Two-factor auth on Android with NFC Ring
Got the NFC ring first batch, a really nice idea to put NFC chip (two of them actually) into a wearable titanium ring. There are two Google Play apps that you can download along with your ring to make use of it; NFC Ring Control is the app which you can use to read or write arbitrary info and setup your ring; The other one is NFC Ring unlock app - which basically loads a second lock screen after you unlock your android PIN or pattern. At first glance, the lock screen seems functional; If you somehow manage to loose your ring, there is an option to unlock the device with your google account. Which would be perfectly OK by the way, BUT:
The account password is not even masked when you type it ? It's a text instead of password field
The login does not work with Google two-factor enabled
So basically, if I have Google's two-factor enabled and I loose my ring, I would have to reset to factory settings in order to have my phone usable. There are setting of course which set behavior upon phone calls etc. so I'd still be able to answer phone, enter android's settings menu, turn off NFC, enable debug ( hmm ;) ) etc. etc.
Other than these two security issues, there are other concerns as well:
Google hangouts does not really behave as phone app, so it does not get the unlock exception during hangouts video call; I can guess same goes for Viber, Skype, and their kind. I am also not able to unlock the phone at all during a hangouts call/ring - I'd have to debug to find out why.
Same issue is valid to alarm applications - I am not able to stop my vanilla android morning alarm when NFC lock is in place. It just does not read the rind for some reason when the alarm is active.
Still, it is a smart gadget, and somewhat restored my faith in crowd funding and Kickstarter after previous unpleasant experience.
As far as it goes as a phone lock mechanism, the ring is good only for buying time for you to issue remote wipe of the device when lost/stolen. I would not trust it further than that. Now days PIN and pattern are just not enough - they are easily bruteforce-able.
Link: http://nfcring.com/