Stunna (OP)
Legendary
Offline
Activity: 3192
Merit: 1279
Primedice.com, Stake.com
|
![](https://bitcointalk.org/Themes/custom1/images/post/xx.gif) |
March 21, 2014, 07:04:40 PM Last edit: April 12, 2014, 10:06:08 PM by Stunna |
|
Bumping this again as I think this should be implemented before a year from now.
If someone wants to write a patch for it, I will seriously consider adding it. I believe that safely adding 2FA would be very time-consuming, so I'm not willing to do it myself or direct Slickage to do it. Not sure how time consuming this would be, I'm willing to put 1 BTC towards a bounty for it though. The only condition of the bounty would be that it is of high enough quality to be accepted/implemented by Theymos. If anyone would like to contribute towards this bounty or is interested in writing the patch please let me know. EDIT: I've doubled the bounty if anyone is interested, it is now 2BTC.
|
|
|
|
Don007
Legendary
Offline
Activity: 1050
Merit: 1007
Live like there is no tomorrow!
|
![](https://bitcointalk.org/Themes/custom1/images/post/xx.gif) |
March 27, 2014, 12:03:27 AM |
|
Here's a friendly bump again, as it's really a nice idea.
"Authy" might be usefull here. Cryptsy uses it too. By Authy, you get a code on your smartphone which gives you the right to log in. This coin is only valid for 20 seconds.
So, if someone wants to hack your account, they need your password as well as your phone physically.
|
{Curently quite inactive as I'm really busy in my private life. I will get back soon!} -> Your line here during my inactivity? Feel free to PM <-
|
|
|
Stunna (OP)
Legendary
Offline
Activity: 3192
Merit: 1279
Primedice.com, Stake.com
|
![](https://bitcointalk.org/Themes/custom1/images/post/xx.gif) |
March 29, 2014, 06:15:56 PM |
|
Here's a friendly bump again, as it's really a nice idea.
"Authy" might be usefull here. Cryptsy uses it too. By Authy, you get a code on your smartphone which gives you the right to log in. This coin is only valid for 20 seconds.
So, if someone wants to hack your account, they need your password as well as your phone physically.
Theymos wants some sort of custom implementation made exclusively for this forum version.
|
|
|
|
Stunna (OP)
Legendary
Offline
Activity: 3192
Merit: 1279
Primedice.com, Stake.com
|
![](https://bitcointalk.org/Themes/custom1/images/post/xx.gif) |
April 14, 2014, 03:23:10 AM |
|
Bounty was doubled the other day, if anyone would like to pledge towards the bounty please let me know.
|
|
|
|
NLNico
Legendary
Offline
Activity: 1876
Merit: 1295
DiceSites.com owner
|
Hey Stunna, just to let you know, I made a modification for 2FA support for this forums' version (SMF 1.1.19.) I just sent a PM to theymos with the details. I hope he can check it to see if it all works properly so it can be implemented soon ![Smiley](https://bitcointalk.org/Smileys/default/smiley.gif)
|
|
|
|
Skidog35
Newbie
Offline
Activity: 10
Merit: 0
|
![](https://bitcointalk.org/Themes/custom1/images/post/xx.gif) |
June 29, 2014, 02:52:36 PM |
|
Wow you have really put up much effort on making this. IMO established forums do offer this sometimes specially when they have money (or electronic items) in there.
|
|
|
|
Stunna (OP)
Legendary
Offline
Activity: 3192
Merit: 1279
Primedice.com, Stake.com
|
![](https://bitcointalk.org/Themes/custom1/images/post/xx.gif) |
June 29, 2014, 07:52:03 PM |
|
Hey Stunna, just to let you know, I made a modification for 2FA support for this forums' version (SMF 1.1.19.) I just sent a PM to theymos with the details. I hope he can check it to see if it all works properly so it can be implemented soon ![Smiley](https://bitcointalk.org/Smileys/default/smiley.gif) If he accepts/implements it I'll make good on my offer. Thanks for giving this a shot
|
|
|
|
Malin Keshar
|
![](https://bitcointalk.org/Themes/custom1/images/post/xx.gif) |
June 29, 2014, 09:16:03 PM |
|
What if the device where the 2FA is saved gets broken or lost? Happened to me some weeks ago with an exchange, needed to give personal info to them and was a pain to get it back, but this forum requires no personal info and is international, so...
|
|
|
|
bluefirecorp
Legendary
Offline
Activity: 882
Merit: 1000
|
![](https://bitcointalk.org/Themes/custom1/images/post/xx.gif) |
June 30, 2014, 01:44:51 AM |
|
What if the device where the 2FA is saved gets broken or lost? Happened to me some weeks ago with an exchange, needed to give personal info to them and was a pain to get it back, but this forum requires no personal info and is international, so...
