{"id":72,"date":"2014-11-13T09:52:31","date_gmt":"2014-11-13T09:52:31","guid":{"rendered":"http:\/\/yiannis.co.uk\/techtalk\/?p=72"},"modified":"2014-11-13T09:52:31","modified_gmt":"2014-11-13T09:52:31","slug":"clef-v-google-authenticator-v-authy","status":"publish","type":"post","link":"https:\/\/yiannis.uk\/techtalk\/clef-v-google-authenticator-v-authy\/","title":{"rendered":"Clef v Google Authenticator v Authy"},"content":{"rendered":"<p>If any of you have a Google\/GMail account I am sure you have seen the prompts to setup 2 factor authentication (2FA). The way 2FA works is that not only do you enter a password, but a pin is sent to you via SMS and you have to enter that, too in order to login. When I first saw it I was tempted but then I thought (like any sensible person would) that if my mobile phone runs out of battery or if I am out of network coverage, I won&#8217;t be able to access my emails. So I left it at that.<\/p>\n<h3>Clef<\/h3>\n<p>Then a few days ago whilst I was attending the WordCamp San Francisco (remotely, via streaming) during one of the presentations somebody mentioned <a href=\"https:\/\/getclef.com\/\" target=\"_blank\">Clef<\/a>.\u00a0<a href=\"https:\/\/getclef.com\/\" target=\"_blank\">Clef<\/a> is a combination of a mobile phone app and software that lets you login to websites without even entering a password. So, when you want to login you see some vertical lines moving up and down on your screen, you open the <a href=\"https:\/\/getclef.com\/apps\" target=\"_blank\">Clef app<\/a> on your mobile phone and you point the camera to the screen. The app reads the lines and sends a coded message to the Clef server. The Clef server confirms with the site that the coded message is correct and the server sends a message back to the app where you choose for how long you want to be left logged-in into the website; you can even choose infinite time. And that&#8217;s it! You are logged in and ready to work. There is a Chrome extension, called <a href=\"http:\/\/getwaltz.com\/\" target=\"_blank\">Waltz<\/a>, that allows you to use Clef even on the websites that don&#8217;t have the Clef technology installed. I am quite happy with it, the only complain is that you cannot be logged in one computer and login to another, too. You will have to log out from the first one to login to the second. A nice feature is that you can logout remotely through\u00a0the mobile app.<\/p>\n<h4>Pros:<\/h4>\n<ul>\n<li>Super quick &amp; easy to login.<\/li>\n<li>No need to remember passwords.<\/li>\n<li>Can use\u00a0password if mobile phone is not available.<\/li>\n<li>For apps\/integrations, up to 1000 logins per month are <a href=\"https:\/\/getclef.com\/pricing\" target=\"_blank\">free<\/a>.<\/li>\n<li>Chrome extension (<a href=\"http:\/\/getwaltz.com\/\" target=\"_blank\">Waltz<\/a>) that allows you\u00a0to login to <strong>any<\/strong> website.<\/li>\n<li><a href=\"http:\/\/docs.getclef.com\/v1.0\/docs\/plugins\" target=\"_blank\">Plugins\/integrations<\/a> for the majority of\u00a0CMSs and frameworks.<\/li>\n<li>Remote logout through the mobile app.<\/li>\n<\/ul>\n<h4>Cons:<\/h4>\n<ul>\n<li>You don&#8217;t know where and how the passwords get saved.<\/li>\n<li>You need your mobile phone to login.<\/li>\n<li>You need to <a href=\"https:\/\/getclef.com\/pricing\" target=\"_blank\">pay<\/a> if you have more than 1000 logins per month.<\/li>\n<li>Cannot use it on multiple PCs simultaneously.