Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Adding a security key to Gmail

techsolidarity.org

Post reply on HN
Print view View original

101–110 of 126 posts

Re: Adding a security key to Gmail

#101

Post by tptacek »

lrvick wrote: post #99
tptacek wrote: post #87

Earlier quoted context omitted.

That simply isn't true, because the hardware token defends against phishing attacks --- in fact, that is the entire reason why U2F tokens exist in the first place. It's literally the motivating use case for the standard: experts with code generators were still getting phished. So, when you have the token handy, you use it, and you're not exposed to phishing. When you don't, you use the mobile app, and you're exposed…

I will grant you the phishing use case, and that one is relevant to average users. I admit I mostly work with infra folks that would not easily be phished, but might have one of their devices compromised unknowingly rendering phishing moot. TOTP is a mess in regard to phishing but if we have tools to avoid some of the problems while we are stuck with it, I feel they are worth mentioning. Particularly for people savvy…

U2F happened because Google developers were being phished. We are all phishable, probably especially those among us who believe we're not.

Re: Adding a security key to Gmail

#102

Post by lrvick »

dsacco wrote: post #96
lrvick wrote: post #91

Earlier quoted context omitted.

I have Yubico Authenticator installed on my phone and my desktops/laptops. The android app is a direct fork of google authenticator and has nearly identical UX. I tap/plug my key to either of them to get a token. If you want to make the argument TOTP via hardware token is overkill for most users, that is totally fair. On that note though, there is no point in having hardware token via U2F. Security is ahout the weake…

I disagree with regards to your risk analysis. Your cost/benefit considerations prioritize relatively miniscule security improvements without considering usability costs or diminishing returns. While we're at it, why don't we just use one-time pads? After all, those are impervious to any form of cryptanalysis. The risk profile for most users does not require a hardware-based auth factor if it results in real world us…

I am only focusing on this bit because it is a few extra seconds of work if you are going to have a hardware token anyway. Why expose your TOTP secret if you don't have to?

I like knowing that if the phones and laptops of someone on my team were compromised, we have some damage control.

With the approach Yubico Authenticator takes an attacker with remote access to your Android Phone and a keylogger on your laptop still can't log in as you remotely.

Granted with more effort that combo can burn you in other ways, but TOTP on a hardware token still gives you some very real reduction in attack surface with no real added user burden. Why not?

Re: Adding a security key to Gmail

#103

Post by tptacek »

lrvick wrote: post #102
dsacco wrote: post #96

Earlier quoted context omitted.

I disagree with regards to your risk analysis. Your cost/benefit considerations prioritize relatively miniscule security improvements without considering usability costs or diminishing returns. While we're at it, why don't we just use one-time pads? After all, those are impervious to any form of cryptanalysis. The risk profile for most users does not require a hardware-based auth factor if it results in real world us…

I am only focusing on this bit because it is a few extra seconds of work if you are going to have a hardware token anyway. Why expose your TOTP secret if you don't have to? I like knowing that if the phones and laptops of someone on my team were compromised, we have some damage control. With the approach Yubico Authenticator takes an attacker with remote access to your Android Phone and a keylogger on your laptop sti…

Three people have answered that for you, and you keep ignoring them. We're protecting Google accounts, not TOTP secrets. We all understand that you can keep a TOTP secret more secure than a Google account. But since nobody cares about the security of a TOTP secret for a compromised Google account, I'm not sure why we're still talking about this.

Re: Adding a security key to Gmail

#104

Post by lrvick »

tptacek wrote: post #97
lrvick wrote: post #95

Earlier quoted context omitted.

