Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Your Android Phone Is a Security Key

blog.google

Post reply on HN
Print view View original

91–100 of 144 posts

Re: Your Android Phone Is a Security Key

#91

Post by christiaanbrand »

penagwin wrote: post #53
oneplane wrote: post #34

> Your Android Phone Is a Security Key no it's not. it's pretending to be, but without vendors actually maintaining and investing in their forks and the hardware having a known good security enclave, you might as well post your credentials on twitter.

Yeah I don't see how this is any different from the standard Google Authenticator style affair. Without a security enclave (which devices are starting to include) I don't see how this is an improvement.

It’s resistant against phishing. That’s solving the problem. OTPs are not.

Re: Your Android Phone Is a Security Key

#92

Post by dgacmu »

kpU8efre7r wrote: post #83
zimmerfrei wrote: post #65

Earlier quoted context omitted.

>> All Android devices certified by Google will have a hardware security module which should keep the keys secure. Source? I understood that having a HW-backed key store is still entirely optional for the purpose of Android certification. On top of that, I noticed some ambiguity on whether a TEE like ARM TrustZone qualifies as a hardware-grade protection mechanism in the same way a discrete and dedicated crypto proce…

Titan M. They have it built into their Pixel devices much like a tiny mobile TPM. https://www.blog.google/products/pixel/titan-m-makes-pixel-3... With that said, I cant find mention of this on the page so it's probably not leveraging this.

It is. If you have a pixel you can just use a button press, because the Titan m can directly sense the button state.

Re: Your Android Phone Is a Security Key

#93

Post by lern_too_spel »

munchbunny wrote: post #81
lern_too_spel wrote: post #68

Earlier quoted context omitted.

Android 7 supports key attestation. https://source.android.com/security/keystore/attestation

That's great, but that doesn't actually guarantee that this new feature requires that the phone is using the hardware security module, just that you'd be able to prove if it it was. Don't get me wrong, it's still better than TOTP in many ways, but having the actual security coprocessor is a big distinction.

There is no practical difference. For people who need the security, this API can guarantee it.

Re: Your Android Phone Is a Security Key

#94

Post by oneplane »

vbezhenar wrote: post #73
oneplane wrote: post #34

> Your Android Phone Is a Security Key no it's not. it's pretending to be, but without vendors actually maintaining and investing in their forks and the hardware having a known good security enclave, you might as well post your credentials on twitter.

I don't see how it's less secure than storing passwords in ~/Documents/Passwords.txt. And it's a second factor, so combined with first factor the result is pretty secure. You can't browse other people phones, even without security enclave.

Websites running javascript weren't supposed to browse other people's computers either, but we all know how that assumption went. Yes, it has gotten better the past few years, but the whole point of a security key is that it takes a purpose-designed piece of hardware and software, with a minimal attack surface. A phone is far from it.

Re: Your Android Phone Is a Security Key

#95

Post by oneplane »

Rafert wrote: post #72
oneplane wrote: post #34

> Your Android Phone Is a Security Key no it's not. it's pretending to be, but without vendors actually maintaining and investing in their forks and the hardware having a known good security enclave, you might as well post your credentials on twitter.

That's a bit snarky. As other commenters mentioned, it can leverage TEEs using the Android Keystore for secure storage. And the way WebAuthn works means users are protected in case of a database breach (it contains only public keys) and the protocol protects against phishing. Both are ways better than usernames and passwords. It got certified (at level 1[0]) too, in case that changes your mind: https://fidoalliance.o…

I was intended to be a bit snarky indeed. I know TEE's and remote attestation are supposed to help out here, but I also know that even a purpose-designed chip couldn't get it right the first few times (think MIFARE NFC, TPMs and YubiKeys with Infineon cores). It's a very hard problem, and making light of it by having marketing (big assumption) play it as if a phone is now a security key seems a bit of a leap here.

At the same time, WebAuthn is better in itself but still not the silver bullet versus passwords and a password manager. We don't live in an ideal world of course, but if we are going to turn commodity multipurpose devices into soft tokens, we might as well name it as such. (but naming it that way definitely doesn't have the same ring to it: "Your Phone is a Soft Token").

Re: Your Android Phone Is a Security Key

#96

Post by danans »

scarejunba wrote: post #61
ghaff wrote: post #12

Earlier quoted context omitted.

I don't carry my keys when I'm traveling if I'm not driving my own car. So, no, not everyone carries keys. ADDED: I do have other 2FA hardware as well. But I assume I'm not guaranteed to have it with me when I need it.

Ah, you have separate keyrings for your home keys and car keys? I'd say that's not usually the case.

It's common in any situation where you share a car with other people.

Re: Your Android Phone Is a Security Key

#97

Post by amanzi »

drexlspivey wrote: post #87

Or you can just use https://krypt.co/ which uses the same FIDO standard, is open source, works on both android and iOS (where it actually uses the secure enclave) and both in Chrome and Firefox

I've been using this for the last month or so and have no complaints. Works well.

Re: Your Android Phone Is a Security Key

#99

Post by rrix2 »

modwilliam wrote: post #40
ksec wrote: post #30

Off topic: This is the state of web we are in, and this is coming from Google. [1] I have literally 20% of the screen displaying useful information. The others are all useless navigation or related crap. Just seeing it nearly got me to puke. It is one those problem in general where the web page is responsive and mobile first. [1] https://ibb.co/fCfmW6h

Looks like you're zoomed in or have a larger default font size, so it's not fair to say this is the state of the web

so the state of the web is fine as long as you don't have accessibility needs? neato.

Re: Your Android Phone Is a Security Key

#100

Post by gretch »

tjbiddle wrote: post #98

My Pixel 2 already does this. When I sign into Google I get a notification that asks if I'm signing in, I click yes, done-zo. Is the only thing new here the UI + that it's open for all Android 7.0 phones now?

disclosure: I work at google

The thing you have now communicates that yes click over the internet. This new thing communicates through a local channel (bluetooth).

Communicating over a local channel prevents phishing.

Consider this attack: Attacker hosts googlee.com and you get tricked into going there. The login site looks exactly like the google site. You type in username/password just like normal. In that moment they take your phished credentials and pass it to the actual google server, like a man in the middle. Now you receive a prompt on your phone asking Yes/No. You click yes, okaying the attacker's login.

Now that same attack with the local channel communication - they can't take your signal and pass it on through to google

Post reply on HN