#indiewebcamp 2012-10-17

2012-10-17 UTC
dascher_, brennannovak, dascher, spinnerin, zztr, josephboyle, eschnou, friedcell, friedcell1 and tantek joined the channel
#
tantek Have any indieweb folks tried using https://www.authy.com/ to setup 2-factor auth on their own site? I'd really like to figure out a solution for indieweb 2-factor auth, which could then be used distributed authentication (not just via delegation).
#
tommorris !tell tantek it might be better to just use Google Authenticator aka. TOTP, as defined in RFC 6238. implementations for iOS, Android, Blackberry, Windows 7, J2ME (still in wide use in low-end phones and in developing world). see https://en.wikipedia.org/wiki/Google_Authenticator
#
Loqi Ok, I'll tell him that when I see him next
#
tommorris !tell tantek TOTP is IMHO more secure than SMS because it avoid (admittedly improbable) man-in-the-middle attacks at the level of the cellphone network. plus there are places with internet but very unreliable mobile service (my house, for instance)
#
Loqi Ok, I'll tell him that when I see him next
#
singpoly1a tommorris: I have no issue with TOTP, but HOTP is also useful if you want to restrict to just one key or whatever, and then you don't need a clock (so it can work on, say, yubikey) :)
#
tommorris ah, but for the use case of logging into your personal site, having it tied to a smartphone (or equivalent device: iOS, Android etc.) is quite sensible.
#
tommorris and TOTP works well for that.
#
tommorris although it was a bit weird: my Android phone lost my Dropbox auth credentials the other day. so I had to log into Dropbox with user/pw and then also give it a TOTP code from the Authenticator app.
#
singpoly1a Sure. I have an app on my phone that will do both HOTP and TOTP, and I do use both for different things :)
#
tommorris Thank god that smartphone operating systems have pre-emptive multitasking, like proper operating systems had in 1969.
#
singpoly1a heh
#
singpoly1a My smartphone runs a real OS, so it's even more on top of things ;)
#
singpoly1a "real OS" being somewhat tounge-in-cheek for "one that also runs on non-phones"
#
tommorris people wonder why I'm not that keen on mobile stuff. well, everyone coos over features that Windows 95 had, plus, well, while I can touch type on a computer and I'm reduced to the same drooling hunt-and-peck mentality when on a phone.
#
tommorris I have an Android phone. the primary use I have for it is plugging my laptop into it to get on the Internet.
#
singpoly1a Yeah, I would never get a phone without a good harware keyboard. I had one once because it was free, but it was pretty annoying
#
@BarnabyWalters #indieweb proposal: Favicons + `apple-touch` PNGs for easily discoverable profile pics. Goes against discovery… http://waterpigs.co.uk/notes/439
dascher, tilgovi and tantek joined the channel
#
Loqi tantek: tommorris left you a message 1 hour, 27 minutes ago: it might be better to just use Google Authenticator aka. TOTP, as defined in RFC 6238. implementations for iOS, Android, Blackberry, Windows 7, J2ME (still in wide use in low-end phones and in developing world). see https://en.wikipedia.org/wiki/Google_Authenticator
#
Loqi tantek: tommorris left you a message 1 hour, 22 minutes ago: TOTP is IMHO more secure than SMS because it avoid (admittedly improbable) man-in-the-middle attacks at the level of the cellphone network. plus there are places with internet but very unreliable mobile service (my house, for instance)
friedcell, brennannovak and tantek joined the channel