be used for all logins and the solution therefore are usually additional passwords with limited user rights, however, if there is a security issue, such limited user rights are usually sufficient …
Your mileage might vary, of course, but I agree more and more that hosting your own data is probably not the right solution for most users (and maybe even for most HN folks).
What's depressing is that bank and mutual fund websites don't generally have OAUTH or 2FA and they're the ones with the worst consequences they get hijacked.
For more info check it out here: https://www.tinfoilsecurity.com/blog/two-factor-authenticati...
Also, for a list of services that provide 2FA, check out http://twofactorauth.org. It's a pretty extensive list, and hopefully more companies start adding 2FA.