Adding a security key to Gmail • Hacker News Board

Re: Adding a security key to Gmail

#91

Post by lrvick » Thu, Apr 13, 2017, 1:52 PM UTC

tptacek wrote: post #84

lrvick wrote: post #82

Earlier quoted context omitted.

Yubico Authenticator is a fork of Google Authenticator and is a drop-in replacement. I have never had any problem helping someone that has used google authenticator set this up. Scan barcode and tap. Also users have a much easier time when they get a new phone. Just tap to new phone and get codes. There is no data to transfer. As for people getting locked out, that is what the printable backup codes are for, or a sec…

That's a desktop TOTP application. Now not only do they have to have their computer with them to log into their Google account from their phone, but they have to have 2 security keys on the account to remove their phone number from it, and all their backups are physically separated from them, so unless they bring their backup codes with them when they travel, if they lose their key, they're boned. And all this for wh…

I have Yubico Authenticator installed on my phone and my desktops/laptops.

The android app is a direct fork of google authenticator and has nearly identical UX.

I tap/plug my key to either of them to get a token.

If you want to make the argument TOTP via hardware token is overkill for most users, that is totally fair. On that note though, there is no point in having hardware token via U2F.

Security is ahout the weakest links. All I am saying is anyone going through the trouble to set up U2F as this guide suggests, might as well spend the extra 10 seconds to store their TOTP secret on the key as well, vs exposing it on the phone.

I assume someone that has a hardware token is getting it for a reason: To have assurances an attacker can't log in as them without that token.

Re: Adding a security key to Gmail

#92

Post by tptacek » Thu, Apr 13, 2017, 1:53 PM UTC

lrvick wrote: post #50

rubatuga wrote: post #47

Earlier quoted context omitted.

Do you have a citation for the fact that google authenticator stores the keys in plain text? Furthermore, for the case of google authenticator on an iPhone, any files on the user partition are encrypted anyway, and I know from experience that the google authenticator app does not back up keys to either iCloud or iTunes backup. This should mean you are safe on iOS

Any device that generates TOTP tokens needs the secret key available by design. Your could read the source code or spec sheets but an easy way to prove this by backing up Google Authenticator via Titanium Backup and restoring it to a new device. Now both devices generate the same codes. There have been plenty of iOS exploits as well as Android and everything else. Phones have a lot of attack surface and are not a rea…

For virtually all users, their iPhone is in fact the most secure computing device they own. It's meaningfully more secure than a computer running a desktop operating system. If we're talking about protecting applications running on a desktop OS, the idea of keeping things off the phone because "phones have exploits" is pretty silly; in that threat model, the desktop is also owned up, and with it the email account --- it's now secured solely by a cookie in your Chrome cookie store on your compromised desktop!

The threat modeling here just doesn't make sense.

Re: Adding a security key to Gmail

#93

Post by jeffreyparker » Thu, Apr 13, 2017, 1:54 PM UTC

tokenizerrr wrote: post #36

captn3m0 wrote: post #21

Earlier quoted context omitted.

Also, if you have a rooted device, you can get the original secret from the SQLite database of the authenticator app.

Even without root. Just run a backup and extract it from that. You can do it with just adb or helium.

That doesn't work for Google Authenticator. Apps can opt-out of being able to be backed up, which even prevents adb/helium backups (unless you're rooted).

Re: Adding a security key to Gmail

#94

Post by tptacek » Thu, Apr 13, 2017, 1:55 PM UTC

lrvick wrote: post #91

tptacek wrote: post #84

Earlier quoted context omitted.

That's a desktop TOTP application. Now not only do they have to have their computer with them to log into their Google account from their phone, but they have to have 2 security keys on the account to remove their phone number from it, and all their backups are physically separated from them, so unless they bring their backup codes with them when they travel, if they lose their key, they're boned. And all this for wh…

I have Yubico Authenticator installed on my phone and my desktops/laptops. The android app is a direct fork of google authenticator and has nearly identical UX. I tap/plug my key to either of them to get a token. If you want to make the argument TOTP via hardware token is overkill for most users, that is totally fair. On that note though, there is no point in having hardware token via U2F. Security is ahout the weake…

You keep saying that, and it keeps being false. The point of U2F isn't to put your secrets in super-secure hardware so you can walk around feeling like you have an HSM hanging from your keychain like a bad-ass. The point of U2F is to defeat phishing attacks, which is how people actually get compromised.