<\/li>\n<\/ul>\n<div data-mode=\"normal\" data-oembed=\"1\" data-provider=\"vimeo\" id=\"arve-vimeo-103148853\" style=\"max-width:590px;\" class=\"arve\">\n<div class=\"arve-inner\">\n<div style=\"aspect-ratio:295\/166\" class=\"arve-embed arve-embed--has-aspect-ratio\">\n<div class=\"arve-ar\" style=\"padding-top:56.271186%\"><\/div>\n<p>\t\t\t<iframe allow=\"accelerometer &apos;none&apos;;autoplay &apos;none&apos;;bluetooth &apos;none&apos;;browsing-topics &apos;none&apos;;camera &apos;none&apos;;clipboard-read &apos;none&apos;;clipboard-write;display-capture &apos;none&apos;;encrypted-media &apos;none&apos;;gamepad &apos;none&apos;;geolocation &apos;none&apos;;gyroscope &apos;none&apos;;hid &apos;none&apos;;identity-credentials-get &apos;none&apos;;idle-detection &apos;none&apos;;keyboard-map &apos;none&apos;;local-fonts;magnetometer &apos;none&apos;;microphone &apos;none&apos;;midi &apos;none&apos;;otp-credentials &apos;none&apos;;payment &apos;none&apos;;picture-in-picture;publickey-credentials-create &apos;none&apos;;publickey-credentials-get &apos;none&apos;;screen-wake-lock &apos;none&apos;;serial &apos;none&apos;;summarizer &apos;none&apos;;sync-xhr;usb &apos;none&apos;;web-share;window-management &apos;none&apos;;xr-spatial-tracking &apos;none&apos;;\" allowfullscreen=\"\" class=\"arve-iframe fitvidsignore\" credentialless data-arve=\"arve-vimeo-103148853\" data-lenis-prevent=\"\" data-src-no-ap=\"https:\/\/player.vimeo.com\/video\/103148853?dnt=1&amp;app_id=122963&amp;transparent=0&amp;title=1&amp;byline=0&amp;portrait=0&amp;autoplay=0\" frameborder=\"0\" height=\"332\" loading=\"lazy\" name=\"\" referrerpolicy=\"strict-origin-when-cross-origin\" sandbox=\"allow-scripts allow-same-origin allow-presentation allow-popups allow-popups-to-escape-sandbox allow-forms\" scrolling=\"no\" src=\"https:\/\/player.vimeo.com\/video\/103148853?dnt=1&#038;app_id=122963&#038;transparent=0&#038;title=1&#038;byline=0&#038;portrait=0&#038;autoplay=0\" title=\"\" width=\"590\"><\/iframe><\/p><\/div>\n<\/p><\/div>\n<p>\t<script type=\"application\/ld+json\">{\"@context\":\"http:\\\/\\\/schema.org\\\/\",\"@id\":\"https:\\\/\\\/yiannis.uk\\\/techtalk\\\/clef-v-google-authenticator-v-authy\\\/#arve-vimeo-103148853\",\"type\":\"VideoObject\",\"embedURL\":\"https:\\\/\\\/player.vimeo.com\\\/video\\\/103148853?dnt=1&app_id=122963&transparent=0&title=1&byline=0&portrait=0&autoplay=0\"}<\/script><\/p>\n<\/div>\n<h3>Google Authenticator<\/h3>\n<p>So after using Clef for a couple of weeks, I decided to give Google another go. I setup <a href=\"https:\/\/www.google.com\/landing\/2step\/\" target=\"_blank\">2FA<\/a> to see how it works. You enable it and then you choose if you want the codes sent to you via SMS or you can download a mobile app that generates auth codes; much like the RSA SecurID tokens. You can also have a <a href=\"http:\/\/www.amazon.co.uk\/s\/?field-keywords=%22FIDO%20U2F%20Security%20Key%22\" target=\"_blank\">USB FIDO U2F security key<\/a>. You plug the U2F in a USB port of any computer and once you have entered the username and password it instructs you to use the key. You touch the key and it logs you in. Now, if you loose your key you can you can use\u00a0a<a href=\"https:\/\/support.google.com\/accounts\/answer\/1187538\" target=\"_blank\"> one-time-only code<\/a> that you have kept on a piece of paper or in USB flash drive. You can even have a <a href=\"https:\/\/support.google.com\/accounts\/answer\/1188780?hl=en\" target=\"_blank\">backup phone<\/a>. Finally, the <a href=\"https:\/\/support.google.com\/accounts\/answer\/1066447?hl=en\" target=\"_blank\">Google Authenticator app<\/a> works on multiple PCs, unlike Clef.<\/p>\n<h4>Pros:<\/h4>\n<ul>\n<li>It can be used on Google services and other sites that allow you to login with your Google account.<\/li>\n<li>It can be used on multiple PCs.