Adding a security key to Gmail • Hacker News Board

Re: Adding a security key to Gmail

#81

Post by tptacek » Thu, Apr 13, 2017, 1:36 PM UTC

lrvick wrote: post #79

tptacek wrote: post #73

Earlier quoted context omitted.

These are indeed answers, but they aren't the real answers. The real answer for "why not a smartphone app" is "because code generators are just as phishable as passwords". In the real world, that's how people are being compromised, not by elaborate phone exploit pivots but by phishing pages. It also speaks to why phone authenticators are acceptable backups to tokens. The real answer for "why not SMS" is "because both…

Code generators are super phishable and that is the whole reason to abandon them in the medium term. In the short term however they are all we have for most websites so protecting the secret in a hardwre token is as good as we can get. No matter how much you protect the secret though, not getting phished is left to the hopefully paranoid user, which is for sure not ideal, but we are probably years out from TOTP being…

Code generators are indeed phishable, which is why your primary login factor is a U2F token. Meanwhile, because of the way phishing works, if you go log in of your own volition to your Google Mail account, the TOTP code provides about as much security as the U2F key does.

The idea behind the U2F/TOTP stack is to minimize your exposure to phishing attacks and at the same time minimize (to practically zero) the odds of you being locked out of your account. It accomplishes that nicely, which is why most of the other experts we talk to have U2F/TOTP/backup-codes as their Google 2FA stack.

Re: Adding a security key to Gmail

#82

Post by lrvick » Thu, Apr 13, 2017, 1:38 PM UTC

tptacek wrote: post #60

lrvick wrote: post #42

I would advise against Google Authenticator as a backup as it really defeats the point of a hardware token. Google Authenticator stores the TOTP secret in plaintext on your device where the potential exists for it to be stolen. An adversary that exploits your phone can generate TOTP tokens as they like and ignore the fact you have a hardware token. If you are going to use Google Authenticator it is your weakest link…

The attacker who gets access to the filesystem of your phone can almost certainly defeat any "encryption" a TOTP authenticator would use to protect secrets, so the premise of phone-based authenticators is that your phone isn't going to get compromised. This is reasonable when you consider that if your computer --- the least secure device you own --- is compromised, your attacker is virtually certain to get your email…

Yubico Authenticator is a fork of Google Authenticator and is a drop-in replacement.

I have never had any problem helping someone that has used google authenticator set this up. Scan barcode and tap.

Also users have a much easier time when they get a new phone. Just tap to new phone and get codes. There is no data to transfer.

As for people getting locked out, that is what the printable backup codes are for, or a secondary key, depending on your threat profile.

In a corporate setting this is a non-issue as an admin can bail you out.

Re: Adding a security key to Gmail

#83

Post by idlewords » Thu, Apr 13, 2017, 1:39 PM UTC

barking wrote: post #14

I'd like some advice about safely accessing gmail from your phone. In particular an android phone that might not have the latest version of android on it. Also for situations where not only do you access your gmail from your phone but also your google authenticator app is installed on it.

We recommend using the authenticator app to log in on your phone. It's not as secure as the key (since you can still get phished) but one to mitigate that is to type in the gmail URL by hand.

An iPhone is so much more secure than any laptop that it more than makes up for the small drop in second-factor security.

Re: Adding a security key to Gmail

#84

Post by tptacek » Thu, Apr 13, 2017, 1:47 PM UTC

lrvick wrote: post #82

tptacek wrote: post #60

Earlier quoted context omitted.

The attacker who gets access to the filesystem of your phone can almost certainly defeat any "encryption" a TOTP authenticator would use to protect secrets, so the premise of phone-based authenticators is that your phone isn't going to get compromised. This is reasonable when you consider that if your computer --- the least secure device you own --- is compromised, your attacker is virtually certain to get your email…

Yubico Authenticator is a fork of Google Authenticator and is a drop-in replacement. I have never had any problem helping someone that has used google authenticator set this up. Scan barcode and tap. Also users have a much easier time when they get a new phone. Just tap to new phone and get codes. There is no data to transfer. As for people getting locked out, that is what the printable backup codes are for, or a sec…

That's a desktop TOTP application. Now not only do they have to have their computer with them to log into their Google account from their phone, but they have to have 2 security keys on the account to remove their phone number from it, and all their backups are physically separated from them, so unless they bring their backup codes with them when they travel, if they lose their key, they're boned.

And all this for what real additional security?

If you want to nerd out and get your security key to do pet tricks like handling your TOTP secrets, I do not have a problem with that. But please don't tell ordinary users they're wrong when they don't do that.

Re: Adding a security key to Gmail

#85

Post by lrvick » Thu, Apr 13, 2017, 1:47 PM UTC

sametmax wrote: post #70

lrvick wrote: post #42

I would advise against Google Authenticator as a backup as it really defeats the point of a hardware token. Google Authenticator stores the TOTP secret in plaintext on your device where the potential exists for it to be stolen. An adversary that exploits your phone can generate TOTP tokens as they like and ignore the fact you have a hardware token. If you are going to use Google Authenticator it is your weakest link…

It's not as good as having a hardware key, but they still need your username and password and pwn your phone. That's a lot of trouble. So for most people, TOTP software is good enough security.

I agree mobile app 2FA it is probably good enough for most people. This article however is about using a hardware token for login.

If you have a need for hardware tokens, use them end to end. Using a hardware token and having a less secure backup method means you are only as secure as that less secure backup method.

Re: Adding a security key to Gmail

#86

Post by kasey_junk » Thu, Apr 13, 2017, 1:48 PM UTC

tptacek wrote: post #78

lrvick wrote: post #54

Earlier quoted context omitted.

