How does the communication between the USB key and Google in a browser work? Will it work on all operating systems and browsers?
Adding a security key to Gmail
31–40 of 126 posts
Re: Adding a security key to Gmail
#32The article states:
>If you're curious why it's important to not have a phone number on your account, see the security key FAQ.
but this is not explained in the FAQ. I've never heard about this before, why is this important?
Re: Adding a security key to Gmail
#33The article states: >If you're curious why it's important to not have a phone number on your account, see the security key FAQ. but this is not explained in the FAQ. I've never heard about this before, why is this important?
I guess because it's relatively easy to redirect/capture an sms/phone call. Trick the phone company into moving your number to a new sim for example
Re: Adding a security key to Gmail
#34Earlier quoted context omitted.
It changes when you input current code. You can scan it multiple times, print it, and then input the code from one of your devices.
Also, if you have a rooted device, you can get the original secret from the SQLite database of the authenticator app.
"can get the original secret" is a phrase which should worry a security-conscious person
Re: Adding a security key to Gmail
#35How does the communication between the USB key and Google in a browser work? Will it work on all operating systems and browsers?
As for the operating systems: in order to use it on your phone, you'll need to be careful to use a YubiKey with NFC support and have a phone that supports NFC. You won't have any trouble using it on Windows/Ubuntu/macOS.
As for the browsers: Chrome/Chromium works fine. Firefox has an addon that adds security key support[0]. Unfortunately, this addon has a bug which causes high CPU load[1]. Firefox is also working on adding the native support for this, and I think that their ETA is somewhere in the second half of this year to get this thing to work natively. Unfortunately, even with the U2F addon on Firefox, you still won't be able to use it for Gmail, since Google hardcoded its browser to be the only one with U2F support, so you're going to have to change your user agent in order to use it, or default back to your second method of 2FA (Google Authenticator or something of the sorts). I have no knowledge about the U2F status on Safari and Edge.
As far as I was able to discover, the only service that didn't hardcode Chrome as being the only browser at the moment with U2F support is GitHub, and using YubiKeys with Firefox + U2F addon on GitHub works without any issues (other than the occasional high CPU load that I've already mentioned).
I wrote a short article on my blog about Yubikey usefulness for my usual setup about a year ago[2]. Things changed slightly to the better since then, but not by a lot.
[0] https://addons.mozilla.org/en-US/firefox/addon/u2f-support-a...
Re: Adding a security key to Gmail
#36Earlier quoted context omitted.
It changes when you input current code. You can scan it multiple times, print it, and then input the code from one of your devices.
Also, if you have a rooted device, you can get the original secret from the SQLite database of the authenticator app.
Even without root. Just run a backup and extract it from that. You can do it with just adb or helium.
Re: Adding a security key to Gmail
#37"We'll remove the phone number later"
Too late, Google now has it and can correlate my profile with other sources. There's literally no other reason why Google doesn't let you enable 2FA without a phone number.
I wish I didn't have to choose between security and privacy.
Re: Adding a security key to Gmail
#38Thanks for writing this! One nitpick: the guide says "If you're curious why it's important to not have a phone number on your account, see the security key FAQ", but the linked security FAQ doesn't actually appear to say why it's important.
Sorry about that, I'm updating that FAQ next. The answer is that SMS is not a secure second factor (it's easy to hijack and eavesdrop on), and in some cases when you give a service a phone number, it becomes possible to take over the account with just control of the phone number.
Which is why password+SMS is sometimes called "1.5 factor auth"
Re: Adding a security key to Gmail
#39How does the communication between the USB key and Google in a browser work? Will it work on all operating systems and browsers?
As for the operating systems: in order to use it on your phone, you'll need to be careful to use a YubiKey with NFC support and have a phone that supports NFC. You won't have any trouble using it on Windows/Ubuntu/macOS. As for the browsers: Chrome/Chromium works fine. Firefox has an addon that adds security key support[0]. Unfortunately, this addon has a bug which causes high CPU load[1]. Firefox is also working on…
You can also use U2F on Firefox with FastMail.
Re: Adding a security key to Gmail
#40Earlier quoted context omitted.
Also, if you have a rooted device, you can get the original secret from the SQLite database of the authenticator app.
"can get the original secret" is a phrase which should worry a security-conscious person
rooting their phone is not something a security-conscious person would do, either.
Edit: maybe I should have explained my position. There are a few security issues with rooting a phone, e.g.:
- rooting usually requires unlocking the bootloader. Once it's unlocked, anyone can flash or boot a custom recovery and modify your system partition. Enrolling your own keys in the recovery and re-locking the bootloader, while possible, is an undocumented and complex process that just about nobody uses, see https://mjg59.dreamwidth.org/31765.html . You're also screwed if a system update replaces the recovery. Once the bootloader is unlocked, anyone with physical access to your phone can mess with your system in malicious ways.
- it circumvents the system's permission model. A malicious app that tricks the user into granting it root rights (maybe for a legitimate reason) could access information it shouldn't have, install a keylogger, etc.