FH news New functionality

[Deebs]

Having spent most of the morning upgrading and fixing stuff I have removed and installed new versions of the FreddysHouse add-ons coded by SheepCow (thanks fella!).

Now you have 2 options for two-factor authentication, Yubikey and Google Authenticator. To add two-factor authentication to your account please click here. If you add multiple authenticators you only need to have one of them available to login with, eg, I have both Yubikey and Google Authenticator against my account, I don't need both devices to login, just one.

Of course your passwords are still stored using BCrypt

 

[TdC]

I just enabled that two-factor stuff. Nice one dude

 

[Deebs]

Thank SheepCow, I nagged, he delivered

 

[TdC]

Thanks SheepCow! I never deliver when Deebs nags at me

 

[MYstIC G]

Thank SheepCow, I nagged, he delivered

Nice one SheepCow

 

[SheepCow]

For anyone that doesn't know what two-factor authentication is, it's basically adding another thing to the login process. A password is simply something you have to remember, but if anyone else knows it they can login as you.

Google Authenticator and YubiKeys are two types of physical factors - you have to physically have them to use them - therefore they now need to know your password and have stolen your phone/tablet/YubiKey

By having more factors to the login process it gets harder to have them all. Wikipedia has more info:
http://en.wikipedia.org/wiki/Two-factor

 

[Calaen]

after scanning the barcode, FH won't accept the Code I receive!

 

[SheepCow]

Couple of things to check:

1. Are you entering the right code, i.e the one that's called "Calaen - The FreddysHouse Forums"
2. How long is the code, it should be 6 digits.
3. If you go to Settings -> About in the Google Authenticator app, what version do you have?
4. Is the time on your phone (is it a phone?) correct, in the Google Auth app go to settings -> Time correction -> sync now

If it's still not working, can you view the source of the page with the barcode and search for "otpauth" and post the full line (e.g.:
otpauth://totp/SheepCow%20-%20The%20FreddysHouse%20Forums?secret=OEV4A755E6NDTUCK&period=30) the code entered and the exact time you tried to add it (using that line and the time i can generate a code and see if it should have worked)
FYI: the "secret" is something to be kept secret but since adding the authenticator failed it's useless to anyone. It is randomly generated using OpenSSL's pseudo random byte generator every time you refresh the add a google auth page so you won't see the same secret again.

 

[Calaen]

It worked after the time sync thanks.

 

[SheepCow]

For anyone that doesn't know what two-factor authentication is or what Google Authenticator is, this page is also quite good:
http://www.google.com/landing/2step/index.html

It's Google's page that says why you should use it to protect your Google account.

 

[Wazzerphuk]

Does that stop the notice appearing everytime I login?

 

[SheepCow]

What notice? If you click the X it goes away forever for me - the notice is not part of the add-on, that's Deebs advertising it

 

[Deebs]

Does that stop the notice appearing everytime I login?

The two factor notice? Hover over it, you see an X and a "Dismiss" text click, click the dismiss and it is gone for good.