Well the scenario we are wanting to defend against is an attacker that can remotely (or even locally) exploit/root the phone (see long list of vulns for ios and android that have allowed exactly this). How many of these still exist not yet patched? Depending on who you work for, someone might just burn a 0-day on you. It all depends on your threat profile. Putting the secret in a hardware token gives you easy to reas…

No, that's a scenario you want to defend against, and I'll remind you again that if you're dealing with attackers that can exploit your computing devices directly, the tokens are pretty much cosmetic. If you have an insecure phone and you actually use it like a smartphone, you're boned no matter how many security tokens you've got attached to your key ring. When we work with lawyers, reporters, and NGOs, what we find…

I think the other part of this is that for these people (and probably most people) losing access to your gmail account is a catastrophic event.

That access can be lost because of an attack or by losing the keys. The former is actually much less likely than the latter so mitigating in favor of it instead doesn't make sense in this threat model.

Re: Adding a security key to Gmail

#87

Post by tptacek » Thu, Apr 13, 2017, 1:49 PM UTC

lrvick wrote: post #85

sametmax wrote: post #70

Earlier quoted context omitted.

It's not as good as having a hardware key, but they still need your username and password and pwn your phone. That's a lot of trouble. So for most people, TOTP software is good enough security.

I agree mobile app 2FA it is probably good enough for most people. This article however is about using a hardware token for login. If you have a need for hardware tokens, use them end to end. Using a hardware token and having a less secure backup method means you are only as secure as that less secure backup method.

That simply isn't true, because the hardware token defends against phishing attacks --- in fact, that is the entire reason why U2F tokens exist in the first place. It's literally the motivating use case for the standard: experts with code generators were still getting phished.

So, when you have the token handy, you use it, and you're not exposed to phishing. When you don't, you use the mobile app, and you're exposed to phishing (but not to weak passwords and breaches in sites). It's not complicated, unless you think the token does more than it really does for your overall security.

Re: Adding a security key to Gmail

#88

Post by michaelt » Thu, Apr 13, 2017, 1:51 PM UTC

tptacek wrote: post #60

lrvick wrote: post #42

I would advise against Google Authenticator as a backup as it really defeats the point of a hardware token. Google Authenticator stores the TOTP secret in plaintext on your device where the potential exists for it to be stolen. An adversary that exploits your phone can generate TOTP tokens as they like and ignore the fact you have a hardware token. If you are going to use Google Authenticator it is your weakest link…

The attacker who gets access to the filesystem of your phone can almost certainly defeat any "encryption" a TOTP authenticator would use to protect secrets, so the premise of phone-based authenticators is that your phone isn't going to get compromised. This is reasonable when you consider that if your computer --- the least secure device you own --- is compromised, your attacker is virtually certain to get your email…

  The attacker who gets access to the filesystem of your
  phone can almost certainly defeat any "encryption" a TOTP
  authenticator would use to protect secrets

Is Android's hardware-backed keystore no good? The documentation makes it sound like keys can't be extracted or used without user authentication.

Re: Adding a security key to Gmail

#89

Post by tptacek » Thu, Apr 13, 2017, 1:52 PM UTC

michaelt wrote: post #88

tptacek wrote: post #60

Earlier quoted context omitted.

The attacker who gets access to the filesystem of your phone can almost certainly defeat any "encryption" a TOTP authenticator would use to protect secrets, so the premise of phone-based authenticators is that your phone isn't going to get compromised. This is reasonable when you consider that if your computer --- the least secure device you own --- is compromised, your attacker is virtually certain to get your email…

The attacker who gets access to the filesystem of your phone can almost certainly defeat any "encryption" a TOTP authenticator would use to protect secrets Is Android's hardware-backed keystore no good? The documentation makes it sound like keys can't be extracted or used without user authentication.

It doesn't matter how good it is, because once the application is used, the (now-resident) attacker gets the (now-unlocked) secrets.

Re: Adding a security key to Gmail

#90

Post by dsacco » Thu, Apr 13, 2017, 1:52 PM UTC

lrvick wrote: post #82

tptacek wrote: post #60

Earlier quoted context omitted.

The attacker who gets access to the filesystem of your phone can almost certainly defeat any "encryption" a TOTP authenticator would use to protect secrets, so the premise of phone-based authenticators is that your phone isn't going to get compromised. This is reasonable when you consider that if your computer --- the least secure device you own --- is compromised, your attacker is virtually certain to get your email…

Yubico Authenticator is a fork of Google Authenticator and is a drop-in replacement. I have never had any problem helping someone that has used google authenticator set this up. Scan barcode and tap. Also users have a much easier time when they get a new phone. Just tap to new phone and get codes. There is no data to transfer. As for people getting locked out, that is what the printable backup codes are for, or a sec…

Yes but you didn't address the main rebuttal, which is that encrypting or not encrypting the TOTP store is a red herring. If someone has access to the filesystem they can likely walk around the issue of encryption, just as they would on a desktop computer. And if they control execution, encrypting the data becomes utterly moot (and I'd argue most cases of someone gaining filesystem access where the individual cares enough to have 2fa are going to be a jailbroken device, which results in complete debugging and reversing capability, which makes this redundant).

This is not the thing to optimize for. Yes, optimize for ease of use, because take PGP as an example of great security vs horrid usability and look where that's got us. If you do the security improvement analysis from a cost/benefit perspective, you do not win by using a hardware key over regular 2fa apps. Users will shoot themselves in the foot, or simply not use it.