Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Your Android Phone Is a Security Key

blog.google

Post reply on HN
Print view View original

81–90 of 144 posts

Re: Your Android Phone Is a Security Key

#81

Post by munchbunny »

lern_too_spel wrote: post #68
penagwin wrote: post #54

Earlier quoted context omitted.

Not doubting you, but were did you find that information? The only thing I see is "it’s built into devices running Android 7.0+" and I found that on multiple pages. As Android 7.0 is available to install on any device and I don't see anything about "certified android devices", I assume they mean ANY Android 7.0 device? Then again it only works with Google services atm, but I know you can sideload google play services…

Android 7 supports key attestation. https://source.android.com/security/keystore/attestation

That's great, but that doesn't actually guarantee that this new feature requires that the phone is using the hardware security module, just that you'd be able to prove if it it was.

Don't get me wrong, it's still better than TOTP in many ways, but having the actual security coprocessor is a big distinction.

Re: Your Android Phone Is a Security Key

#82

Post by [deleted] »

scarejunba wrote: post #61
ghaff wrote: post #12

Earlier quoted context omitted.

I don't carry my keys when I'm traveling if I'm not driving my own car. So, no, not everyone carries keys. ADDED: I do have other 2FA hardware as well. But I assume I'm not guaranteed to have it with me when I need it.

Ah, you have separate keyrings for your home keys and car keys? I'd say that's not usually the case.

[deleted]

Re: Your Android Phone Is a Security Key

#83

Post by kpU8efre7r »

zimmerfrei wrote: post #65
guelo wrote: post #13

Earlier quoted context omitted.

All Android devices certified by Google will have a hardware security module which should keep the keys secure. Some cheap non-certified devices (mostly Chinese) might not have hardware backed keystores, but I doubt those devices would be able to run this Google app.

>> All Android devices certified by Google will have a hardware security module which should keep the keys secure. Source? I understood that having a HW-backed key store is still entirely optional for the purpose of Android certification. On top of that, I noticed some ambiguity on whether a TEE like ARM TrustZone qualifies as a hardware-grade protection mechanism in the same way a discrete and dedicated crypto proce…

Titan M. They have it built into their Pixel devices much like a tiny mobile TPM.

https://www.blog.google/products/pixel/titan-m-makes-pixel-3...

With that said, I cant find mention of this on the page so it's probably not leveraging this.

Re: Your Android Phone Is a Security Key

#84

Post by guelo »

penagwin wrote: post #54
guelo wrote: post #13

Earlier quoted context omitted.

All Android devices certified by Google will have a hardware security module which should keep the keys secure. Some cheap non-certified devices (mostly Chinese) might not have hardware backed keystores, but I doubt those devices would be able to run this Google app.

Not doubting you, but were did you find that information? The only thing I see is "it’s built into devices running Android 7.0+" and I found that on multiple pages. As Android 7.0 is available to install on any device and I don't see anything about "certified android devices", I assume they mean ANY Android 7.0 device? Then again it only works with Google services atm, but I know you can sideload google play services…

I just said I doubt it, I don't actually know. The combination of the Google web service and the android keystore api probably makes it at least difficult. But if you're running some custom compiled aosp code maybe it could be hacked.

Re: Your Android Phone Is a Security Key

#85

Post by guelo »

zimmerfrei wrote: post #65
guelo wrote: post #13

Earlier quoted context omitted.

All Android devices certified by Google will have a hardware security module which should keep the keys secure. Some cheap non-certified devices (mostly Chinese) might not have hardware backed keystores, but I doubt those devices would be able to run this Google app.

>> All Android devices certified by Google will have a hardware security module which should keep the keys secure. Source? I understood that having a HW-backed key store is still entirely optional for the purpose of Android certification. On top of that, I noticed some ambiguity on whether a TEE like ARM TrustZone qualifies as a hardware-grade protection mechanism in the same way a discrete and dedicated crypto proce…

Here's the CTS for Android 7.0 https://source.android.com/compatibility/7.0/android-7.0-cdd...

"When the device implementation supports a secure lock screen it MUST back up the keystore implementation with secure hardware and meet following requirements: MUST have hardware backed implementations of RSA, AES, ECDSA and HMAC cryptographic algorithms and MD5, SHA1, SHA-2 Family hash functions to properly support the Android Keystore system's supported algorithms. MUST perform the lock screen authentication in the secure hardware and only when successful allow the authentication-bound keys to be used. The upstream Android Open Source Project provides the Gatekeeper Hardware Abstraction Layer (HAL) that can be used to satisfy this requirement. "

Re: Your Android Phone Is a Security Key

#86

Post by phyzome »

NikolaNovak wrote: post #35
ksec wrote: post #30

Off topic: This is the state of web we are in, and this is coming from Google. [1] I have literally 20% of the screen displaying useful information. The others are all useless navigation or related crap. Just seeing it nearly got me to puke. It is one those problem in general where the web page is responsive and mobile first. [1] https://ibb.co/fCfmW6h

I fully 101% agree with you in principle, but in this particular case my experience is wildly different. As soon as I scrolled, the navigation got out of the way, and all I have is text - with author's decision to keep large wide white margins. (Vanilla Chrome on Windows - no extensions/plugins/blockers, no reader mode, etc) https://imgur.com/5DOqvj1

What happens when you scroll up a tiny amount? Do the floating dickbars come back?

In my case, I didn't opt in to running the site's javascript... so there were no floating bars. :-)

Re: Your Android Phone Is a Security Key

#89

Post by wavefunction »

This is great other than the fact Google is involved. Now I will admit it's unlikely (effectively impossible) that this would come to Android without Google being involved but I am not interested in adding Google to more of my life. I'm looking to cut them out more and more wherever I can.

Re: Your Android Phone Is a Security Key

#90

Post by christiaanbrand »

guelo wrote: post #84
penagwin wrote: post #54

Earlier quoted context omitted.

Not doubting you, but were did you find that information? The only thing I see is "it’s built into devices running Android 7.0+" and I found that on multiple pages. As Android 7.0 is available to install on any device and I don't see anything about "certified android devices", I assume they mean ANY Android 7.0 device? Then again it only works with Google services atm, but I know you can sideload google play services…

I just said I doubt it, I don't actually know. The combination of the Google web service and the android keystore api probably makes it at least difficult. But if you're running some custom compiled aosp code maybe it could be hacked.

1. This functionality only works on Android devices having passed CDD (try it). 2. Titan M is leveraged on Pixel 3.
Post reply on HN