<\/li>\n<li>You can use a\u00a0<a href=\"http:\/\/www.amazon.co.uk\/s\/?field-keywords=%22FIDO%20U2F%20Security%20Key%22\" target=\"_blank\">USB FIDO U2F security key<\/a>\u00a0for ease and speed.<\/li>\n<li>You have <a href=\"https:\/\/support.google.com\/accounts\/answer\/1187538\" target=\"_blank\">one-time-only backup codes<\/a>.<\/li>\n<li>Plenty backup options for worst-case scenarios.<\/li>\n<li>Many implementations\/plugins available for CMSs\/frameworks for free.<\/li>\n<\/ul>\n<h4>Cons:<\/h4>\n<ul>\n<li>You still need to remember passwords.<\/li>\n<li>It makes the login process longer.<\/li>\n<li>Google Authenticator mobile app does not have a pin\/password.<\/li>\n<\/ul>\n<div data-mode=\"normal\" data-oembed=\"1\" data-provider=\"youtube\" id=\"arve-youtube-zmabeyrtprg\" style=\"max-width:590px;\" class=\"arve\">\n<div class=\"arve-inner\">\n<div style=\"aspect-ratio:295\/166\" class=\"arve-embed arve-embed--has-aspect-ratio\">\n<div class=\"arve-ar\" style=\"padding-top:56.271186%\"><\/div>\n<p>\t\t\t<iframe allow=\"accelerometer &apos;none&apos;;autoplay &apos;none&apos;;bluetooth &apos;none&apos;;browsing-topics &apos;none&apos;;camera &apos;none&apos;;clipboard-read &apos;none&apos;;clipboard-write;display-capture &apos;none&apos;;encrypted-media &apos;none&apos;;gamepad &apos;none&apos;;geolocation &apos;none&apos;;gyroscope &apos;none&apos;;hid &apos;none&apos;;identity-credentials-get &apos;none&apos;;idle-detection &apos;none&apos;;keyboard-map &apos;none&apos;;local-fonts;magnetometer &apos;none&apos;;microphone &apos;none&apos;;midi &apos;none&apos;;otp-credentials &apos;none&apos;;payment &apos;none&apos;;picture-in-picture;publickey-credentials-create &apos;none&apos;;publickey-credentials-get &apos;none&apos;;screen-wake-lock &apos;none&apos;;serial &apos;none&apos;;summarizer &apos;none&apos;;sync-xhr;usb &apos;none&apos;;web-share;window-management &apos;none&apos;;xr-spatial-tracking &apos;none&apos;;\" allowfullscreen=\"\" class=\"arve-iframe fitvidsignore\" credentialless data-arve=\"arve-youtube-zmabeyrtprg\" data-lenis-prevent=\"\" data-src-no-ap=\"https:\/\/www.youtube-nocookie.com\/embed\/zMabEyrtPRg?feature=oembed&amp;iv_load_policy=3&amp;modestbranding=1&amp;rel=0&amp;autohide=1&amp;playsinline=0&amp;autoplay=0\" frameborder=\"0\" height=\"332\" loading=\"lazy\" name=\"\" referrerpolicy=\"strict-origin-when-cross-origin\" sandbox=\"allow-scripts allow-same-origin allow-presentation allow-popups allow-popups-to-escape-sandbox\" scrolling=\"no\" src=\"https:\/\/www.youtube-nocookie.com\/embed\/zMabEyrtPRg?feature=oembed&#038;iv_load_policy=3&#038;modestbranding=1&#038;rel=0&#038;autohide=1&#038;playsinline=0&#038;autoplay=0\" title=\"\" width=\"590\"><\/iframe><\/p><\/div>\n<\/p><\/div>\n<p>\t<script type=\"application\/ld+json\">{\"@context\":\"http:\\\/\\\/schema.org\\\/\",\"@id\":\"https:\\\/\\\/yiannis.uk\\\/techtalk\\\/clef-v-google-authenticator-v-authy\\\/#arve-youtube-zmabeyrtprg\",\"type\":\"VideoObject\",\"embedURL\":\"https:\\\/\\\/www.youtube-nocookie.com\\\/embed\\\/zMabEyrtPRg?feature=oembed&iv_load_policy=3&modestbranding=1&rel=0&autohide=1&playsinline=0&autoplay=0\"}<\/script><\/p>\n<\/div>\n<h3>Authy<\/h3>\n<p>Looking into the whole 2FA thing I came across <a href=\"https:\/\/www.authy.com\/\" target=\"_blank\">Authy<\/a>. Authy is very similar to Google Authenticator and it gives you the options to create your own integration with your WordPress, Joumla, Drupal installation, etc. The only problem is that then you need to <a href=\"https:\/\/www.authy.com\/pricing\" target=\"_blank\">pay<\/a> in order to create your own integration\/app. For Gmail, other Google services and sites that you can login with your Google account it&#8217;s free.