We use Kerberos/LDAP at work so are able to use CoSign to provide web SSO. I did a quick write-up about a service that I wrote which allows me to use Google Authenticator as an additional factor with CoSign: http://it.isevil.org/blog/2011/11/13/authentication-service-...
Since it's just a Sinatra app, the web service could be used by other things. We also use it with FreeRADIUS so our users can use their second factor on the web and in their VPN client.
The solution to security is to come up with better and innovative security solutions.
Imagine that you had a "log in with iPhone" button, like the common "log in with Facebook" buttons. It would send down a push notification to your iPhone that shows a dialog "Log in to hn.com? Yes | No." Pressing Yes uses fingerprint-sensing capability under the touchscreen to send anonymized[^1] biometric information to provider to authorize the login with.
You'd also get a smartphone app to generate temporary login keys for when you need to give a friend access to your account, and get a 32-byte "master" key that can be used to unlock the account without biometric access.
[^1]: simply a HMAC / hash value using both the biometric data + the domain being authorized would deal with privacy concerns.
The "Log-in with your iPhone?" could be coupled with some kind of non-biometric authentication and that would be better. But honestly, two-factor with strong passwords are more than enough. The dismal security scenario is mostly cultural, not technological.
Unfortunately the SDK is only available for PHP & mysql.
Seriously - how is that any different than turning on your iPhone and clicking on the Google authenticator app to get your code?
- you can still social engineer your way out (!) - "oh i lost my phone and the recovery keys" "heres my name address cc number, etc please help!" (ie nothing has been solved)
- its quite annoying to use
- it doesnt solve everything, only weak passwords/brute force
- it locks you out if you lose your phone/token until you get back home to get your recovery keys
- compromising the phone (2nd factor for the general public) allow compromising both passwords and the authenticator
and the issue of passwords managers:
- they're stored everywhere because you need them (incl. your phone)
- you have a single password to decrypt them all
- compromising the phone, once again, give you all passwords, and the authenticator
My password doesn't get used for anything, all my applications have a 1 app only password.
An attacker would still need my password...
Personally I have a pin on my iPhone - and I have my iPhone set to 'reset' itself if there are 10 incorrect pin attempts - so even if I lose my phone, I doubt they would get in...
Unless I've misunderstood how 2-factor authentication works, this is misinformation. The entire point of 2-factor authentication is that you need _both_ factors; i.e., having only one does not compromise the system.
so, no, you just need to think about it a little while longer.
Until your two-factor system gets hacked, as happened to RSA: http://bits.blogs.nytimes.com/2011/04/02/the-rsa-hack-how-th...
The more common a security system is, the more attractive a target it is for professional (organized crime) hackers to attack.
Google Authenticator is a great service imho, but I find myself moreso pleased with the 'application specific' password feature which allows me to abstract my exposure even further.
If someone built a system which could restrict passwords or keys by some kind of capabilities (e.g. my Adium gtalk password could only be used to authenticate to Google's Jabber servers), that would be useful. It would be complex to manage, especially as your applications change over time, but not impossible.
Joking aside, once you start down the road to two-factor authentication, you might as well go to three factors if you are truly concerned about security. Moreover, at least one of those factors would need to be based on physical properties, i.e., biometrics, or some other intrinsically unique property that can't be forgotten or copied.
