Your yubikey isn't owned by an evil megacorp.
Use a damn yubikey; they're practically free and don't monetize their users.
Your Android Phone Is a Security Key
101–110 of 144 posts
Re: Your Android Phone Is a Security Key
#102My Pixel 2 already does this. When I sign into Google I get a notification that asks if I'm signing in, I click yes, done-zo. Is the only thing new here the UI + that it's open for all Android 7.0 phones now?
disclosure: I work at google The thing you have now communicates that yes click over the internet. This new thing communicates through a local channel (bluetooth). Communicating over a local channel prevents phishing. Consider this attack: Attacker hosts googlee.com and you get tricked into going there. The login site looks exactly like the google site. You type in username/password just like normal. In that moment t…
As there's very little documentation on this right now: couple of related questions (feel free to ignore them I don't want to guilt you into it)
1. It doesn't seem to be using the Titan M flow on my Pixel 3 currently
2. After reinstalling GMS on my phone to try and get the Titan M working, it stayed registered as a key, but the prompt never shows up on my device.
I guess this is more of a "flag for internal review" vs a "please provide me with answers".
Re: Your Android Phone Is a Security Key
#103Earlier quoted context omitted.
This is 2FA for Google accounts so of course it's on Google products?
Google Authenticator works with any service that uses the TOTP or HOTP standards. https://en.wikipedia.org/wiki/Google_Authenticator
This post is not about Google authenticator. It's about making a different 2FA solution for their accounts in particular.
Re: Your Android Phone Is a Security Key
#104Earlier quoted context omitted.
The problem isn't even Google, it's just lack of actual support for services that need it. You have to have the right client, the right device, and every website has to implement it. Government websites won't support it, nor most financial services, your gym, school, job, etc. Sensitive records like your SSN will be kept in walled gardens accessible by a simple user and password, and maybe a security question. Most p…
Admittedly, that's not a minor benefit. If someone has access to your Gmail account, there's all sorts of information there they can use to engineer access to other services. The naive optimist in me wants to think that making security keys accessible to more users, and getting them used to them, will lead to pressure for other services to follow suit. But then I think about how long people have been criticizing bank…
I mean the problems I have with banks are 1) you type your username and password on different pages 2) password limits of like 20 chars.
We're in a day and age where people should be using password managers (even my tech illiterate parents use them). So why are character limits set so low? I want my bank password locked down. And we're in an day and age where (1) shouldn't even be an issue. I'm not sure what other issues people face, but I've seen these patterns with multiple banks.
I think banks get lip more because they are a clear case where security should be VERY high. Just like you should protect your email strongly (note google does (1)[0]).
[0] https://screenshots.firefox.com/v9AjmrW7jtr1aGg3/accounts.go...
[0'] If someone is an actual security expert, I'd like to know why (1) is an acceptable practice. (My bank does it, but they pass you to the password page no matter what you type in, which seems safer than what google is doing)
Re: Your Android Phone Is a Security Key
#105Earlier quoted context omitted.
I don't know how they determine what options to offer, but using my phone was the only one given, despite entering a correct password . The only other option, which I either found from the "Learn more" link or after exhausting the "login with your phone" attempts, was to create a support ticket for my G-suite account which, in this case, would have been slower than returning to home a few hours later where I had left…
There's an option on https://myaccount.google.com/security to turn off 2-step login.
Sorry for being thick, but I'm not seeing it. This is a G-suite account (though I'm the only user / admin) so maybe it's different.
Re: Your Android Phone Is a Security Key
#106Earlier quoted context omitted.
Admittedly, that's not a minor benefit. If someone has access to your Gmail account, there's all sorts of information there they can use to engineer access to other services. The naive optimist in me wants to think that making security keys accessible to more users, and getting them used to them, will lead to pressure for other services to follow suit. But then I think about how long people have been criticizing bank…
I mean the problems I have with banks are 1) you type your username and password on different pages 2) password limits of like 20 chars. We're in a day and age where people should be using password managers (even my tech illiterate parents use them). So why are character limits set so low? I want my bank password locked down. And we're in an day and age where (1) shouldn't even be an issue. I'm not sure what other is…
>If someone is an actual security expert, I'd like to know why (1) is an acceptable practice.
So your issue here is that Google tells you whether it's a valid email address before you enter in a password?
You could validate email addresses yourself by sending out a ton of emails to different permutations of *@gmail.com and seeing which ones come back as undeliverable. An email address on its own isn't inherently private so this doesn't seem to be a security risk to me unless I'm missing something.
Re: Your Android Phone Is a Security Key
#107I like the idea behind it in principle, since it will simplify 2FA for the masses and may lead more people to adopt it. But, apart from that: 1. It's only on Chrome (for now(?)) 2. It's only for Google products (for now (?)) 3. It's only on Android that Google fully controls remotely (and probably it will stay there). All these give even more power to Google at the expense of convenience and allows a single company t…
In principle I don't see any reason why this couldn't be made to work with any browser/site through the WebAuthn standard. In fact, it wouldn't surprise me if that's exactly what Google's doing under the hood.
Re: Your Android Phone Is a Security Key
#108Earlier quoted context omitted.
I mean the problems I have with banks are 1) you type your username and password on different pages 2) password limits of like 20 chars. We're in a day and age where people should be using password managers (even my tech illiterate parents use them). So why are character limits set so low? I want my bank password locked down. And we're in an day and age where (1) shouldn't even be an issue. I'm not sure what other is…
>If someone is an actual security expert, I'd like to know why (1) is an acceptable practice. So your issue here is that Google tells you whether it's a valid email address before you enter in a password? You could validate email addresses yourself by sending out a ton of emails to different permutations of *@gmail.com and seeing which ones come back as undeliverable. An email address on its own isn't inherently priv…
I interpreted the parent's complaint in (1) as the login form having the username/password entries split across two screens, not as a complaint that it tells you the account doesn't exist.
AIUI, splitting the entry across two screens like that breaks a lot of password managers, as they can't handle it. This hampers the adoption of password managers, which would largely help the average Joe's security.
Google supports external auth in some cases¹, and to know whether they need to redirect to that auth, they first need your username / email. Then, you're either redirected or you're shown the password entry prompt.
I don't know of any banks that do this, so this might not be applicable to them. (Theirs might just be bad design.)
¹GSuite, not consumer GMail, but I assume the flows are the same
Re: Your Android Phone Is a Security Key
#109I like the idea behind it in principle, since it will simplify 2FA for the masses and may lead more people to adopt it. But, apart from that: 1. It's only on Chrome (for now(?)) 2. It's only for Google products (for now (?)) 3. It's only on Android that Google fully controls remotely (and probably it will stay there). All these give even more power to Google at the expense of convenience and allows a single company t…
The problem isn't even Google, it's just lack of actual support for services that need it. You have to have the right client, the right device, and every website has to implement it. Government websites won't support it, nor most financial services, your gym, school, job, etc. Sensitive records like your SSN will be kept in walled gardens accessible by a simple user and password, and maybe a security question. Most p…
I'm not sure this is the right perspective. Is it really such a big deal if SSNs get leaked?
On the other hand, insecure e-mail has been at the center of massive political upheavals. I think securing e-mail is way more important than even banking information.
Re: Your Android Phone Is a Security Key
#110Earlier quoted context omitted.
There's an option on https://myaccount.google.com/security to turn off 2-step login.
Sorry for being thick, but I'm not seeing it. This is a G-suite account (though I'm the only user / admin) so maybe it's different.
From my G-Suite account (where I'm the only user / admin), it shows two-step verification settings here:
https://myaccount.google.com/signinoptions/two-step-verifica...