Sign a message from a bitcoin address that was tied to your account in the past stating you own the account?
|
|
|
|
NLNico
Legendary
Offline
Activity: 1876
Merit: 1295
DiceSites.com owner
|
![](https://bitcointalk.org/Themes/custom1/images/post/xx.gif) |
June 30, 2014, 05:30:27 AM Last edit: June 30, 2014, 07:15:38 AM by NLNico Merited by vapourminer (2), minifrij (2) |
|
What if the device where the 2FA is saved gets broken or lost? Happened to me some weeks ago with an exchange, needed to give personal info to them and was a pain to get it back, but this forum requires no personal info and is international, so...
The way 2FA works is that your mobile phone and the forum have the same key. You are scanning the key with the QR code to import it into your mobile application (for example: Google Authenticator) Some more background info: For now I only implemented the "Time-based One-time Password Algorithm" (TOTP.) This algorithm uses the key and time to generate the digit code. This is why the device you use must have the correct time synchronized and also why Yubikey doesn't support it by default (Yubikey has no battery so no time.) There seems to be a application for Yubikey though btw: http://www.yubico.com/applications/internet-services/gmail/Anyway, what you should -always- do with 2FA is make a backup of the KEY or the QR code, so: - print the QR code or key (and secure it properly!) - write the key down (and secure it properly!) - save the QR/key on your computer but make sure to encrypt it very well (so.. secure it properly!) With this QR/key you can just import it in your new phone if your old one gets lost. (obv after that you should disable/enable the 2FA again to generate a new key.) At the 2FA setup page there will be a warning that says you can permanently lose access to your account if you don't make a backup. However in theory, like bluefirecorp said, you should be able to prove it by signing a message from a bitcoin address. But that depends on what policy theymos will use for that. Theymos already gave some feedback on my modification and I will take a day or 2 to make some changes. After this I will publish the code in this thread so hopefully some more people can have a look at it. I made it like a "real SMF package" so it is very easy to install/test. Hopefully after that we can use it soon ![Smiley](https://bitcointalk.org/Smileys/default/smiley.gif)
|
|
|
|
2dogs
Legendary
Offline
Activity: 1267
Merit: 1000
|
![](https://bitcointalk.org/Themes/custom1/images/post/xx.gif) |
July 03, 2014, 04:50:29 AM |
|
Anyway, what you should -always- do with 2FA is make a backup of the KEY or the QR code, so: - print the QR code or key (and secure it properly!) - write the key down (and secure it properly!) - save the QR/key on your computer but make sure to encrypt it very well (so.. secure it properly!)
With this QR/key you can just import it in your new phone if your old one gets lost. (obv after that you should disable/enable the 2FA again to generate a new key.)
I need to do this, but how? The QR code is not visible once I enable....are you saying to set up new? Have numerous accounts using 2FA, and I kid about having this android just for 2FA. I'll also be screwed if I lost this device.
|
|
|
|
NLNico
Legendary
Offline
Activity: 1876
Merit: 1295
DiceSites.com owner
|
Yes. You cannot see the key/QR after it's enabled for security reasons.
For example on an exchange or gambling site: if a hacker somehow hijacks your session, they will probably still need 2FA for any withdrawal (aka actually stealing your coins), so it would be a big problem if the key/QR is shown to them.
On most or all sites you should be able to easily disable 2FA with your current code. After you double-check it's really disabled, you can delete the specific account from your 2FA app. Then just enable it again with the new key/QR and make a (protected) backup of it.
|
|
|
|
2dogs
Legendary
Offline
Activity: 1267
Merit: 1000
|
![](https://bitcointalk.org/Themes/custom1/images/post/xx.gif) |
July 03, 2014, 05:45:24 AM |
|
Thanks for confirming that, NLNico. But how do you make a protected back up of the new QR code/key? Is that on Titanium Backup or ![Huh](https://bitcointalk.org/Smileys/default/huh.gif) Sorry for all the questions...
|
|
|
|
NLNico
Legendary
Offline
Activity: 1876
Merit: 1295
DiceSites.com owner
|
![](https://bitcointalk.org/Themes/custom1/images/post/xx.gif) |
July 03, 2014, 05:59:30 AM Last edit: July 03, 2014, 06:19:17 AM by NLNico Merited by vapourminer (2) |
|
You should make the backup of the QR/key on a computer or piece of paper, not on your Android phone because if you lose your phone it's still lost :p AFAIK, Titanium Backup makes a backup of your whole phone, that might be good, but not what I meant.
The key is a 16 character code, like "SYLC3WL6FV56YB6T". You could just write this on a piece of paper and make sure any thief (or even "friends") cannot easily get this. If your phone is lost, your 2FA will still work with this 16-character code (just add it on a new phone.)
The QR code is actually also your key with an easy link for your mobile to understand it. You could just right click on the QR code and "print it". Or you could save it on your computer. But obviously you shouldn't leave an image like that on your computer, because if your computer gets hacked, the hacker will probably have both your passwords and your 2FA codes. You would have to encrypt these specific images to make it password-protected (with a unique long password - not used anywhere else.) To be honest I am not an expert in that and I am not sure what program is best for that (especially since TrueCrypt is gone.)
