nexist

Ankur Chauhan

Keyy gives you 2-factor authentication with a difference. It replaces passwords with sophisticated RSA public-key cryptography, which results in stronger security and a better user experience.
<div class="embed-vimeo" style="text-align: center;"><iframe loading="lazy" src="https://player.vimeo.com/video/217465671" width="750" height="422" frameborder="0" webkitallowfullscreen mozallowfullscreen allowfullscreen></iframe></div>
Keyy does away with typing:
<ul>
<li>Usernames</li>
<li>Passwords</li>
<li>One-time-passwords or other 2FA tokens</li>
</ul>
Instead, users log in simply using their mobile phone. It’s easy!
<ul>
<li>Install the Keyy app on your phone, available through Android or iOS (iPhone / iPad / iPod).</li>
<li>Secure the app using either a fingerprint or a 4-number pin</li>
<li>To log in, open the app and point it at the code shown on the screen. </li>
</ul>
Keyy gives you one-click access to all your WordPress websites simultaneously.
Security
Keyy has been built on RSA public-key cryptography, which is the same tried-and-tested technology underlying secure websites (SSL) and many other industry standards.
It involves a 2048-bit RSA digital key, which is created and stored on the user’s mobile phone. Keyy doesn’t keep a central database of user profile and login details, so you’re not reliant upon any third parties. The digital key is secured in the Android Keystore or Apple Keychain, only accessible via each user’s mobile phone protected by a fingerprint scan or a 6-digit PIN, so data remains safe even if the phone becomes lost or stolen.
Because it doesn’t use passwords, Keyy protects against a host of common password-stealing hacks, including:
<ul>
<li>Brute-forcing</li>
<li>Weak credentials</li>
<li>Key-logging</li>
<li>Password re-use</li>
<li>Shoulder-surfing</li>
<li>Connection sniffing</li>
</ul>
By strengthening individual account security, Keyy keeps the entire network safe.
Hold your phone up to any computer and you’re instantly logged in.
You need to have a device (e.g. phone or tablet) that uses either Android or iOS (e.g. iPhone, iPad).
N.B. This is our initial release. It is expected to be rough around the edges!
Please don’t hit us with a bad review before giving us a chance to improve the product; we’re very eager for your and suggestions feedback in the support channel.
In the coming weeks and months we will: 
* Launch a single-sign on feature, so logging into one site with Keyy logs you into all sites on that device 
* Ability to log on to a localhost site or other site without incoming Internet access (not currently possible) 
* Various other smaller improvements also planned
<h4>Features</h4>
<ul>
<li>
Login by scanning a code with your phone (or other device). No passwords to remember!
</li>
<li>
Industry-standard RSA encryption (assymetric keys) – your login key lives on your phone. There is no back-door access, even for us.
</li>
<li>
No central point of failure. The login instruction (signed by your unique private key) goes directly from your phone to your website; no third-party server is involved. You don’t get locked out if somebody else’s server is down.
</li>
<li>
Secret URL for de-activating Keyy: note and securely store this URL when you set up, and if you lose your phone later, you can use it to login using the ordinary WordPress username/password mechanism.
</li>
<li>
If you lose your phone, you can also disable the plugin through your web hosting account. i.e. You can’t be permanently logged out if you still have access to your WordPress install through your web hosting.
</li>
</ul>
<h4>Premium Features</h4>
The Premium version of this plugin adds these extra features:
<ul>
<li>
Ability to choose whether to require a password as well as, or instead of, a scan
</li>
<li>
Ability for administrators to impose scan/password policies on users (e.g. all editors require both)
</li>
<li>
Scan codes also appear on the WooCommerce and Affiliates-WP login forms and Theme My Login widgets and secondary login forms
</li>
<li>
Stealth mode: Hide the Keyy scan image until the user presses a key to reveal it
</li>
<li>
Hide username/password fields and require Keyy for all users
</li>
<li>
Mass contacting of all users with a connect scan code (useful when requiring Keyy of all users)
</li>
<li>
Ability for admins to view and over-ride settings for a specific user
</li>
<li>
Keyy admin pages do not show information about other products from our product family
</li>
<li>
Ability to customise/brand the “What is this?” message
</li>
<li>
Access to Premium support channels
</li>
</ul>

