[tor-talk] Tor-Friendly Two-Factor Authentication?

2016-06-14 Thread tor_talk
Hi Tor Talkers and Scott Arciszewski, perhaps this thought is easier and Tor friendly. right now all computers are better in maths than the average human being. but every human being is better in in-depth knowledge of reading texts than (average) computers. you even can trick AIs with texts, la

[tor-talk] Tor-Friendly Two-Factor Authentication?

2016-06-13 Thread tor_talk
Hi Tor Talkers and Scott Arciszewski, there are some thoughts out there about 2FA and MFA - maybe there is something Tor related thing and interesting for you, too, Scott: www.securityweek.com/multi-factor-authe%ntication-waking-elephant-room But, in light of new research and rising mandates, it

Re: [tor-talk] Tor-Friendly Two-Factor Authentication?

2016-06-13 Thread The Doctor
-BEGIN PGP SIGNED MESSAGE- Hash: SHA512 On Fri, 10 Jun 2016 21:58:16 -0400 Scott Arciszewski wrote: > * Google Authenticator requires a Google Account, which now-a-days > requires surrendering your phone number to Google I don't believe that is the case: https://github.com/gbraad/gauth

[tor-talk] Tor-Friendly Two-Factor Authentication?

2016-06-12 Thread tor_talk
Hi Tor Talkers and Mr. Nobody, you wrote: As far as I know, to implement 2 factor authentication in terms of the codes that many websites have, the only thing you need is to generate random numbers coming from seed that the webpage/bank you want to authenticate to know. This simple setup by no me

Re: [tor-talk] Tor-Friendly Two-Factor Authentication?

2016-06-12 Thread Mr Nobody
As far as I know, to implement 2 factor authentication in terms of the codes that many websites have, the only thing you need is to generate random numbers coming from seed that the webpage/bank you want to authenticate to know. This simple setup by no means need to be privacy invading. tor_t...@a

Re: [tor-talk] Tor-Friendly Two-Factor Authentication?

2016-06-11 Thread Scott Arciszewski
On Sat, Jun 11, 2016 at 3:18 AM, Flipchan wrote: > Let me awnser this for u:) use pgp , if c alot of ppl that use Googles > stuff but all gets send back to Google so i wouldnt want them to get my > data, github.com/flipchan/blogger i created 2factor so if the usr got a > pgp fingerprint it will b

[tor-talk] Tor-Friendly Two-Factor Authentication?

2016-06-11 Thread tor_talk
Hi Tor Talkers and Scott Arciszewski, you wrote: I was curious if anyone in/around Tor was aware of any privacy-preserving 2FA initiatives. maybe banks are https://en.wikipedia.org/wiki/Mtan#Mobile_TAN_.28mTAN.29 when you have to log in to your phone/handy with e. g. a "living" fingerprint it

Re: [tor-talk] Tor-Friendly Two-Factor Authentication?

2016-06-11 Thread Flipchan
Let me awnser this for u:) use pgp , if c alot of ppl that use Googles stuff but all gets send back to Google so i wouldnt want them to get my data, github.com/flipchan/blogger i created 2factor so if the usr got a pgp fingerprint it will be redirected to 2factor.html after login ,then u generat

Re: [tor-talk] Tor-Friendly Two-Factor Authentication?

2016-06-10 Thread Scott Arciszewski
On Fri, Jun 10, 2016 at 10:13 PM, Allen wrote: > On Fri, Jun 10, 2016 at 9:58 PM, Scott Arciszewski > wrote: > > > * FIDO U2F requires users to purchase separate hardware devices which, > > while cheap, aren't already in the arsenal of most netizens > > > > How about developing a simple 2FA app

Re: [tor-talk] Tor-Friendly Two-Factor Authentication?

2016-06-10 Thread Allen
On Fri, Jun 10, 2016 at 9:58 PM, Scott Arciszewski wrote: > * FIDO U2F requires users to purchase separate hardware devices which, > while cheap, aren't already in the arsenal of most netizens > How about developing a simple 2FA app for a smartphone? Maybe a smartphone could emulate a FIDO U2F?

[tor-talk] Tor-Friendly Two-Factor Authentication?

2016-06-10 Thread Scott Arciszewski
-BEGIN PGP SIGNED MESSAGE- Hash: SHA256 Hi, I'm developing a CMS platform called Airship and I'd like to make it as Tor-friendly as possible. Someone from the community suggested Two-Factor Authentication, but as far as I'm aware there aren't many good options: * SMS-based authenticatio