Comments on: PhoneFactor 1.0 http://alexking.org/blog/2008/06/27/phonefactor-10 Alex King, Denver Web Developer Wed, 08 Feb 2012 13:45:57 +0000 hourly 1 http://wordpress.org/?v=3.3.1 By: MHeinrich http://alexking.org/blog/2008/06/27/phonefactor-10#comment-64883 MHeinrich Fri, 03 Oct 2008 04:18:23 +0000 http://alexking.org/blog/2008/06/27/phonefactor-10#comment-64883 I think those are valid concerns, but I have to say that the reality of recovering from all of those situations with my phone is much simpler/convenient than any of the alternative problems with tokens. Have you ever had to carry a SecurID token or keep track of a PKI certificate? I prefer waterboarding to being the IT person that has to manage that. And if you're a consumer, way too expensive for anything but the most valuable of web properties (e.g. E*trade account with 50k in it). Worst case, I can't login unless I have a phone signal and my charger. If I lose my cell phone, I have to replace it anyhow. If I lose a token or cert, again ... waterboarding, please. I think those are valid concerns, but I have to say that the reality of recovering from all of those situations with my phone is much simpler/convenient than any of the alternative problems with tokens. Have you ever had to carry a SecurID token or keep track of a PKI certificate? I prefer waterboarding to being the IT person that has to manage that. And if you’re a consumer, way too expensive for anything but the most valuable of web properties (e.g. E*trade account with 50k in it).

Worst case, I can’t login unless I have a phone signal and my charger. If I lose my cell phone, I have to replace it anyhow. If I lose a token or cert, again … waterboarding, please.

]]> By: Rich http://alexking.org/blog/2008/06/27/phonefactor-10#comment-64875 Rich Thu, 02 Oct 2008 15:05:36 +0000 http://alexking.org/blog/2008/06/27/phonefactor-10#comment-64875 What happens if you lose your phone, run out of batteries, or just dont get a singnal? What happens if you lose your phone, run out of batteries, or just dont get a singnal?

]]> By: Dan http://alexking.org/blog/2008/06/27/phonefactor-10#comment-64624 Dan Tue, 09 Sep 2008 23:52:36 +0000 http://alexking.org/blog/2008/06/27/phonefactor-10#comment-64624 This is fantastic! Sorry for bumping and commenting on a old post, but this is a brilliant addon. This is fantastic!
Sorry for bumping and commenting on a old post, but this is a brilliant addon.

]]> By: Prevent Your WordPress Blog From Getting Hacked http://alexking.org/blog/2008/06/27/phonefactor-10#comment-64452 Prevent Your WordPress Blog From Getting Hacked Sat, 30 Aug 2008 03:33:13 +0000 http://alexking.org/blog/2008/06/27/phonefactor-10#comment-64452 [...] You can learn more about Phone Factor and download it here. [...] [...] You can learn more about Phone Factor and download it here. [...]

]]> By: hypotheek http://alexking.org/blog/2008/06/27/phonefactor-10#comment-64148 hypotheek Wed, 06 Aug 2008 07:25:49 +0000 http://alexking.org/blog/2008/06/27/phonefactor-10#comment-64148 This is a very cool plugin. I do agree with some of the comments that there might be some limitations if there is any problem in the chain of layers. But i think if there is a concrete error, you can alway's enter your server and change and get into wordpress. I generaly like it. This is a very cool plugin. I do agree with some of the comments that there might be some limitations if there is any problem in the chain of layers. But i think if there is a concrete error, you can alway’s enter your server and change and get into wordpress. I generaly like it.

]]> By: Alex http://alexking.org/blog/2008/06/27/phonefactor-10#comment-63973 Alex Wed, 23 Jul 2008 18:46:19 +0000 http://alexking.org/blog/2008/06/27/phonefactor-10#comment-63973 <blockquote>I presume if you MUST access your blog and the service is down, you can just log into the server and delete the plugin file?</blockquote> Yes, that would work fine.

