2 Factor Iframe Similar To Duo

[Jon Byers]

Well we like Duo for its push capability and SMS since it offers that same effect.  With the frequency of phone upgrades and damamges we see using an authenticator app requiring higher helpdesk support, than if it was tied to a phone number.  I read the NIST info, totally understand.


-----Original Message-----
From: users [mailto:users-bounces at shibboleth.net] On Behalf Of Cantor, Scott
Sent: Friday, August 5, 2016 11:27 AM
To: Shib Users <users at shibboleth.net>
Subject: Re: 2 Factor Iframe Similar To Duo

On 8/5/16 2:04 PM, Jon Byers wrote:
> Thanks.  All helpful information.  Didn't know there was a push to move away
> from SMS as a method of 2-factor.

NIST is deprecating it in their recommendations, to be exact.

> From a cost perspective it seems like the less expensive way over Duo
> or other providers.

Well, it's less secure also, for some definitions of secure. If you
really want to do something like that, I'd personally suggest OATH with
a mobile phone authenticator app. That's even cheaper and doesn't depend
on any messaging or network connectivity to the device.

> I'll checkout SimpleSAMLphp, but we've pretty much fine tunes Shibboleth
> so I'd hate to start over now.

Point is just that Shibboleth means Java, it doesn't make a lot of sense
to extend it with PHP.

What is your time line?

We are collectively looking at the schedule for 3.3, and there's a
pretty strong sense from the team that we want to start pruning scope
back down and getting this shipped. This year certainly.

-- Scott
-- 
To unsubscribe from this list send an email to users-unsubscribe at shibboleth.net