41–50 of 126 posts
"We'll remove the phone number later" Too late, Google now has it and can correlate my profile with other sources. There's literally no other reason why Google doesn't let you enable 2FA without a phone number. I wish I didn't have to choose between security and privacy.
Google Authenticator stores the TOTP secret in plaintext on your device where the potential exists for it to be stolen. An adversary that exploits your phone can generate TOTP tokens as they like and ignore the fact you have a hardware token. If you are going to use Google Authenticator it is your weakest link and a security token buys you no added security, only ease of use.
The typical goal of a security token is to be able to assert: "No one can log into my account without this physical device or an offline backup token from my safe"
To acheive this consider a device with built-in TOTP support in addition to U2F. All current Yubikeys fit the bill here as as well as some Nitrokey models. Desktop or Android users can use the either USB or NFC devices but it is worth noting that iOS lacks support for either which means you would need a desktop or Android device to fetch TOTP tokens for an iPhone.
You can use the open source "Yubico Authenticator" apps to store your TOTP secrets in your key alongside your U2F secret. Now both methods use the same hardware and your phone/computer only get handed OTP codes from the key if present, but can't generate them itself.
Added bonus is now you can now use security token backed login even on the majority of sites/browsers today that lack U2F support.
Extra bonus is these keys can be used for ssh without any server changes. Security token all the things :)
I would advise against Google Authenticator as a backup as it really defeats the point of a hardware token. Google Authenticator stores the TOTP secret in plaintext on your device where the potential exists for it to be stolen. An adversary that exploits your phone can generate TOTP tokens as they like and ignore the fact you have a hardware token. If you are going to use Google Authenticator it is your weakest link…
I would advise against Google Authenticator as a backup as it really defeats the point of a hardware token. Google Authenticator stores the TOTP secret in plaintext on your device where the potential exists for it to be stolen. An adversary that exploits your phone can generate TOTP tokens as they like and ignore the fact you have a hardware token. If you are going to use Google Authenticator it is your weakest link…
If only there were a similar guide to getting gpg agent working with the yubikey stored gpg keys and ssh. I've done it, but for the life of my I couldn't tell you how as it was mostly just trying magic incantations of things until it started working.
Simple GPG setup: https://github.com/lrvick/security-token-docs/blob/master/Us...
Advanced GPG setup with backups: https://github.com/lrvick/security-token-docs/blob/master/Us...
SSH Setup: https://github.com/lrvick/security-token-docs/blob/master/Us...
I also will be adding an alternate "quick ssh setup" guide via PKCS#11 flows to just store an existing ssh private key. Still I think GPG is the way to go in general given all the other use cases it opens up.
Please file issues with anything you want to see! I have a lot of unpublished content I can get polished/up if people care.
I would advise against Google Authenticator as a backup as it really defeats the point of a hardware token. Google Authenticator stores the TOTP secret in plaintext on your device where the potential exists for it to be stolen. An adversary that exploits your phone can generate TOTP tokens as they like and ignore the fact you have a hardware token. If you are going to use Google Authenticator it is your weakest link…
Thanks for writing this! One nitpick: the guide says "If you're curious why it's important to not have a phone number on your account, see the security key FAQ", but the linked security FAQ doesn't actually appear to say why it's important.
Sorry about that, I'm updating that FAQ next. The answer is that SMS is not a secure second factor (it's easy to hijack and eavesdrop on), and in some cases when you give a service a phone number, it becomes possible to take over the account with just control of the phone number.
I would advise against Google Authenticator as a backup as it really defeats the point of a hardware token. Google Authenticator stores the TOTP secret in plaintext on your device where the potential exists for it to be stolen. An adversary that exploits your phone can generate TOTP tokens as they like and ignore the fact you have a hardware token. If you are going to use Google Authenticator it is your weakest link…
"We'll remove the phone number later" Too late, Google now has it and can correlate my profile with other sources. There's literally no other reason why Google doesn't let you enable 2FA without a phone number. I wish I didn't have to choose between security and privacy.
I would advise against Google Authenticator as a backup as it really defeats the point of a hardware token. Google Authenticator stores the TOTP secret in plaintext on your device where the potential exists for it to be stolen. An adversary that exploits your phone can generate TOTP tokens as they like and ignore the fact you have a hardware token. If you are going to use Google Authenticator it is your weakest link…
Do you have a citation for the fact that google authenticator stores the keys in plain text? Furthermore, for the case of google authenticator on an iPhone, any files on the user partition are encrypted anyway, and I know from experience that the google authenticator app does not back up keys to either iCloud or iTunes backup. This should mean you are safe on iOS
Even without root. Just run a backup and extract it from that. You can do it with just adb or helium.
--
I can't quickly find any examples online that don't specifically mention requiring rooting the phone. Just this anecdote: https://community.spiceworks.com/topic/465582-google-authent...
If you do a backup (even if not rooted you can use ADB to backup your apps and data,) then you can simply restore the app and data to your new phone and the codes for the device come with it.
This article appears to contain the most detailed instructions, stating that both Titanium backaup and manual extraction require root: https://www.howtogeek.com/130755/how-to-move-your-google-aut...
If your Android is rooted, you can use Titanium Backup, which we’ve written about before, to take a backup of your Google Authenticator app data. [...] If you have root access to your device, you can actually extract the credentials manually
It was at one point possible to extract from iPhone backups: https://dpron.com/recovering-google-authenticator-keys-from-...
I would advise against Google Authenticator as a backup as it really defeats the point of a hardware token. Google Authenticator stores the TOTP secret in plaintext on your device where the potential exists for it to be stolen. An adversary that exploits your phone can generate TOTP tokens as they like and ignore the fact you have a hardware token. If you are going to use Google Authenticator it is your weakest link…
Do you have a citation for the fact that google authenticator stores the keys in plain text? Furthermore, for the case of google authenticator on an iPhone, any files on the user partition are encrypted anyway, and I know from experience that the google authenticator app does not back up keys to either iCloud or iTunes backup. This should mean you are safe on iOS
There have been plenty of iOS exploits as well as Android and everything else. Phones have a lot of attack surface and are not a reasonable place to store 2FA of any kind, IMO.
The separate hardware TOTP device never exposes the private key to system memory or disk at all. Even if your phone was rooted by a remote attacker, they could not generate tokens.
Likewise even if someone physically stole your unlocked phone and your pin-protected key... you are still in pretty good shape.
With a hardware TOTP device is just a "viewer" for one code at a time, as generated by the token.