Question about Shibboleth and MFA - Google Authenticator

[Tom Scavo]

On Fri, Feb 15, 2019 at 11:22 AM Cantor, Scott <cantor.2 at osu.edu> wrote:
>
> > I tried using it, and,  it is no way the same polish as the Duo plugin. Not sure
> > end users would be happy “registering a token?”.
>
> You have to register tokens with Duo also. The reason we haven't bothered providing alternative implementations is that doing them requires providing a full system for managing the tokens and the registration UI, and given the almost total monopoly Duo has, it hasn't seemed to be something worth doing.

Are you referring to OATH TOTP? That's the less interesting part of
Duo's implementation as you know. Duo pretty much invented push
authentication, which everyone copied, and so there are lots of
choices out there.

> If members ask for the feature I'm sure we would consider it.

Out of curiosity, are members asking about W3C WebAuthn? [1] That's
where the authentication space seems to be headed at the moment.

Melvin, sorry for hijacking your thread. You didn't say why you're
considering Google Authenticator in lieu of Duo but you probably want
to avoid that if you can. Google Authenticator has hidden costs (as
you're finding out).

Tom

[1] W3C Web Authentication https://www.w3.org/TR/webauthn/