It would not be much of a stretch to say that this U2F guide was written deliberately as a corrective to this mindset.

Re: Adding a security key to Gmail

#95

Post by lrvick » Thu, Apr 13, 2017, 1:57 PM UTC

dsacco wrote: post #90

lrvick wrote: post #82

Earlier quoted context omitted.

Yubico Authenticator is a fork of Google Authenticator and is a drop-in replacement. I have never had any problem helping someone that has used google authenticator set this up. Scan barcode and tap. Also users have a much easier time when they get a new phone. Just tap to new phone and get codes. There is no data to transfer. As for people getting locked out, that is what the printable backup codes are for, or a sec…

Yes but you didn't address the main rebuttal, which is that encrypting or not encrypting the TOTP store is a red herring. If someone has access to the filesystem they can likely walk around the issue of encryption, just as they would on a desktop computer. And if they control execution, encrypting the data becomes utterly moot (and I'd argue most cases of someone gaining filesystem access where the individual cares e…

I guess I didn't understnd that bit. It sounds like there is som mistunderstanding about how Yubico authenticator works?

It does not store the secrets on the disk/memory of the phone/laptop at all. It just sends over a code. The device only sees one code and nothing else.

This is also why a user can get a new phone and and just tap the key to the new phone and truck on. Magic.

When a user drops their Google Authenticator phone in the toilet however... bad day.

Re: Adding a security key to Gmail

#96

Post by dsacco » Thu, Apr 13, 2017, 2:01 PM UTC

lrvick wrote: post #91

tptacek wrote: post #84

Earlier quoted context omitted.

That's a desktop TOTP application. Now not only do they have to have their computer with them to log into their Google account from their phone, but they have to have 2 security keys on the account to remove their phone number from it, and all their backups are physically separated from them, so unless they bring their backup codes with them when they travel, if they lose their key, they're boned. And all this for wh…

I have Yubico Authenticator installed on my phone and my desktops/laptops. The android app is a direct fork of google authenticator and has nearly identical UX. I tap/plug my key to either of them to get a token. If you want to make the argument TOTP via hardware token is overkill for most users, that is totally fair. On that note though, there is no point in having hardware token via U2F. Security is ahout the weake…

I disagree with regards to your risk analysis.

Your cost/benefit considerations prioritize relatively miniscule security improvements without considering usability costs or diminishing returns. While we're at it, why don't we just use one-time pads? After all, those are impervious to any form of cryptanalysis.

The risk profile for most users does not require a hardware-based auth factor if it results in real world usability sacrifices that end in either 1) accidental misuse or 2) gradual disuse.

You're optimizing for someone compromising the device, great. But the point is that if that risk if on the table, all of this work is essentially meaningless anyway.

Re: Adding a security key to Gmail

#97

Post by tptacek » Thu, Apr 13, 2017, 2:01 PM UTC

lrvick wrote: post #95

dsacco wrote: post #90

Earlier quoted context omitted.

Yes but you didn't address the main rebuttal, which is that encrypting or not encrypting the TOTP store is a red herring. If someone has access to the filesystem they can likely walk around the issue of encryption, just as they would on a desktop computer. And if they control execution, encrypting the data becomes utterly moot (and I'd argue most cases of someone gaining filesystem access where the individual cares e…

I guess I didn't understnd that bit. It sounds like there is som mistunderstanding about how Yubico authenticator works? It does not store the secrets on the disk/memory of the phone/laptop at all. It just sends over a code. The device only sees one code and nothing else. This is also why a user can get a new phone and and just tap the key to the new phone and truck on. Magic. When a user drops their Google Authentic…

No, I'm pretty clear about how Yubikey TOTP works. The point is that the threat model doesn't make sense. Any device you can use Yubikey TOTP on is significantly less secure than your iPhone.

