Forum

 I would like to use the Authentication Token or SMS for 2 factor authentication. There are 2 problems:


 1. I have 3 Dynadot accounts (one for personal domains, another shared with others for company domains, another is someone else's account that I administer). The iOS Token app only seems to support a single token at a time. So I can't enable 2 factor across all accounts. At least, not without re-entering the serial number every single time I change accounts.


 Is the token compatible with RFC 4226 or RFC 6238 (ie, Google Authenticator)? Is there a way to translate the account S/N into a key that Google Authenticator accepts? Ideally I would have a single app for this stuff and not have every random site need its own app.


 2. For the company account I share, there is only one telephone number for SMS authentication. So it seems I can't use that instead of the Token Auth in that case. Are there any plans to add a way to have multiple phone numbers per account?


 Alternatively, Is there a way to link accounts so that 2 or more individuals can access the company account by logging into their own accounts?


Thanks,
 David

I've just tried the token. The algorithm it uses actually seems _very similar_ to OATH-TOTP, with only a few small differences:

– 60 second interval vs 30 second (TOTP allows both, but most apps only support 30s);

– the time must be converted to binary, _not_ ASCII, when using it as the counter (e.g. 1396067024 → 23267783 → 00 00 00 00 01 63 09 C7, as in ByteBuffer.putLong).

– most phone apps expect the secret to be Base32-encoded (e.g. GEZDGNBVGY3TQ instead of 12345678)

For convenience, most apps can scan QR codes (qrencode otpauth://totp/Dynadot:jon123?secret=GEZDGNBVGY3TQ&issuer=Dynadot as per https://code.google.com/p/google-authenticator/wiki/KeyUriFormat).

+1

Thanks!  We've passed this on to our engineering team.  :)

Thanks for your consideration.

Let me point out that Google Authenticator doesn't have an API that needs implementing. It's an open source one-time passcode generator app for mobile phones (Android, iOS, and Blackberry) built on open standards based encryption algorithms. Their web page states: "These implementations support the HMAC-Based One-time Password (HOTP) algorithm specified in RFC 4226 and the Time-based One-time Password (TOTP) algorithm specified in RFC 6238."

https://code.google.com/p/google-authenticator/

Thank you for posting.  Our security apps are not compatible with Google Authenticator at this time.  We are looking to integrate some Google products, but not until after March when they update their API.  We can explore the possibility of Google Authenticator integration at that time.  

A faster solution may be your idea of having more than one phone number associated to each account.  We'll discuss this and see if it something we can add in or if our tech team has another solution.