Comment by flyt
12 years ago
DuoSec's iOS app replaced the never-updated Google Authenticator app for me after they added support for third-party token generation. It even works with QR-code scanning, just like the Google App.
The advantage here is obvious: it's an app that is a primary business concern for a security-focused company. It's unlikely it'll go out of date as long as Duo is around.
https://blog.duosecurity.com/2012/11/announcing-two-factor-a...
Never mind that the Google Authenticator app does get updated, why would it be suspect that it wasn't? Since when did it become a mark of quality that something changes constantly?
It's sole purpose in life is to run a well-defined, never-changing calculation and display a 6 digit number on the screen. Not changing is absolutely preferred here.
It's not confidence-inspiring when an app you use is missing both retina graphics and iPhone 5 support.
I have only used it on iPhone 5 without any problem, so I am not sure what you mean here. I only use it for a few seconds to read the number and do not really understand how retina graphics would help you.
2 replies →
And if a security bug did pop up, I'd sure rather bet on Duo, Authy, etc. fixing their app quickly than Google doing so, given that I don't think anyone is actually on the Authenticator team. I'm sure someone within Google would consider it a high priority to fix, but it wouldn't be as easy for them to quickly address something.
2 replies →
The Duo app is really nice. I was really happy to find out you could use it without their (fairly expensive) service; it's essentially a drop-in replacement for the Google Authenticator app. I've still been using both, though.
The thing I dislike most is when sites don't allow you to link your own OATH credential (i.e. a hardware token); I don't consider any of the cellphone apps or services to be as secure as the hardware token, and there are nice ways to use the hardware tokens for role accounts (locking the physical token in a safe, or leaving it in the custody of a third party without direct access to the account, like a CFO). The ideal implementation of OATH/2FA for a site allows users to specify their own, get the QR code, or get a text code.
Coinbase, for instance, only shows the QR code; I can't either use my own hardware token or back up the character string (which I feel I can do safely) to let me re-generate the token. I generally like having >1 device with my OATH credentials for any given account, particularly if the device is needed to change security settings later. It's awesome that they support 2FA, but doing better would be better.
I use Duo as well. The only thing I miss is a countdown timer.