11–20 of 144 posts
My phone already prompts me when I login to a google account on another device. Is this new / different?
Of course their motivation as normal may be to have users have their wifi/bluetooth on all the time so they can reliably collect more location data.
Earlier quoted context omitted.
I'd argue using Authenticator is better than simply not using 2FA. Which is probably the choice for a lot of people for whom always carrying some dedicated hardware device is not really a realistic option.
In what way is carrying a dedicated device not realistic? My second factor lives on my keyring and is only a bit larger than a typical door key. Everyone carries keys.
ADDED: I do have other 2FA hardware as well. But I assume I'm not guaranteed to have it with me when I need it.
I don't know how I feel about making a device so endlessly hackable a "security key".
My phone already prompts me when I login to a google account on another device. Is this new / different?
So the access key the client logging in passes to the server is from the local device you trust.
Earlier quoted context omitted.
I'd argue using Authenticator is better than simply not using 2FA. Which is probably the choice for a lot of people for whom always carrying some dedicated hardware device is not really a realistic option.
In what way is carrying a dedicated device not realistic? My second factor lives on my keyring and is only a bit larger than a typical door key. Everyone carries keys.
For most people, it's so far outside what they're familiar with that it feels alien and incomprehensible. It makes absolutely no sense to them. So they're not going to do it or adopt it quickly.
User education will catch up in time, but that will take quite a long time.
My phone already prompts me when I login to a google account on another device. Is this new / different?
I think the difference is that the prompt you describe still travels over the wire to get to your device, while this new thing used Bluetooth based on FIDO standards. So the access key the client logging in passes to the server is from the local device you trust.
Sometimes google's announcements really make it hard to understand their products when there is overlap or similarities or what.
But, apart from that: 1. It's only on Chrome (for now(?)) 2. It's only for Google products (for now (?)) 3. It's only on Android that Google fully controls remotely (and probably it will stay there).
All these give even more power to Google at the expense of convenience and allows a single company to define "how things should be done".
And I should clarify that I am not against this tech specifically. If anything, I think Google has some of the brightest minds, so technically I'm sure that the product will be great.
The problem is that with great power comes something that Google (as a company) seems to be lacking lately.