<\/p>\n<h4>Pros:<\/h4>\n<ul>\n<li><a href=\"https:\/\/www.authy.com\/users\" target=\"_blank\">Mobile app<\/a> has pin protection.<\/li>\n<li>It can be used with Google Authentication.<\/li>\n<li>Many <a href=\"https:\/\/www.authy.com\/developers\" target=\"_blank\">implementations\/plugins<\/a> available for CMSs\/frameworks.<\/li>\n<li>You can create your own integrations.<\/li>\n<li>You can use <a href=\"https:\/\/www.authy.com\/users\" target=\"_blank\">Authy\u00a0mobile app<\/a> for Google Authenticator.<\/li>\n<li>You can save codes\/passwords on Authy&#8217;s cloud.<\/li>\n<\/ul>\n<h4>Cons:<\/h4>\n<ul>\n<li>You still need to remember passwords.<\/li>\n<li>Login process is long.<\/li>\n<li>You have to <a href=\"https:\/\/www.authy.com\/pricing\" target=\"_blank\">pay<\/a> for server-side plugins\/integrations.<\/li>\n<li>You don&#8217;t know how secure are the codes\/passwords saved on Authy&#8217;s cloud.<\/li>\n<\/ul>\n<div data-mode=\"normal\" data-oembed=\"1\" data-provider=\"vimeo\" id=\"arve-vimeo-71272779\" style=\"max-width:590px;\" class=\"arve\">\n<div class=\"arve-inner\">\n<div style=\"aspect-ratio:295\/166\" class=\"arve-embed arve-embed--has-aspect-ratio\">\n<div class=\"arve-ar\" style=\"padding-top:56.271186%\"><\/div>\n<p>\t\t\t<iframe allow=\"accelerometer &apos;none&apos;;autoplay &apos;none&apos;;bluetooth &apos;none&apos;;browsing-topics &apos;none&apos;;camera &apos;none&apos;;clipboard-read &apos;none&apos;;clipboard-write;display-capture &apos;none&apos;;encrypted-media &apos;none&apos;;gamepad &apos;none&apos;;geolocation &apos;none&apos;;gyroscope &apos;none&apos;;hid &apos;none&apos;;identity-credentials-get &apos;none&apos;;idle-detection &apos;none&apos;;keyboard-map &apos;none&apos;;local-fonts;magnetometer &apos;none&apos;;microphone &apos;none&apos;;midi &apos;none&apos;;otp-credentials &apos;none&apos;;payment &apos;none&apos;;picture-in-picture;publickey-credentials-create &apos;none&apos;;publickey-credentials-get &apos;none&apos;;screen-wake-lock &apos;none&apos;;serial &apos;none&apos;;summarizer &apos;none&apos;;sync-xhr;usb &apos;none&apos;;web-share;window-management &apos;none&apos;;xr-spatial-tracking &apos;none&apos;;\" allowfullscreen=\"\" class=\"arve-iframe fitvidsignore\" credentialless data-arve=\"arve-vimeo-71272779\" data-lenis-prevent=\"\" data-src-no-ap=\"https:\/\/player.vimeo.com\/video\/71272779?dnt=1&amp;app_id=122963&amp;transparent=0&amp;title=1&amp;byline=0&amp;portrait=0&amp;autoplay=0\" frameborder=\"0\" height=\"332\" loading=\"lazy\" name=\"\" referrerpolicy=\"strict-origin-when-cross-origin\" sandbox=\"allow-scripts allow-same-origin allow-presentation allow-popups allow-popups-to-escape-sandbox allow-forms\" scrolling=\"no\" src=\"https:\/\/player.vimeo.com\/video\/71272779?dnt=1&#038;app_id=122963&#038;transparent=0&#038;title=1&#038;byline=0&#038;portrait=0&#038;autoplay=0\" title=\"\" width=\"590\"><\/iframe><\/p><\/div>\n<\/p><\/div>\n<p>\t<script type=\"application\/ld+json\">{\"@context\":\"http:\\\/\\\/schema.org\\\/\",\"@id\":\"https:\\\/\\\/yiannis.uk\\\/techtalk\\\/clef-v-google-authenticator-v-authy\\\/#arve-vimeo-71272779\",\"type\":\"VideoObject\",\"embedURL\":\"https:\\\/\\\/player.vimeo.com\\\/video\\\/71272779?dnt=1&app_id=122963&transparent=0&title=1&byline=0&portrait=0&autoplay=0\"}<\/script><\/p>\n<\/div>\n<h3 style=\"text-align: left\">Verdict<\/h3>\n<p>I really like the ease and simplicity of <a href=\"https:\/\/getclef.com\/\" target=\"_blank\">Clef<\/a>. On the other hand, Google&#8217;s Authenticator is widely used and I have a few Google accounts (GMail, Google Apps, etc.). The Google Authenticator app does not have a pin\/password but neither the RSA SecurID tokens do. Authy costs if you want to implement it on your website\/blog.