Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Adding a security key to Gmail

techsolidarity.org

Post reply on HN
Print view View original

111–120 of 126 posts

Re: Adding a security key to Gmail

#111

Post by tptacek »

lrvick wrote: post #109
tptacek wrote: post #75

Earlier quoted context omitted.

"You should disable any other keys that aren't backed by a security token" ... why? You don't need a security token to physically secure a backup key; just put it on a USB drive and stick it in a safe (or a sock drawer). Security tokens are a nice little bonus for security, and they're a major corrective for the kinds of real-world attacks that screw real people over, like phishing (and dumb passwords). But they're p…

It means a lot because I have to physically touch the device every single time I ssh. I can even do agent fowarding taboos and know an attacker can't go creating new connections on that agent without a physical action from me each and every time. Compare this to how ssh keys are normally used. You use it once, type in a keyloggable passphrase, and the key is unpacked plaintext into system memory for, in most cases, t…

You're making a comparison to an example I didn't cite. I'm not saying that you should have software-only SSH keys on your computer alongside your Y4 SSH pubkey.

Re: Adding a security key to Gmail

#112

Post by lrvick »

tptacek wrote: post #111
lrvick wrote: post #109

Earlier quoted context omitted.

It means a lot because I have to physically touch the device every single time I ssh. I can even do agent fowarding taboos and know an attacker can't go creating new connections on that agent without a physical action from me each and every time. Compare this to how ssh keys are normally used. You use it once, type in a keyloggable passphrase, and the key is unpacked plaintext into system memory for, in most cases, t…

You're making a comparison to an example I didn't cite. I'm not saying that you should have software-only SSH keys on your computer alongside your Y4 SSH pubkey.

I was mostly responding to: "But they're pretty marginal against the kinds of attackers who will target SSH keys."

I am arguing it is not all that marginal. If the only non 0-day way into production is via ssh to a bastion host with a touch-based hardware token then their lives are more than marginally harder than an on-disk key.

Re: Adding a security key to Gmail

#113

Post by avenoir »

idlewords wrote: post #4
samdk wrote: post #3

Thanks for writing this! One nitpick: the guide says "If you're curious why it's important to not have a phone number on your account, see the security key FAQ", but the linked security FAQ doesn't actually appear to say why it's important.

Sorry about that, I'm updating that FAQ next. The answer is that SMS is not a secure second factor (it's easy to hijack and eavesdrop on), and in some cases when you give a service a phone number, it becomes possible to take over the account with just control of the phone number.

There was an article floating around on HN a while ago about someone basically stating that an attacker was able to call their cellphone provider and use social engineering tactics to transfer their account to their own number. Ultimately circumventing second factor auth via SMS and gaining access to their Google account. I believe it was from an actual Google employee. So they were able to recover the account quickly.

Re: Adding a security key to Gmail

#114

Post by lrvick »

tptacek wrote: post #92
lrvick wrote: post #50

Earlier quoted context omitted.

Any device that generates TOTP tokens needs the secret key available by design. Your could read the source code or spec sheets but an easy way to prove this by backing up Google Authenticator via Titanium Backup and restoring it to a new device. Now both devices generate the same codes. There have been plenty of iOS exploits as well as Android and everything else. Phones have a lot of attack surface and are not a rea…

For virtually all users, their iPhone is in fact the most secure computing device they own. It's meaningfully more secure than a computer running a desktop operating system. If we're talking about protecting applications running on a desktop OS, the idea of keeping things off the phone because "phones have exploits" is pretty silly; in that threat model, the desktop is also owned up, and with it the email account ---…

Yes the desktop is just as bad as the phone. This is why I don't alow any of those devices have secrets that could be used without me being physically present to access data of users I am responsible for, or my own.

You are coming at this from a threat profile of joe individual user. Okay, point taken.

I am talking about the perspective of trying to take every reasonable step to reamin secure while being targeted by skilled adversaries who have a lot to gain if they succeed. It is not that much extra work to reduce attack surface so much further than TOTP-generator-on-a-phone offers, so why not teach anyone best practices that will listen?

Say I have 30+ TOTP secrets in my mobile phone app, and also my password manager. Everyting from Gmail to my AWS root account.

If the TOTP secrets are on my phone and an attacker compromises my phone... they get -everything-. If I am using a hardware token for TOTP and I quickly expire the sessions of all really important things I don't log into often, like AWS... then an attacker only gets a slice of the farm instead of the whole thing.

What this buys is us is damage control and a much clearer picture of what an attacker could of accessed, and what they probably could not of because no cookies or secrets were available to memory or disk at that time. I can assert -maybe- this one token was phished, but that none of the others were at risk.

If the attacker is on a phone with Google Authenticator, they an just generate all the codes they want for every service. We lose the whole farm.

Re: Adding a security key to Gmail

#115

Post by tptacek »

lrvick wrote: post #114
tptacek wrote: post #92

Earlier quoted context omitted.

For virtually all users, their iPhone is in fact the most secure computing device they own. It's meaningfully more secure than a computer running a desktop operating system. If we're talking about protecting applications running on a desktop OS, the idea of keeping things off the phone because "phones have exploits" is pretty silly; in that threat model, the desktop is also owned up, and with it the email account ---…

Yes the desktop is just as bad as the phone. This is why I don't alow any of those devices have secrets that could be used without me being physically present to access data of users I am responsible for, or my own. You are coming at this from a threat profile of joe individual user. Okay, point taken. I am talking about the perspective of trying to take every reasonable step to reamin secure while being targeted by…

You keep doing this. I didn't say "desktops are as bad as phones". I said "phones are far better than desktops".