Yes, I'm clear that the attacker in this scenario doesn't get your TOTP secrets. If your primary goal is to protect your TOTP secret, I see your point. My problem is, my goal is to protect my actual account. I kind of don't give a shit about my TOTP secret, because Google will give me as many new TOTP secrets as I ask it for, but I only have the one account. If the device I'm securely generating a TOTP secret for is compromised, I'm going to feel pretty silly doing a security theater dance with my Yubikey as my attacker steals my cookie and locks me out of my Google account.

Re: Adding a security key to Gmail

#98

Post by idlewords » Thu, Apr 13, 2017, 2:03 PM UTC

dsacco wrote: post #96

lrvick wrote: post #91

Earlier quoted context omitted.

I have Yubico Authenticator installed on my phone and my desktops/laptops. The android app is a direct fork of google authenticator and has nearly identical UX. I tap/plug my key to either of them to get a token. If you want to make the argument TOTP via hardware token is overkill for most users, that is totally fair. On that note though, there is no point in having hardware token via U2F. Security is ahout the weake…

I disagree with regards to your risk analysis. Your cost/benefit considerations prioritize relatively miniscule security improvements without considering usability costs or diminishing returns. While we're at it, why don't we just use one-time pads? After all, those are impervious to any form of cryptanalysis. The risk profile for most users does not require a hardware-based auth factor if it results in real world us…

"if that risk if on the table, all of this work is essentially meaningless anyway"

I can't agree with this strongly enough. If someone's willing and able to hack your iPhone, then you need more help than a random art major writing a yubikey howto can give you.

Re: Adding a security key to Gmail

#99

Post by lrvick » Thu, Apr 13, 2017, 2:04 PM UTC

tptacek wrote: post #87

lrvick wrote: post #85

Earlier quoted context omitted.

I agree mobile app 2FA it is probably good enough for most people. This article however is about using a hardware token for login. If you have a need for hardware tokens, use them end to end. Using a hardware token and having a less secure backup method means you are only as secure as that less secure backup method.

That simply isn't true, because the hardware token defends against phishing attacks --- in fact, that is the entire reason why U2F tokens exist in the first place. It's literally the motivating use case for the standard: experts with code generators were still getting phished. So, when you have the token handy, you use it, and you're not exposed to phishing. When you don't, you use the mobile app, and you're exposed…

I will grant you the phishing use case, and that one is relevant to average users. I admit I mostly work with infra folks that would not easily be phished, but might have one of their devices compromised unknowingly rendering phishing moot.

TOTP is a mess in regard to phishing but if we have tools to avoid some of the problems while we are stuck with it, I feel they are worth mentioning.

Particularly for people savvy enough to purchase hardware tokens for personal use.

Re: Adding a security key to Gmail

#100

Post by dsacco » Thu, Apr 13, 2017, 2:05 PM UTC

lrvick wrote: post #95

dsacco wrote: post #90

Earlier quoted context omitted.

Yes but you didn't address the main rebuttal, which is that encrypting or not encrypting the TOTP store is a red herring. If someone has access to the filesystem they can likely walk around the issue of encryption, just as they would on a desktop computer. And if they control execution, encrypting the data becomes utterly moot (and I'd argue most cases of someone gaining filesystem access where the individual cares e…

I guess I didn't understnd that bit. It sounds like there is som mistunderstanding about how Yubico authenticator works? It does not store the secrets on the disk/memory of the phone/laptop at all. It just sends over a code. The device only sees one code and nothing else. This is also why a user can get a new phone and and just tap the key to the new phone and truck on. Magic. When a user drops their Google Authentic…

No, I understand that.

Let me simplify my point: Whether or not the TOTP secret is on the smartphone, encrypted or not, or sent to it from another device, is the wrong attack vector to optimize for.

Getting mainstream users en masse to consistently and correctly use any 2fa is a win.

Furthermore, you're moving the goalposts a bit by using the Yubikey in this scenario. So sure, if someone compromises your phone they don't compromise the Yubikey, but 1) how certain are you that your Yubikey is safer than a modern iPhone or Android model with the crypto and security engineering that entails and 2) how certain are you that accessing your iPhone's filesystem or execution state does not bypass this whole dance entirely?

For you, the minimal security gains might outweigh the usability costs if you know what you're doing. But a hardware token for most people, as the technology currently stands?