I guess I didn't understnd that bit. It sounds like there is som mistunderstanding about how Yubico authenticator works? It does not store the secrets on the disk/memory of the phone/laptop at all. It just sends over a code. The device only sees one code and nothing else. This is also why a user can get a new phone and and just tap the key to the new phone and truck on. Magic. When a user drops their Google Authentic…

No, I'm pretty clear about how Yubikey TOTP works. The point is that the threat model doesn't make sense. Any device you can use Yubikey TOTP on is significantly less secure than your iPhone. Yes, I'm clear that the attacker in this scenario doesn't get your TOTP secrets. If your primary goal is to protect your TOTP secret, I see your point. My problem is, my goal is to protect my actual account . I kind of don't giv…

Cookie theft is for sure a real issue. In the case of Google, if your cookie suddenly pops up in another country, it will often be quickly terminated.

Not all services do this, and Google does no do it all the time either.

Still, I see no reason not to take the super easy low-hanging fruit to reduce attack surface when you can.

Re: Adding a security key to Gmail

#105

Post by tptacek »

lrvick wrote: post #104
tptacek wrote: post #97

Earlier quoted context omitted.

No, I'm pretty clear about how Yubikey TOTP works. The point is that the threat model doesn't make sense. Any device you can use Yubikey TOTP on is significantly less secure than your iPhone. Yes, I'm clear that the attacker in this scenario doesn't get your TOTP secrets. If your primary goal is to protect your TOTP secret, I see your point. My problem is, my goal is to protect my actual account . I kind of don't giv…

Cookie theft is for sure a real issue. In the case of Google, if your cookie suddenly pops up in another country, it will often be quickly terminated. Not all services do this, and Google does no do it all the time either. Still, I see no reason not to take the super easy low-hanging fruit to reduce attack surface when you can.

Don't be evasive. It doesn't matter how you secure the channel, with cookies or magic beans: if the attacker controls the device you're using Google Mail from, they've compromised the account. What's the point of having a super secure key to a house with a wide-open hole in the side of it? There is no point, is the answer.

Re: Adding a security key to Gmail

#106

Post by lrvick »

dsacco wrote: post #100
lrvick wrote: post #95

Earlier quoted context omitted.

I guess I didn't understnd that bit. It sounds like there is som mistunderstanding about how Yubico authenticator works? It does not store the secrets on the disk/memory of the phone/laptop at all. It just sends over a code. The device only sees one code and nothing else. This is also why a user can get a new phone and and just tap the key to the new phone and truck on. Magic. When a user drops their Google Authentic…

No, I understand that. Let me simplify my point: Whether or not the TOTP secret is on the smartphone, encrypted or not, or sent to it from another device, is the wrong attack vector to optimize for. Getting mainstream users en masse to consistently and correctly use any 2fa is a win. Furthermore, you're moving the goalposts a bit by using the Yubikey in this scenario. So sure, if someone compromises your phone they d…

The device keeps the secret in self contained memory and never exposes it. It is on the other side of a USB bus or in some cases NFC. There have been local attacks against old designs via side channel attacks etc, but never once a remote attack. The model makes that pretty hard. The phone is essentially zero knowledge. Android and iOS allow arbitrary execution of user installed code and are a massive attack surface and have piles of pubished vulnerabilities.

By moving secrets to very simple easy to reason about devices we get substantial reduction in attack surface.

Also I have helped deploy these to several dozen people, taught workshops etc. It is no harder than teaching people to use Google Authenticator, but lower attack surface.

Use U2F where you can and when you must fall back to TOTP at least you can promise an attacker does not get a free pass to genreate codes whenever they want which is something.

Re: Adding a security key to Gmail

#107

Post by lrvick »

lrvick wrote: post #104
tptacek wrote: post #97

Earlier quoted context omitted.

No, I'm pretty clear about how Yubikey TOTP works. The point is that the threat model doesn't make sense. Any device you can use Yubikey TOTP on is significantly less secure than your iPhone. Yes, I'm clear that the attacker in this scenario doesn't get your TOTP secrets. If your primary goal is to protect your TOTP secret, I see your point. My problem is, my goal is to protect my actual account . I kind of don't giv…

Cookie theft is for sure a real issue. In the case of Google, if your cookie suddenly pops up in another country, it will often be quickly terminated. Not all services do this, and Google does no do it all the time either. Still, I see no reason not to take the super easy low-hanging fruit to reduce attack surface when you can.