<\/p>\n<p>I already use <a href=\"https:\/\/getclef.com\/\" target=\"_blank\">Clef<\/a>\u00a0and it suits me. I like the many backup solutions of <a href=\"https:\/\/www.google.com\/landing\/2step\/\" target=\"_blank\">Google Authenticator<\/a> (U2F security key, one-use-codes, mobile app, SMS, voice-call, backup\u00a0telephone number). So a combination of <a href=\"https:\/\/getclef.com\/\" target=\"_blank\">Clef<\/a>\u00a0and <a href=\"https:\/\/www.google.com\/landing\/2step\/\" target=\"_blank\">Google Authenitcator<\/a>\u00a0with the <a href=\"https:\/\/www.authy.com\/users\" target=\"_blank\">Authy app<\/a> (for the extra security of the pin) I think is the best solution. My main 2FA login app is <a href=\"https:\/\/getclef.com\/\" target=\"_blank\">Clef<\/a>. If I don&#8217;t have signal on my mobile phone I can use <a href=\"https:\/\/www.authy.com\/users\" target=\"_blank\">Authy<\/a> for <a href=\"https:\/\/www.google.com\/landing\/2step\/\" target=\"_blank\">Google Authenitcator<\/a>. If the phone is not available\/lost, I Can use the <a href=\"http:\/\/www.amazon.co.uk\/s\/?field-keywords=%22FIDO%20U2F%20Security%20Key%22\" target=\"_blank\">FIDO U2F key<\/a>. If I don&#8217;t have the key on me, then I can use one of the <a href=\"https:\/\/support.google.com\/accounts\/answer\/1187538?hl=en&amp;ref_topic=2784804\" target=\"_blank\">one-time-only backup codes<\/a>. Until somebody else comes with the simplicity of <a href=\"https:\/\/getclef.com\/\" target=\"_blank\">Clef<\/a>\u00a0and the flexibility of <a href=\"https:\/\/www.google.com\/landing\/2step\/\" target=\"_blank\">Google Authenticator<\/a>, I think this is my setup of choice.<\/p>\n","protected":false},"excerpt":{"rendered":"<p>If any of you have a Google\/GMail account I am sure you have seen the prompts to setup 2 factor authentication (2FA). The way 2FA works is that not only do you enter a password, but a pin is sent to you via SMS and you have to enter that, too in order to login&#8230;. <\/p>\n<div class=\"read-more\"><a href=\"https:\/\/yiannis.uk\/techtalk\/clef-v-google-authenticator-v-authy\/\">Read More<\/a><\/div>\n","protected":false},"author":1,"featured_media":80,"comment_status":"open","ping_status":"open","sticky":false,"template":"","format":"standard","meta":{"footnotes":""},"categories":[5,6],"tags":[7,10,12,17,19],"class_list":["post-72","post","type-post","status-publish","format-standard","has-post-thumbnail","hentry","category-reviews","category-security","tag-2fa","tag-authy","tag-clef","tag-google-authenticator","tag-security-2"],"_links":{"self":[{"href":"https:\/\/yiannis.uk\/techtalk\/wp-json\/wp\/v2\/posts\/72","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/yiannis.uk\/techtalk\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/yiannis.uk\/techtalk\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/yiannis.uk\/techtalk\/wp-json\/wp\/v2\/users\/1"}],"replies":[{"embeddable":true,"href":"https:\/\/yiannis.uk\/techtalk\/wp-json\/wp\/v2\/comments?post=72"}],"version-history":[{"count":0,"href":"https:\/\/yiannis.uk\/techtalk\/wp-json\/wp\/v2\/posts\/72\/revisions"}],"wp:featuredmedia":[{"embeddable":true,"href":"https:\/\/yiannis.uk\/techtalk\/wp-json\/wp\/v2\/media\/80"}],"wp:attachment":[{"href":"https:\/\/yiannis.uk\/techtalk\/wp-json\/wp\/v2\/media?parent=72"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/yiannis.uk\/techtalk\/wp-json\/wp\/v2\/categories?post=72"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/yiannis.uk\/techtalk\/wp-json\/wp\/v2\/tags?post=72"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}