Duo Security Blog

If you are looking for a clean reliable two-factor auth system, I highly recommend Duo: http://www.duosecurity.com/ I've been using them across a half dozen personal machines for quite a while now, looking to roll it out at work as well.

Google, Paypal, World of Warcraft, Mailchimp, etc. have all implemented user-facing two-factor auth also. It's the easiest way for them to protect against endpoint insecurity when attackers are going after user credentials en masse. For any other site looking to implement this, check out our open-source web SDKs and service at Duo Security: http://www.duosecurity.com https://github.com/duosecurity At the very least, we highly recommend folks use it to protect their own cloud/datacenter infrastructure, and have made it free to do so (assuming you have 10 or less admins): http://blog.duosecurity.com/2011/04/ssh-keys-that-call-you-back/ We support callback, SMS, mobile apps for 7 platforms, as well as traditional hardware tokens for online and offline use...

Why not read Nate Lawson's blog post? This will be the second time I've recommended it to you. One of the reasons I'm not going into too much depth is, why would I recap all of Nate Lawson? You're doing crypto dev, you should be reading him already. Your invocation of SJCL is also a bit of a straw-man. SJCL doesn't do straight-up number-theoretic crypto; even the AE cipher modes it offers avoids it. You're doing SRP in Javascript. You also keep calling it "Tom Wu's SJCL". You're saying that because "Tom Wu" is the name on SRP. Tom Wu didn't write SJCL. The SJCL authors, for what it's worth, claim "the best security which is practically available in Javascript", follow by a parenthesis, followed by the word "Unfortunately", followed by more words you should read. The two factor stuff, by the way? News to me as of this post. Twilio and 2-factor auth is a good idea (note though that I'm biased, as my friend Dug is doing something very similar --- http://www.duosecurity.com).

>Talent on both sides is in high demand, but there are few organizations that are able to get both working together effectively on these hard problems. Somehow Duo Security[1] has managed to do this phenomenally well. Their product is both a UX wonder and a security marvel. My first thought was "This doesn't feel like a security product. This feels like a solid UX design demo." But looking at their open source code, it's some of the more beautifully designed security software I've seen. I wonder what their secret is-- and if they'd be willing to share. [1] https://www.duosecurity.com/

Duo Security[0] is awesome. [0] https://www.duosecurity.com/

Most of our integrations allow for a configuration of "failmode" that allows for deciding how to handle unreachable/bad configuration scenarios. From our docs: "On service or configuration errors that prevent Duo authentication, fail "safe" (allow access) or "secure" (deny access). The default is "safe"." Check, https://www.duosecurity.com/docs/duounix, for an example of this in actual documentation. Great question!

Better yet, check out Duo Security: https://www.duosecurity.com/ It's free for individuals, and they even answer support emails ;) (Undisclaimer: I have no interest in the company, just a fan)

Really happy you guys decided to finally implement two-factor auth! I had suggested this after the compromise you guys had a while back: http://news.ycombinator.com/item?id=4067190 I wassss kind of rooting for DUO Security (http://www.duosecurity.com/) to be the vendor you chose, but I guess you can't win them all. Do you think maybe you could work on login accounting and some alerting next? :-)

Duo-unix from Duo security [1] works with scp as long as you install duo-push on your cell phone. [1] http://www.duosecurity.com/

I can't speak for Google Authenticator but Duo works great with RADIUS http://www.duosecurity.com/docs/radius

Very neat service. The Duo Security team also has a similar product with a lot of features: http://www.duosecurity.com/ They make the X-Ray Android vulnerability scanner (http://www.xray.io/)

And for all things not Google, check out http://www.duosecurity.com/. Completely painless to set up on my box at home.