Keyy Two Factor Authentication (like Clef)

WordPress 2-Factor Authentication plugin that's high security and low hassle. Say goodbye to remembering usernames, passwords and tokens; say hel …

oskarhane

Secure WordPress login with this two factor auth. Users will have to enter an One Time Password when they log in.
<h4>Why You Need This</h4>
Users can have common or weak passwords that lets hackers/bots brute-force your WordPress site and gain access to your files and place malware there. 
Just like happend not that long ago: <a href="http://techcrunch.com/2013/04/12/hackers-point-large-botnet-at-wordpress-sites-to-steal-admin-passwords-and-gain-server-access/" rel="nofollow ugc">Article on TechCrunch</a>
If all sites would have used this plugin, this would never happend. 
It doesn’t matter how weak your users passwords are, no one can gain access to your WordPress site 
without already having access to the users mobile phone or email inbox (depending on how the user gets his OTP).
<h4>How Does It Work?</h4>
This plugin uses the industry standard algorithm <a href="http://en.wikipedia.org/wiki/Time-based_One-time_Password_Algorithm" rel="nofollow ugc">TOTP</a> or <a href="http://en.wikipedia.org/wiki/HMAC-based_One-time_Password_Algorithm" rel="nofollow ugc">HOTP</a> for creating One Time Passwords. 
A OTP is valid for a certain time and after that a new code has to be entered.
You can now choose to use third party apps like <a href="http://code.google.com/p/google-authenticator/" rel="nofollow ugc">Google Authenticator</a> which is available for most mobile platforms. You can really use any 
third party app that supports TOTP/HOTP that generates 6 digits OTP’s. 
Or, as before, you can choose to get your One Time Passwords by email.
Since you have to enter a secret code to third party apps, email is the default way of delivering One Time Passwords. Your 
users will have to activate delivery by third party apps themselves.
<h4>Easy To Use</h4>
Just install this plugin and you’re all set. There’s really nothing more to it. 
If you want to use a third party app, goto Two Factor Auth in the admin menu and activate it and set up your app. 
General settings can be found uner Settings -> Two Factor Auth in admin menu. Settings for each individual user 
can be found at the root level of the admin menu, in Two Factor Auth. 
A bit more work to get logged in, but a whole lot more secure!
If you use WooCommerce or other plugins that make custom login forms, you will not be able to login through those anymore. 
I will be adding a plugin that puts a One Time Password field to WooCommerce. If you use some other plugin that needs 
support for this, let me know in the support forum.
<h4>TOTP or HOTP</h4>
Which algorithm you and your users choose doesn’t really matter. The time based TOTP is a bit more secure since a One Time 
Password is valid only for a certain amount of time. But this requires the server time to be in sync the clients time (if 
the OTP isn’t delivered by email). This is often hard to do with embedded clients and the event based HOTP is then a better choice. 
If you have a somewhat slow email server and have chosen email delivery, you might not get the TOTP in time.
Conslusion: Choose which ever you want. TOTP is a little bit safer since OTP:s only are valid for a short period.
Note that email delivery users always uses the site default algorithm, which you can set on the settings page. Third party 
apps users can choose which one they want.
<h4>Is this really Two Factor Auth?</h4>
Before version 3.0 this plugin had ‘kind of’ two factor auth where the OTP was delivered to an email address. 
Since version 3.0 you can have real two factor auth if you activate the Third Party Apps delivery type.
Read more about <a href="http://oskarhane.com/two-factor-auth-explained/" rel="nofollow ugc">what two factor auth means >></a>.
See http://oskarhane.com/plugin-two-factor-auth-for-wordpress/ for more info.

Two Factor Auth

Secure WordPress login with Two Factor Auth. Users will have to enter an One Time Password when they log in.

Keyy Two Factor Authentication (like Clef) vs Two Factor Auth