Maybe someone else has a recommendation for the best way to encrypt a file on a computer? Is making a ZIP file with 7z with a long unique password with AES-256 "good enough"? Or better use a "real encryption" program?
|
|
|
|
2dogs
Legendary
Offline
Activity: 1267
Merit: 1000
|
![](https://bitcointalk.org/Themes/custom1/images/post/xx.gif) |
July 03, 2014, 08:36:55 AM Last edit: July 04, 2014, 04:56:33 AM by 2dogs |
|
Excellent advice - thanks for explaining this in such a way that is easy to understand.
|
|
|
|
Malin Keshar
|
![](https://bitcointalk.org/Themes/custom1/images/post/xx.gif) |
July 03, 2014, 03:44:09 PM |
|
any way to make a backup of a 2FA key if I close the key window and don't write the key?
|
|
|
|
Light
|
![](https://bitcointalk.org/Themes/custom1/images/post/xx.gif) |
July 04, 2014, 12:18:01 AM |
|
any way to make a backup of a 2FA key if I close the key window and don't write the key?
As stated there are really only two options if you want to backup your key but forgot to do it initially when the secret/QR code was offered. The first would be to disable your 2FA and then re-enable it noting down the new key associated with it. If for some reason you don't want do that and your using a phone based authenticator you might be able to extract the key from the phone data (easier on Andriod then on iOS). The first option is probably easier and more secure but if you want to do the second one there should be some guide - just google them out.
|
|
|
|
NLNico
Legendary
Offline
Activity: 1876
Merit: 1295
DiceSites.com owner
|
I changed some things in my "2FA modification for SMF 1.1.19" and it would be great if some people could test it here. Download: https://mega.co.nz/#!io5QxZrK!vhcQ1zdjauEYgeS_xpuOhWtLEmE_t3jcemakz4fKlKkInstall & Test (within 3 minutes)1. Download SMF 1.1.19 - http://download.simplemachines.org/?archive;version=752. Install SMF 3. Download "2FA Modification" - https://mega.co.nz/#!io5QxZrK!vhcQ1zdjauEYgeS_xpuOhWtLEmE_t3jcemakz4fKlKk4. Go to "Admin" > "Packages" > "Download Packages" > "Upload a Package" and select the .zip file 5. Click "Apply Mod" to install, then "Install now" 6. Change your 2FA settings at "Profile" > "2FA Settings" Test without installing SMFYou can also just look at the ~5 relevant files to see if there is anything wrong with it. Some details:- Supports 2FA using OATH TOTP (Google Auth) - Requires the 2FA code for enabling 2FA (with the key/QR that is shown) - After that requires 2FA code for logging in and disabling it - You cannot use the same 2FA code twice in a row for security reasons - "Forgot password" still possible without 2FA, but you do still need 2FA to login - Uses the default SMF method against multiple login tries (I will still look if this is sufficient) - Uses phpSec for the OATH TOTP class and random string generator (openssl_random_pseudo_bytes, mcrypt_create_iv or mt_rand as fallback if other 2 unavailable.) I use 3 files of phpSec and stripped them down to only use the basic functions. http://phpseclib.com/- Uses the following JS script to generate the QR code (only uses qrcode.min.js - doesn't need jQuery) https://github.com/davidshimjs/qrcodejsI hope some people can test it, would be great, thanks ![Smiley](https://bitcointalk.org/Smileys/default/smiley.gif)
|
|
|
|
Lesbian Cow
Legendary
Offline
Activity: 3038
Merit: 1754
|
![](https://bitcointalk.org/Themes/custom1/images/post/xx.gif) |
January 25, 2018, 07:50:23 PM |
|
Any news on 2FA implementation?
|
|
|
|
PowerGlove
|
![](https://bitcointalk.org/Themes/custom1/images/post/xx.gif) |
June 10, 2024, 04:01:02 AM |
|
I know this is a long shot, but... I did fulfill the requirements to be able to claim this still-open BTC-denominated bounty, so I'll leave an addy: 184Rg7mSkJ8WL1c5VjAMDi3QU7qXGJ29zy(I sent Stunna a PM about this bounty ~11 months ago and never heard anything back. I sent that PM because I thought it very likely that theymos would eventually merge my 2FA patch, and I wanted to give Stunna an opportunity to re-think this thread before that happened. Anyway, I'm not going to be an asshole about it and hound Stunna, but with 2 BTC on the table I'm also not going to play it so cool that I don't even try to claim it.) Here's the PM (for all you nosy motherfuckers excessively curious types): Hey Stunna,
I hope you don't mind me sending you a PM out of nowhere.
I just wanted to check if the bounty you set for adding 2FA to the forum is still active?
No hard feelings if it isn't, I decided to take a shot at getting theymos to accept a 2FA patch before I was aware of your bounty, but I'd (obviously) be very happy to hear that you haven't rescinded your offer.
Kind regards -- PowerGlove
|
|
|
|
|