Shameless plug for http://duosecurity.com We offer a two-factor cloud service to protect any kind of service that may be remotely accessed: web, ssh, rdp, vpn, ... Biggest difference from Google Authenticator is the smart phone user experience: one tap to approve a login instead of transcribing a six digit OTP.

http://www.duosecurity.com/ https://github.com/duosecurity/duo_unix

I'm not affiliated with Dashlane in any manner but I thought I'd chime in with my experience as a user. I used to use LastPass but lost a bit of confidence in them when they asked users to reset their master password [1] when an anomaly was found present in network traffic from one of their DBs. Prior to this I was looking at open source alternatives but the syncing and add-ons for each browser (which made logging in and generating passwords easier offered by Dashlane) really caught my attention. These features aren't unique to Dashlane, I'm sure. New sign-ups reap the benefits of premium features for a month or so, then you could send an invite to a friend and accrue 6 free months of premium service when they sign up (which is what I did) for free. They also offer a public password generator [2] page. They support the major browsers (Safari, Chrome, Firefox). Dashlane also has a "security dashboard" which keeps track of password expiration, reuse, and weak password usage, with a base analysis score that gets presented to you when action on a site is required. If you want something for offline use and that is hardware based, I'd recommend checking out the Mooltipass [3]. I hope this helps. [1] - https://www.duosecurity.com/blog/breaking-down-the-probable-lastpass-b… [2] - https://www.dashlane.com/password-generator [3] - http://www.themooltipass.com/

Here's a few more to add to your list (not all SaaS)... --ANALYTICS Snowplow (https://github.com/snowplow/snowplow) Segment.io (http://segment.io) --CRM Close.io (http://close.io), Streak (http://www.streak.com/) Base (http://getbase.com) --SALES ElasticSales (https://elasticsales.com/) --CUSTOMER SERVICE Metaverse Mod Squad (http://metaversemodsquad.com/) --DATA Factual (http://www.factual.com/) --DATABASE Titan (http://thinkaurelius.com/) Tinkerpop (http://www.tinkerpop.com/) Bulbs (http://bulbflow.com) Datomic (http://datomic.com) --LOG MONITORING Logstash (http://logstash.net) Lumberjack (https://github.com/jordansissel/lumberjack) Fluentd (http://fluentd.org), Flume (https://github.com/cloudera/flume) Kafka (http://sna-projects.com/kafka/) Scribe (https://github.com/facebook/scribe/) --ACCOUNTING/INVOICING Harvest (http://www.getharvest.com/) Ballpark (http://www.getballpark.com/) PaySimple (http://paysimple.com/) AcceptPay (http://acceptpay.com) FreshBooks (http://www.freshbooks.com/) FreeAgent (http://www.freeagent.com/) Blinksale (http://www.blinksale.com/) --PAYMENTS Balanced Payements (https://www.balancedpayments.com/) Dwolla (https://www.dwolla.com/) -- BANKING Simple (http://simple.com) --PHONE/PBX/SMS Plivo (http://plivo.com/) Tropo (https://www.tropo.com/) Twillo (http://www.twilio.com/) PhoneBooth (http://www.phonebooth.com/) -- PROJECT MANAGEMENT Orchestra (http://www.orchestra.com/) -- RECOMMENDATION…

Have you heard of Duo Security? http://www.duosecurity.com/

It gets better: they also shipped the private key material for signing arbitrary windows kernel drivers with a Verisign-issued certificate: https://www.duosecurity.com/blog/dude-you-got-dell-d-publishing-your-p…

One thing to consider is the possibility of your phone itself being compromised (stagefright et al.). Note how Duo issued a security advisory to limit access for Android devices [1]. A fully isolated component like a Yubikey has a smaller attack surface area for these kinds of things (easier to audit smaller code, no sustained Internet or cellular connectivity). [1]https://www.duosecurity.com/blog/understanding-your-exposure-to-stagef…

We've been using Duo Security for two factor ssh auth[0] for a number of years. Its quite easy to setup and gives you push notifications to your phone. Its awesome. [0]: https://www.duosecurity.com/docs/duounix