I presume if you MUST access your blog and the service is down, you can just log into the server and delete the plugin file?

Yes, that would work fine.

]]> By: Paradox http://alexking.org/blog/2008/06/27/phonefactor-10#comment-63972 Paradox Wed, 23 Jul 2008 18:45:06 +0000 http://alexking.org/blog/2008/06/27/phonefactor-10#comment-63972 Interesting. I saw the ad for this service on tv, and thought it might be useful. Ill have to try it. I presume if you MUST access your blog and the service is down, you can just log into the server and delete the plugin file? Interesting. I saw the ad for this service on tv, and thought it might be useful.

Ill have to try it.

I presume if you MUST access your blog and the service is down, you can just log into the server and delete the plugin file?

]]> By: Alex http://alexking.org/blog/2008/06/27/phonefactor-10#comment-63947 Alex Mon, 21 Jul 2008 13:32:20 +0000 http://alexking.org/blog/2008/06/27/phonefactor-10#comment-63947 Interesting. I've got bit about Crowd Favorite on my home page, in my sidebar, and I listed this as a "Case Study"... I guess I thought I was making it clear that it was something we built. I never intended not to. Interesting. I’ve got bit about Crowd Favorite on my home page, in my sidebar, and I listed this as a “Case Study”… I guess I thought I was making it clear that it was something we built. I never intended not to.

]]> By: Guy Rintoul http://alexking.org/blog/2008/06/27/phonefactor-10#comment-63946 Guy Rintoul Mon, 21 Jul 2008 11:38:30 +0000 http://alexking.org/blog/2008/06/27/phonefactor-10#comment-63946 Alex, Just a suggestion - in the interests of openness, it may be better to explicitly call out that Crowd Favorite is your company. While I see you've used 'we' and 'us' in the post, it does come across like you're trying to give an impartial review of a product - which you're not. Most bloggers would put an explicit disclaimer in their post to avoid any perception of underhand bias... Guy Alex,

Just a suggestion – in the interests of openness, it may be better to explicitly call out that Crowd Favorite is your company. While I see you’ve used ‘we’ and ‘us’ in the post, it does come across like you’re trying to give an impartial review of a product – which you’re not. Most bloggers would put an explicit disclaimer in their post to avoid any perception of underhand bias…

Guy

]]> By: PhoneFactor Makes WordPress Logins More Secure than Most Online Bank Accounts | PhoneFactor http://alexking.org/blog/2008/06/27/phonefactor-10#comment-63904 PhoneFactor Makes WordPress Logins More Secure than Most Online Bank Accounts | PhoneFactor Thu, 17 Jul 2008 14:12:16 +0000 http://alexking.org/blog/2008/06/27/phonefactor-10#comment-63904 [...] today announced that PhoneFactor, its phone-based authentication technology, is available as a free plug-in to WordPress, the largest self-hosted blogging tool in the world. With PhoneFactor, WordPress’ hundreds of [...] [...] today announced that PhoneFactor, its phone-based authentication technology, is available as a free plug-in to WordPress, the largest self-hosted blogging tool in the world. With PhoneFactor, WordPress’ hundreds of [...]

]]> By: Jeff http://alexking.org/blog/2008/06/27/phonefactor-10#comment-63748 Jeff Thu, 03 Jul 2008 20:29:15 +0000 http://alexking.org/blog/2008/06/27/phonefactor-10#comment-63748 Sorry about the spam everyone. An overzealous intern recruited some friends back home (yes - India) and went a little post crazy. They have been reprimanded and it has been stopped immediately. Alex, nor his team at Crowd Favorite had anything to do with this. Our apologies. PhoneFactor Product Team Sorry about the spam everyone.

An overzealous intern recruited some friends back home (yes – India) and went a little post crazy.

They have been reprimanded and it has been stopped immediately.

Alex, nor his team at Crowd Favorite had anything to do with this.

Our apologies.

