If you want to use your Google Account on your iPhone's Mail, Calendar, or Contact apps. Security Key doesn't work with apps that come on your iPhone, but you can use Google apps instead.[0] I'm using Google Contact on my iPhone. It seems security key is not for me. :(
Adding a security key to Gmail
51–60 of 126 posts
Re: Adding a security key to Gmail
#52I would advise against Google Authenticator as a backup as it really defeats the point of a hardware token. Google Authenticator stores the TOTP secret in plaintext on your device where the potential exists for it to be stolen. An adversary that exploits your phone can generate TOTP tokens as they like and ignore the fact you have a hardware token. If you are going to use Google Authenticator it is your weakest link…
Do you have a citation for the fact that google authenticator stores the keys in plain text? Furthermore, for the case of google authenticator on an iPhone, any files on the user partition are encrypted anyway, and I know from experience that the google authenticator app does not back up keys to either iCloud or iTunes backup. This should mean you are safe on iOS
If you are rooted, you can easily copy the sqlite database that secrets are stored in. I've done this a few times to migrate secrets to a new phone.
Re: Adding a security key to Gmail
#53Earlier quoted context omitted.
Do you have a citation for the fact that google authenticator stores the keys in plain text? Furthermore, for the case of google authenticator on an iPhone, any files on the user partition are encrypted anyway, and I know from experience that the google authenticator app does not back up keys to either iCloud or iTunes backup. This should mean you are safe on iOS
tokenizerrr | https://news.ycombinator.com/item?id=14105616 Even without root. Just run a backup and extract it from that. You can do it with just adb or helium. -- I can't quickly find any examples online that don't specifically mention requiring rooting the phone. Just this anecdote: https://community.spiceworks.com/topic/465582-google-authent... If you do a backup (even if not rooted you can use ADB to backup your…
ADB backups won't export the secrets from Google Authenticator. The app is configured to disallow that.
Source: I've tried.
Re: Adding a security key to Gmail
#54Earlier quoted context omitted.
Do you have a citation for the fact that google authenticator stores the keys in plain text? Furthermore, for the case of google authenticator on an iPhone, any files on the user partition are encrypted anyway, and I know from experience that the google authenticator app does not back up keys to either iCloud or iTunes backup. This should mean you are safe on iOS
tokenizerrr | https://news.ycombinator.com/item?id=14105616 Even without root. Just run a backup and extract it from that. You can do it with just adb or helium. -- I can't quickly find any examples online that don't specifically mention requiring rooting the phone. Just this anecdote: https://community.spiceworks.com/topic/465582-google-authent... If you do a backup (even if not rooted you can use ADB to backup your…
Well the scenario we are wanting to defend against is an attacker that can remotely (or even locally) exploit/root the phone (see long list of vulns for ios and android that have allowed exactly this). How many of these still exist not yet patched?
Depending on who you work for, someone might just burn a 0-day on you. It all depends on your threat profile.
Putting the secret in a hardware token gives you easy to reason about assurances a mobile phone OS vendor can't ever offer.
Also this means when you get a new phone, you just install app and tap key. No setup required.
Easier for you, and far more secure. Win/win.
Re: Adding a security key to Gmail
#55I would advise against Google Authenticator as a backup as it really defeats the point of a hardware token. Google Authenticator stores the TOTP secret in plaintext on your device where the potential exists for it to be stolen. An adversary that exploits your phone can generate TOTP tokens as they like and ignore the fact you have a hardware token. If you are going to use Google Authenticator it is your weakest link…
Are there any safe software alternatives to Google Authenticator? Duo? LastPass?
Yubico Authenticator and cryptostick.oauth are the only open solutions I am aware of that one can easily verify don't ever expose your secret key.
Both of course assume you have the secret key on a Yubikey, Nitrokey or similar.
Any app-only TOTP solution has to expose your private key somewhere by design and thus are best avoided in favor of hardware-backed solutions when possible.
Re: Adding a security key to Gmail
#56Earlier quoted context omitted.
The recommended way are app passwords. You basically generate a password for each app that needs to access your mail account. You can easily revoke access for a single app in case something goes wrong. Also, nobody gets the chance to read your actual password.
Unfortunately, you can't access GMail over its "native" protocol using app-specific passwords: it'll only work for IMAP. And the GMail client is a terrible IMAP client. My inbox and folders / labels would constantly desync. I'd moved to FastMail a while back and the problem persisted, so I'm reasonably sure it's the client. I'm actually using Outlook as my e-mail client now. It's surprisingly snappy for my minimal ne…
Warning: Outlook for Android stores your mails and all other data in the cloud! It is former Acompli app.
Re: Adding a security key to Gmail
#57Is there any point in doing this if you do not use Chrome?
Opera also has native U2F support, although some services (I'm looking at you, Dropbox) refuse to show the token UI to anything but Chrome via browser UA checking.
Re: Adding a security key to Gmail
#58The HyperFIDO Mini (U2F Security Key) is the cheapest and smallest key I've found so far for $10. (Amazon) The Yubico are probably the best key chain candidate. No one wants to trust their key to a weak nylon thread. You can also set up a Google account to use more than one U2F key. As for Google 2FA, I think Google caused a lot of confusion by how they set up the Google Authenticator app. Always opt for the text gen…
The HyperFIDO Mini (U2F Security Key)
clickable link: https://amzn.com/dp/B00WIX4JMC
Re: Adding a security key to Gmail
#59If you want to use your Google Account on your iPhone's Mail, Calendar, or Contact apps. Security Key doesn't work with apps that come on your iPhone, but you can use Google apps instead.[0] I'm using Google Contact on my iPhone. It seems security key is not for me. :( [0]: https://support.google.com/accounts/answer/6103523
Have you tried using app specific passwords?
Re: Adding a security key to Gmail
#60I would advise against Google Authenticator as a backup as it really defeats the point of a hardware token. Google Authenticator stores the TOTP secret in plaintext on your device where the potential exists for it to be stolen. An adversary that exploits your phone can generate TOTP tokens as they like and ignore the fact you have a hardware token. If you are going to use Google Authenticator it is your weakest link…
The attacker who gets access to the filesystem of your phone can almost certainly defeat any "encryption" a TOTP authenticator would use to protect secrets, so the premise of phone-based authenticators is that your phone isn't going to get compromised.
This is reasonable when you consider that if your computer --- the least secure device you own --- is compromised, your attacker is virtually certain to get your email account with it, because you'll have (at some near point) a logged-in session.
Meanwhile: the #1 concern that laypeople have about security tokens is that they'll be locked out of their account when they lose the token. Authenticator (or Duo) is a perfectly sane answer to that concern.
Finally, it's worth adding that at least the last time I helped someone set this up, you can't remove your phone number as a factor from your Google account until you have TOTP set up. Your phone number is an extremely insecure login factor.
We use, and recommend, Google Authenticator as a backup login factor.
We do not recommend Yubikey 4 keys for normal users. Nerds on HN might get a kick out of them; I say, go ahead and enjoy yourself. We're trying to solve problems for people who aren't computer experts.