Similarly, I've been impressed by Duo's mobile applications.[1] They offer a push authentication capability, so you only have to click "accept" or "deny" in the app on your phone. They've also got code generation and a hardware token as backups. In practice, I can usually authenticate through the phone in 2ish seconds. Clef does look like an awfully nice user experience, though. [1] https://www.duosecurity.com/product/methods/duo-mobile

There are solutions in place to combine SSH keys with 2FA. E.g. Duo Security has a solution for that: https://www.duosecurity.com/blog/ssh-keys-that-call-you-back [Edit: Removed redundant comments.]

https://www.duosecurity.com/authentication-methods What? This exists...

Duo's "Verify API" does just that: https://www.duosecurity.com/docs/duoverify

Doesn't Duo Security do this really well already? https://www.duosecurity.com/docs/duoweb Once I can load the webpage will be interested to see if there are any differentiating features that make it easier to get started as a developer.

Duo Security has a tested module for OS X: https://www.duosecurity.com/docs/duounix This doesn't help at all for Apple ID, though.

You may also want to check out Yubikey - http://www.yubico.com/yubikey - Check out the Github repo for the PAM https://github.com/Yubico/yubico-pam#readme -- Stop by and see me (Nick @ MNX Solutions) at Indiana Linux Fest http://www.indianalinux.org/ we have a few Yubikeys we are giving away. Duo Security - http://www.duosecurity.com - These guys are doing some neat things in this area: https://github.com/duosecurity/duo_unix

Yes, as you told, I was writing from my memory and I remembered having read DES encryption with password in source somewhere. But It seems it was a DES based hashing: http://www.duosecurity.com/blog/entry/brief_analysis_of_the_gawker_pas… [edit] deleted the parent post because I could not find the article I remembered (which was probably wrong anyways).

Lots of options. * You can buy a hardware token. https://www.duosecurity.com/product/methods/hardware-tokens * You can have Duo call/text you every time you want to log in. * You can use some other device you have that runs a mobile OS. I had Duo set up on my wifi-only iPad while I was using a feature phone for a few months a year ago. (I eventually gave up on that and got a smartphone, though.) * You can buy a used/cheap smartphone, iPod Touch, or similar, install either the Google Authenticator or Duo app, and not use mobile service at all. You just need a bit of wifi to enroll. * You can write an OATH client as a J2ME MIDlet. When I was using a feature phone, I spent some time figuring out how to compile J2ME apps in 2015, by piecing together ten-year-old tutorials. It works fine; if you want me to dig up details let me know. (Alternatively, someone may have written one already, but I didn't search very hard.) * You can, technically, run an OATH client on your computer. But at that point, you take responsibility for your two-factor auth being slightly less than two-factor.

Senior Windows Software Engineer | Duo Security | Ann Arbor, Michigan (Relocation strongly preferred) (https://www.duosecurity.com/company/jobs) Duo Security's hosted two-factor authentication service brings strong, scalable security to organizations of any size. Duo's unique, high-availability architecture provides centralized management, self-service enrollment, and interactive secondary login through an intuitive web interface, eliminating the high costs, complexity, and confusion associated with traditional two-factor systems. Every day, over 1,000 organizations in 80+ countries around the world rely on Duo for their security. Duo Security is based in Ann Arbor, Michigan, and is a privately held company whose investors include Google Ventures, True Ventures, Resonant Venture Partners, and Radar Partners. Read more about Duo's investors. About Duo / Co-Founder Bios: https://www.duosecurity.com/company/about ----------------------------------- Our ideal candidate is an experienced Windows developer. Experience with security products a big plus, as is experience working on B2B and SaaS products. Job duties: * Integrate Duo with all things Windows including Active Directory, ADFS, Exchange Server, IIS, and Remote Desktop Services. * Help us build and deliver cloud-based 2FA services for two-factor authentication as part of a high performance development team. * Handle field escalations, related to Windows integrations, when fronttline support escalates support…