I promise you, my security requirements are as stringent as yours are. My 2FA stack is Hardware U2F, Software TOTP, and physically secured backup codes. That's what I recommend. You keep suggesting that this stack is inferior to yours, and I keep explaining why it isn't and why the threat model suggesting to you that it is is incoherent.

Re: Adding a security key to Gmail

#116

Post by msh »

tptacek wrote: post #60
lrvick wrote: post #42

I would advise against Google Authenticator as a backup as it really defeats the point of a hardware token. Google Authenticator stores the TOTP secret in plaintext on your device where the potential exists for it to be stolen. An adversary that exploits your phone can generate TOTP tokens as they like and ignore the fact you have a hardware token. If you are going to use Google Authenticator it is your weakest link…

The attacker who gets access to the filesystem of your phone can almost certainly defeat any "encryption" a TOTP authenticator would use to protect secrets, so the premise of phone-based authenticators is that your phone isn't going to get compromised. This is reasonable when you consider that if your computer --- the least secure device you own --- is compromised, your attacker is virtually certain to get your email…

Who are the we in your post?

Re: Adding a security key to Gmail

#117

Post by lrvick »

tptacek wrote: post #115
lrvick wrote: post #114

Earlier quoted context omitted.

Yes the desktop is just as bad as the phone. This is why I don't alow any of those devices have secrets that could be used without me being physically present to access data of users I am responsible for, or my own. You are coming at this from a threat profile of joe individual user. Okay, point taken. I am talking about the perspective of trying to take every reasonable step to reamin secure while being targeted by…

You keep doing this. I didn't say "desktops are as bad as phones". I said "phones are far better than desktops". I promise you, my security requirements are as stringent as yours are. My 2FA stack is Hardware U2F, Software TOTP, and physically secured backup codes. That's what I recommend. You keep suggesting that this stack is inferior to yours, and I keep explaining why it isn't and why the threat model suggesting…

You didn't address my primary point.

Say we each have TOTP for say 20 accounts and our password managers on our phones with the credentials for them as well. We are system administrators with access to piles of PII. Account password resets require 2FA so email alone is not enough to spider to other accounts.

Both our phones have been rooted and are accessible by a remote attacker because some "coworker" sent us a new beta app that was in fact malware.

In both cases the attacker has all our passwords to all apps via our password managers. That is lost.

We each are logged into 5 of these services and the attacker steals the cookies. Those are lost.

Now what about the remaining 15 services we are not logged into? Things we don't log into super often but some of which ar quite important like AWS root credentials.

In your case, the attacker goes and opens the Google Authenticator sqlite database and gets every TOTP secret you have in plain text. You just lost all 15 remaining accounts.

In my case those secrets exist on a hardware token and can't be accessed at all. If I catch my intruder at this point I can be reasonably sure those remaining accounts were not impacted.

Hopefully this clarifies the wider model I am working from.

Re: Adding a security key to Gmail

#118

Post by orbitingpluto »

idlewords wrote: post #98
dsacco wrote: post #96

Earlier quoted context omitted.

I disagree with regards to your risk analysis. Your cost/benefit considerations prioritize relatively miniscule security improvements without considering usability costs or diminishing returns. While we're at it, why don't we just use one-time pads? After all, those are impervious to any form of cryptanalysis. The risk profile for most users does not require a hardware-based auth factor if it results in real world us…

"if that risk if on the table, all of this work is essentially meaningless anyway" I can't agree with this strongly enough. If someone's willing and able to hack your iPhone, then you need more help than a random art major writing a yubikey howto can give you.

Just an offshoot thought, but some random art major writing one of these guides giving a bird's eye overview of the entire process is something most businesses should be able to do themselves. But they don't.

Re: Adding a security key to Gmail

#119

Post by puddintane »

msh wrote: post #116
tptacek wrote: post #60

Earlier quoted context omitted.

The attacker who gets access to the filesystem of your phone can almost certainly defeat any "encryption" a TOTP authenticator would use to protect secrets, so the premise of phone-based authenticators is that your phone isn't going to get compromised. This is reasonable when you consider that if your computer --- the least secure device you own --- is compromised, your attacker is virtually certain to get your email…

Who are the we in your post?

Clicking on his name [1] you can see he works at Latacora now [1]. Hopefully that helps answer your question

[1] https://news.ycombinator.com/user?id=tptacek [2] https://latacora.com/

Re: Adding a security key to Gmail

#120

Post by wfunction »

barking wrote: post #80
wfunction wrote: post #28

Earlier quoted context omitted.

Encrypt + add PIN + disable SMS/Phone authentication? Is this insufficient?

Thanks but I don't know if it is or not. The steps you mention apart from the last are all to do with protection in case a phone is stolen. I suppose what really concerns me is someone hacking my phone through some kind of malware. If Android is as insecure as some say it is, then is it risky to log in to gmail on any android device ever? What about the Google Pixel range of phones? How do they compare to the iphone.…

I'm not sure how you can protect against malware aside from not visiting sketchy sites or downloading shady apps. Pretty much by definition they use security holes, which if people were aware of wouldn't exist in the first place. Only attack vector I can think of is some kind of SMS attack, to which the "solution" would be to disable SMS, if you're really worried about that. Personally I'm not.
Post reply on HN