PhoneFactor Product Team

]]> By: Chris Nielsen http://alexking.org/blog/2008/06/27/phonefactor-10#comment-63746 Chris Nielsen Thu, 03 Jul 2008 19:42:48 +0000 http://alexking.org/blog/2008/06/27/phonefactor-10#comment-63746 I'm here as well because someone named "breanan" posted about this WP plugin: I DARE YOU TO STEAL MY BLOG You can’t with this new WP plugin. Developed by the master himself, alex king. http://wordpress.org/extend/plugins/phonefactor/ I find it hard to believe that you don't know this person or have not hired them to promote your plug in. Perhaps they are connected with the phone service that is used...? But if it's true I would distance yourself from them as much as possible and consider using another phone service that doesn't need to spam. Nice feature, by the way, but overkill in my opinion just to keep someone from logging into a blog. And it still has nice options for abuse... :-) I’m here as well because someone named “breanan” posted about this WP plugin:

I DARE YOU TO STEAL MY BLOG

You can’t with this new WP plugin. Developed by the master himself, alex king.
http://wordpress.org[...]phonefactor/

I find it hard to believe that you don’t know this person or have not hired them to promote your plug in. Perhaps they are connected with the phone service that is used…?

But if it’s true I would distance yourself from them as much as possible and consider using another phone service that doesn’t need to spam. Nice feature, by the way, but overkill in my opinion just to keep someone from logging into a blog. And it still has nice options for abuse… :-)

]]> By: Alex http://alexking.org/blog/2008/06/27/phonefactor-10#comment-63740 Alex Thu, 03 Jul 2008 15:49:53 +0000 http://alexking.org/blog/2008/06/27/phonefactor-10#comment-63740 I have no idea who is doing the spamming, but I can assure you it is <em>not</em> Crowd Favorite (which is my company). We built the plugin and I posted this blog post, which is all we've done the publicize it. I have no idea who is doing the spamming, but I can assure you it is not Crowd Favorite (which is my company). We built the plugin and I posted this blog post, which is all we’ve done the publicize it.

]]> By: Dr. Mike Wendell http://alexking.org/blog/2008/06/27/phonefactor-10#comment-63739 Dr. Mike Wendell Thu, 03 Jul 2008 15:26:51 +0000 http://alexking.org/blog/2008/06/27/phonefactor-10#comment-63739 Alex, while I agree with you that this is a great idea, could you please drop a hint to Crowd Favorite to knock off the spamming. They've hit a large number of sites, including the typepad, movable type, drupal, and edublogs support forums. It really gives wordpress a bad name to see a plugin promoted via spam and to see your name associated with this. http://wordpress.org/support/topic/186359 Alex, while I agree with you that this is a great idea, could you please drop a hint to Crowd Favorite to knock off the spamming. They’ve hit a large number of sites, including the typepad, movable type, drupal, and edublogs support forums. It really gives wordpress a bad name to see a plugin promoted via spam and to see your name associated with this.

http://wordpress.org[...]topic/186359

]]> By: paan http://alexking.org/blog/2008/06/27/phonefactor-10#comment-63729 paan Thu, 03 Jul 2008 01:50:53 +0000 http://alexking.org/blog/2008/06/27/phonefactor-10#comment-63729 the phone calls acts as a second authentication channel. It is typical in security to add another, usually from a diffferent technology domain, authetication channel so that anyone that wants to steal your account will have to get your credential on both channel. In other words. Some one trying to steal your account will have to get your password AND have access to your phone calls. You don't authenticate yourself with the phone number but as david said the phone call is the authentication process. the phone calls acts as a second authentication channel.
It is typical in security to add another, usually from a diffferent technology domain, authetication channel so that anyone that wants to steal your account will have to get your credential on both channel.

In other words. Some one trying to steal your account will have to get your password AND have access to your phone calls.

You don’t authenticate yourself with the phone number but as david said the phone call is the authentication process.

]]>