Would like higher security authentication to SSO

[Joe "Rotund" Tennies]

I use Launchpad as my main OpenID provider. I would like increased security in the form of one-time use keys. An example of this is eBay/PayPal (https://www.paypal.com/cgi-bin/webscr?cmd=xpt/Marketing_CommandDriven/securitycenter/PayPalSecurityKey-outside) and World of Warcraft.

The SMS version eBay uses sounds good, but I'm concerned about needing a backdoor for the situation that you lose you cellphone/change phone numbers or providers. There's also the issue of the fact SMS is not a guaranteed service, so the key could be dropped if you are out of coverage (like in a basement at a conference). I wonder how eBay gets around these issues.

[Stuart Metcalfe (stuartmetcalfe)]

We're looking into a number of options to provide additional security for some cases, whether defined by a specific site or enabled by the user. This is not on our short-term roadmap but we are looking into it.

[Daniel Manrique (roadmr)]

login.ubuntu.com now supports 2-factor authentication. On the main personal details page, select "authentication devices" (on the left), configure one of the available devices, and you can then decide whether to be prompted for a 2FA code only for certain sites that request it, or all the time. To answer the "backup device" concerns, more than one device can be added to an account. There's even a "paper" device which is just a list of one-time codes, that's as low-tech as it gets and it will get you past any failures with e.g. a yubikey, a smartphone, etc.