PDA

View Full Version : Two Factor Authentication added for secure login



dannzeman
February 20th, 2015, 03:44 PM
We've recently seen a sharp increase in the number of nefarious attempts to log into existing accounts. Some of you may have received an email that looks something like this:


Dear [username],

Someone has tried to log into your account on FPGeeksForum with an incorrect password at least 5 times. This person has been prevented from attempting to login to your account for the next 15 minutes.

The person trying to log into your account had the following IP address: 199.217.117.89

All the best,
FPGeeksForum

Presently, the most we can do is blacklist the IP address to prevent people from accessing the forum from that specific address, but a simple proxy will easily allow them to get around that.

The best method for securing your account is to have a strong password and using two factor authentication (http://en.wikipedia.org/wiki/Two_factor_authentication). I've just installed a plugin that allows users to choose if they want to enable two factor authentication.

To do so, follow these simple instructions:

1. Click "Settings" in the upper right corner.
16574

2. Click "Two Factor Authentication" under My Settings on the left.
16573

3. Click "Enable Two Factor Authentication".
16572
You'll see my screen says "Disable" as I've already enabled it.

You'll then need to use the Google Authenticator app for iOS (https://itunes.apple.com/us/app/google-authenticator/id388497605?mt=8) or Android (https://play.google.com/store/apps/details?id=com.google.android.apps.authenticator2&hl=en) to generate your code.

Finally, be sure to write down your Recovery Key so you can recover your account should you not have access your phone.
16575

The two factor authentication adds your IP address to a whitelist so you won't have to generate a new code every time you logon to the forum from the same machine. If you use a different computer then it will ask you for a new code, which you can get from opening up the Google Authenticator app and entering the code shown.

If you enable two factor authentication then you won't be able to use the mobile style when visiting from a phone or tablet. You'll have to switch to the "Full Site" design.

This plugin does not impact the use of Tapatalk.

If you have any questions, please let me know.

gweddig
February 20th, 2015, 04:38 PM
Also seems to work with the Yubico Authenticator which, I believe Google's is based on.

--greg

Edited to add: thanks Dan!

Jon Szanto
February 20th, 2015, 11:49 PM
I always thought I was on a life-long quest for validation. Now I realize it was authentication I was after. Who knew?


Thanks, Dan.

Xina
February 21st, 2015, 11:19 PM
Is there anything laptop users can or should do? Any similar authentication precautions for us non-cell-phone people?

Cob
February 22nd, 2015, 12:13 AM
I am not seeking an explanation of all this stuff; I just want to record the fact here that I do not understand a word of it!

Rgds

Cob

dannzeman
February 22nd, 2015, 10:35 PM
Is there anything laptop users can or should do? Any similar authentication precautions for us non-cell-phone people?
If you don't have a cell phone to use the authenticator app then I would just make sure you have a strong password in place.