They may of compromised gmail, because gmail is logged in. They however won't get to the other 20 services that I have not recently logged into recently on the device that also use hardware tokens. They don't get the totp secret for my AWS account which I only log into from that device in emrgencies. Etc.

If someone gets remote access to your device it is a very bad day, but you -can- have damage control and a clear picture of what they had access to and what they did not.

If the attacker roots your phone and it has your unlocked password manager on it and google authenticator with all the 2fa secrets... well now they get the entire farm, including for services you don't have active cookies for.

Hardware tokens are not magic, but they are a very useful tool and if we combine enough tools we make the life of an attacker that much harder.

Re: Adding a security key to Gmail

#108

Post by lighttower »

lrvick wrote: post #44
kasey_junk wrote: post #43

Earlier quoted context omitted.

If only there were a similar guide to getting gpg agent working with the yubikey stored gpg keys and ssh. I've done it, but for the life of my I couldn't tell you how as it was mostly just trying magic incantations of things until it started working.

Here you go: Simple GPG setup: https://github.com/lrvick/security-token-docs/blob/master/Us... Advanced GPG setup with backups: https://github.com/lrvick/security-token-docs/blob/master/Us... SSH Setup: https://github.com/lrvick/security-token-docs/blob/master/Us... I also will be adding an alternate "quick ssh setup" guide via PKCS#11 flows to just store an existing ssh private key. Still I think GPG is the way to g…

Yubikey documentation for setting up ssh gpg and system login is ... Well, I couldn't find it when I looked circa 18 months ago. Thank you for this.

Re: Adding a security key to Gmail

#109

Post by lrvick »

tptacek wrote: post #75
lrvick wrote: post #44

Earlier quoted context omitted.

Here you go: Simple GPG setup: https://github.com/lrvick/security-token-docs/blob/master/Us... Advanced GPG setup with backups: https://github.com/lrvick/security-token-docs/blob/master/Us... SSH Setup: https://github.com/lrvick/security-token-docs/blob/master/Us... I also will be adding an alternate "quick ssh setup" guide via PKCS#11 flows to just store an existing ssh private key. Still I think GPG is the way to g…

"You should disable any other keys that aren't backed by a security token" ... why? You don't need a security token to physically secure a backup key; just put it on a USB drive and stick it in a safe (or a sock drawer). Security tokens are a nice little bonus for security, and they're a major corrective for the kinds of real-world attacks that screw real people over, like phishing (and dumb passwords). But they're p…

It means a lot because I have to physically touch the device every single time I ssh.

I can even do agent fowarding taboos and know an attacker can't go creating new connections on that agent without a physical action from me each and every time.

Compare this to how ssh keys are normally used. You use it once, type in a keyloggable passphrase, and the key is unpacked plaintext into system memory for, in most cases, the rest of the time the system is booted.

You could invalidate the passphrase after every connection but this puts an unreasonable amount of work on the developer.

Simply tapping once for each connection and having no way for an attacker to avoid that is a great middle ground, imo. Particularly for high level production keys.

Re: Adding a security key to Gmail

#110

Post by lrvick »

tptacek wrote: post #76
ptha wrote: post #72

Earlier quoted context omitted.

I use Authy: https://www.authy.com/ Now I'm wondering are there similar security concerns here as with Google Authenticator?

Yes. But those concerns don't really matter. Just use whatever TOTP application you're most comfortable with, and, because even experts can be phished, try to use the security key as much as you can.

You can only use U2F for what, github and google? I am a big fan, but the 30 other services I need to access to do my job use TOTP.

We need all the help we can get on that until TOTP is finally phased out.

Post reply on HN