Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Adding a security key to Gmail

techsolidarity.org

Post reply on HN
Print view View original

21–30 of 126 posts

Re: Adding a security key to Gmail

#21

Post by captn3m0 »

hdhzy wrote: post #11
orbitingpluto wrote: post #8

Earlier quoted context omitted.

Didn't it change the web page on your computer browser after you successfully added it into Google Authenticator? I suppose you could always take a photo of the QR code and then rescan that. Text seems simpler. edit: Anyone else remember this behavior? Old version? Browser specific?

It changes when you input current code. You can scan it multiple times, print it, and then input the code from one of your devices.

Also, if you have a rooted device, you can get the original secret from the SQLite database of the authenticator app.

Re: Adding a security key to Gmail

#22

Post by RJIb8RBYxzAMX9u »

b15h0p wrote: post #17
barking wrote: post #14

I'd like some advice about safely accessing gmail from your phone. In particular an android phone that might not have the latest version of android on it. Also for situations where not only do you access your gmail from your phone but also your google authenticator app is installed on it.

The recommended way are app passwords. You basically generate a password for each app that needs to access your mail account. You can easily revoke access for a single app in case something goes wrong. Also, nobody gets the chance to read your actual password.

Unfortunately, you can't access GMail over its "native" protocol using app-specific passwords: it'll only work for IMAP. And the GMail client is a terrible IMAP client. My inbox and folders / labels would constantly desync. I'd moved to FastMail a while back and the problem persisted, so I'm reasonably sure it's the client.

I'm actually using Outlook as my e-mail client now. It's surprisingly snappy for my minimal needs. Maybe I should switch to iCloud for e-mail, and aim for the trifecta...

Re: Adding a security key to Gmail

#23

Post by hdhzy »

cntlzw wrote: post #15
hdhzy wrote: post #12

Earlier quoted context omitted.

Only Chrome supports U2F. Firefox has experimental support of you enable special flags in about:config but I never got it to work. U2F will be superseded by Web Authentication [0] that includes U2F and will be supported by all major browsers. Edge includes draft spec API that uses TPM to store keys. [0]: https://w3c.github.io/webauthn/

You can use U2F in firefox with extension. Last time I tried it worked. However I use chrome most of the time so I am not sure if it still does. https://addons.mozilla.org/en-Us/firefox/addon/u2f-support-a...

It works! Thanks.

Re: Adding a security key to Gmail

#24

Post by hdhzy »

U2F has some interesting properties. It cannot be phished (browser sends origin to the token), binds the credentials to username (you can use one token multiple times), can be attested (e.g. server can trust tokens only from manufacturer X), uses asymmetric crypto (P-256) instead of shared secrets.

Re: Adding a security key to Gmail

#25

Post by cyphar »

idlewords wrote: post #4
samdk wrote: post #3

Thanks for writing this! One nitpick: the guide says "If you're curious why it's important to not have a phone number on your account, see the security key FAQ", but the linked security FAQ doesn't actually appear to say why it's important.

Sorry about that, I'm updating that FAQ next. The answer is that SMS is not a secure second factor (it's easy to hijack and eavesdrop on), and in some cases when you give a service a phone number, it becomes possible to take over the account with just control of the phone number.

And some services that do phone calls can be tricked to save to voicemail (which was the case for Google, Facebook and various others previously): https://shubs.io/how-i-bypassed-2-factor-authentication-on-g...

Re: Adding a security key to Gmail

#26

Post by nspassov »

phillc73 wrote: post #6

The article mentions Yubikey at $18. As an alternative, the Nitrokey U2F is only €9 (€11 including delivery) https://shop.nitrokey.com/shop/product/nitrokey-u2f-5

Plus, unlike with Yubikey, Nitrokey has open-sourced both hardware and firmware [1].

[1] https://github.com/nitrokey

Re: Adding a security key to Gmail

#27

Post by phillc73 »

nspassov wrote: post #26
phillc73 wrote: post #6

The article mentions Yubikey at $18. As an alternative, the Nitrokey U2F is only €9 (€11 including delivery) https://shop.nitrokey.com/shop/product/nitrokey-u2f-5

Plus, unlike with Yubikey, Nitrokey has open-sourced both hardware and firmware [1]. [1] https://github.com/nitrokey

True for their storage and encryption products. Unfortunately not for their U2F product. "Nitrokey U2F is a relabeled 3rd party product and hence not open source."[1]

[1] https://shop.nitrokey.com/shop/product/nitrokey-u2f-5

Re: Adding a security key to Gmail

#28

Post by wfunction »

barking wrote: post #14

I'd like some advice about safely accessing gmail from your phone. In particular an android phone that might not have the latest version of android on it. Also for situations where not only do you access your gmail from your phone but also your google authenticator app is installed on it.

Encrypt + add PIN + disable SMS/Phone authentication? Is this insufficient?

Re: Adding a security key to Gmail

#29

Post by wfunction »

noxToken wrote: post #19
samdk wrote: post #3

Thanks for writing this! One nitpick: the guide says "If you're curious why it's important to not have a phone number on your account, see the security key FAQ", but the linked security FAQ doesn't actually appear to say why it's important.

Because it can be a way to compromise your account[0]. HN discussion[1]: [0]: https://blog.coinbase.com/on-phone-numbers-and-identity-423d... [1]: https://news.ycombinator.com/item?id=12597609

> We were also able to get in contact with an outstanding Verizon employee who understood the urgency and impact of our situation and shepherded our case through the byzantine halls of inter-carrier communications. We had control of the phone number back by 2 PM (which, if you’ve ever tried to get two phone companies to talk to each other, is a significant achievement. We were initially assuming we wouldn’t be able to regain control until the following week).

How in the world is a random guy supposed to do this sort of thing? Anyone have any tips for people who get into these situations and who aren't already BFFs with C-level executives of phone companies or something like that?

Re: Adding a security key to Gmail

#30

Post by leni536 »

RJIb8RBYxzAMX9u wrote: post #22
b15h0p wrote: post #17

Earlier quoted context omitted.

The recommended way are app passwords. You basically generate a password for each app that needs to access your mail account. You can easily revoke access for a single app in case something goes wrong. Also, nobody gets the chance to read your actual password.

Unfortunately, you can't access GMail over its "native" protocol using app-specific passwords: it'll only work for IMAP. And the GMail client is a terrible IMAP client. My inbox and folders / labels would constantly desync. I'd moved to FastMail a while back and the problem persisted, so I'm reasonably sure it's the client. I'm actually using Outlook as my e-mail client now. It's surprisingly snappy for my minimal ne…

Did you try K-9 Mail?
Post reply on HN