51–60 of 144 posts
I don't know how I feel about making a device so endlessly hackable a "security key".
All Android devices certified by Google will have a hardware security module which should keep the keys secure. Some cheap non-certified devices (mostly Chinese) might not have hardware backed keystores, but I doubt those devices would be able to run this Google app.
Is there any way to get this working in Firefox? :(
As an aside, I'm not sure that I want random JavaScript to be able to do Bluetooth stuff. At the least, I'd want the ability to limit it on a per-website basis.
> Your Android Phone Is a Security Key no it's not. it's pretending to be, but without vendors actually maintaining and investing in their forks and the hardware having a known good security enclave, you might as well post your credentials on twitter.
Without a security enclave (which devices are starting to include) I don't see how this is an improvement.
I don't know how I feel about making a device so endlessly hackable a "security key".
All Android devices certified by Google will have a hardware security module which should keep the keys secure. Some cheap non-certified devices (mostly Chinese) might not have hardware backed keystores, but I doubt those devices would be able to run this Google app.
As Android 7.0 is available to install on any device and I don't see anything about "certified android devices", I assume they mean ANY Android 7.0 device? Then again it only works with Google services atm, but I know you can sideload google play services so...
Most security keys don’t have app stores full of malware.
A read-only, non-wireless security key like Yubikey would be even more secure, but this is an improvement over TOTP codes, which can be phished.
This is also better than SMS 2FA, which is prone to phone-number theft.
It's also better than Push notifications for 2FA, which relay on third-party servers.
This solution uses Bluetooth between your phone and the Chrome browser, offering a good balance of security and convenience.
Earlier quoted context omitted.
I'd argue using Authenticator is better than simply not using 2FA. Which is probably the choice for a lot of people for whom always carrying some dedicated hardware device is not really a realistic option.
In what way is carrying a dedicated device not realistic? My second factor lives on my keyring and is only a bit larger than a typical door key. Everyone carries keys.
TOTP for GMail assures Google that the same person who enrolled the account was given custody of a key.
The physical token only adds value in scenarios where phones aren’t available or you need to assure the identity of the individual.
> Your Android Phone Is a Security Key no it's not. it's pretending to be, but without vendors actually maintaining and investing in their forks and the hardware having a known good security enclave, you might as well post your credentials on twitter.
Yeah I don't see how this is any different from the standard Google Authenticator style affair. Without a security enclave (which devices are starting to include) I don't see how this is an improvement.
It's the secure enclave and the purpose-built firmware that makes a security key a security key. I'm sure some specific Android devices have a safe implementation, and I'm sure that some SIM cards and perhaps the recent iPhone Secure Elements have properties that allow them to be safely used as a security key, but putting it forward that phones can be seen and used that way in general lacks that important distinction.
Looks like Google has used the open Web Bluetooth specification (that only Chrome currently supports) along with the open FIDO Bluetooth spec ( https://fidoalliance.org/specs/fido-u2f-v1.2-ps-20170411/fid... ). A read-only, non-wireless security key like Yubikey would be even more secure, but this is an improvement over TOTP codes, which can be phished. This is also better than SMS 2FA, which is prone to phone-number…