Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Your Android Phone Is a Security Key

blog.google

Post reply on HN
Print view View original

131–140 of 144 posts

Re: Your Android Phone Is a Security Key

#131

Post by rathish_g »

doughj3 wrote: post #113
binarycrusader wrote: post #110

Earlier quoted context omitted.

From my G-Suite account (where I'm the only user / admin), it shows two-step verification settings here: https://myaccount.google.com/signinoptions/two-step-verifica...

That seems to redirect me to the same page linked earlier in this thread ( https://myaccount.google.com/security ). Taking a look in my admin console, it looks like "Allow users to turn on 2-step verification" is unchecked, so presumably 2-step verification is not enabled for this account. That's exactly what I want, but it seems Google is failing to abide when they think I'm a "hacker". Other people have had the sam…

Did you enable 2FA from https://admin.google.com/ for your account ?

Dashboard -> select Security -> Basic Settings -> Two-Step Verification setting

Re: Your Android Phone Is a Security Key

#132

Post by 556B19BB »

lucb1e wrote: post #63
ksec wrote: post #30

Off topic: This is the state of web we are in, and this is coming from Google. [1] I have literally 20% of the screen displaying useful information. The others are all useless navigation or related crap. Just seeing it nearly got me to puke. It is one those problem in general where the web page is responsive and mobile first. [1] https://ibb.co/fCfmW6h

Turning off JavaScript sometimes helps, but often just breaks the site. However, I also have a button to turn off CSS, which just flips a setting (dead simple addon, no security risk, can't break anything, and doesn't need a page refresh). I use it about once a week for articles with too low contrast, annoying fonts (this is getting better over the past year or so), or crappy sites like this. The article after turnin…

> The article after turning off CSS: https://snag.gy/RmXpxl.jpg

I found it amusing after you mention turning off Javascript, and then that link doesn't work without it.

The actual image is at https://i.snag.gy/RmXpxl.jpg

Re: Your Android Phone Is a Security Key

#133

Post by rheerani »

arnarbi wrote: post #116
munchbunny wrote: post #29

Is this based on a hardware security module in the phone? I don't see this written anywhere in the blog post. For something like this, especially with your phone, putting the private keys out of reach of the CPU/memory and hardened against side channel attacks is table stakes.

For phones that have a dedicated hardware module, such as the Pixel 3, yes the key material is generated and stored there. Using it requires a physical action that is hardwired to the hardware module. We think the most pressing need right now is to protect users against phishing, which is a much larger threat than malware. Thus we think there's a lot of value in enabling this for all phone models where it's possible…

So, can the button used be changed or does it have to be standardized across devices and which is why it's the volume down button? Because the squeeze function on Pixels or assistant buttons on other devices could be used instead, though that's just me wondering out loud for an alternative user-facing implementation because the use of volume button seems strange to me.

Re: Your Android Phone Is a Security Key

#134

Post by helloindia »

doughj3 wrote: post #22

> Now, you have one more option—and it’s already in your pocket. Starting today in beta, your phone can be your security key—it’s built into devices running Android 7.0+. You know, it's nice they phrase this as an "option", but in my experience Google has the habit of forcing me to have my phone on me when I login from a new location / new device, something I never asked for and apparently cannot disable.[0] This has…

This happened with some of my friends, and locked them out of their gmail accounts(2FA disabled accounts). Google won't let them login to their accounts after providing correct password & SMS OTP.

Remaining options include: 1. give date(month year) of email sign-up, which most don't remember

2. pasword reset over alternate email address, which wasn't set during signup.

The only way for free gmail users to get help is support forum ran by gmail user volunteers, which didn't solve the problem. To me this approach to security, just seem super paranoic.

Re: Your Android Phone Is a Security Key

#135

Post by lucb1e »

556B19BB wrote: post #132
lucb1e wrote: post #63

Earlier quoted context omitted.

Turning off JavaScript sometimes helps, but often just breaks the site. However, I also have a button to turn off CSS, which just flips a setting (dead simple addon, no security risk, can't break anything, and doesn't need a page refresh). I use it about once a week for articles with too low contrast, annoying fonts (this is getting better over the past year or so), or crappy sites like this. The article after turnin…

> The article after turning off CSS: https://snag.gy/RmXpxl.jpg I found it amusing after you mention turning off Javascript, and then that link doesn't work without it. The actual image is at https://i.snag.gy/RmXpxl.jpg

Heh :)

I don't browse with JS off, I only turn it off for sites that are a pain in the ass when it's on.

Re: Your Android Phone Is a Security Key

#136

Post by plttn »

arnarbi wrote: post #114
plttn wrote: post #102

Earlier quoted context omitted.

As there's very little documentation on this right now: couple of related questions (feel free to ignore them I don't want to guilt you into it) 1. It doesn't seem to be using the Titan M flow on my Pixel 3 currently 2. After reinstalling GMS on my phone to try and get the Titan M working, it stayed registered as a key, but the prompt never shows up on my device. I guess this is more of a "flag for internal review" v…

Thanks for this! I'm the TL for this at Google. Re 1: The Titan-M specific flow is still rolling out, you should see your phone switch to the volume-down UI soon. Re 2: I've flagged this and we'll look into it.

Hey, thanks so much!

Re: Your Android Phone Is a Security Key

#137

Post by acct1771 »

scottlocklin wrote: post #101

Your yubikey isn't owned by an evil megacorp. Use a damn yubikey; they're practically free and don't monetize their users.

As someone who can't currently afford the two Yubikeys needed to finish securing their internal startup services...please think for just a second before you say things.

Re: Your Android Phone Is a Security Key

#138

Post by pwg »

aerotwelve wrote: post #42
ksec wrote: post #30

Off topic: This is the state of web we are in, and this is coming from Google. [1] I have literally 20% of the screen displaying useful information. The others are all useless navigation or related crap. Just seeing it nearly got me to puke. It is one those problem in general where the web page is responsive and mobile first. [1] https://ibb.co/fCfmW6h

Sticky elements that follow you around while scrolling a web page should be banned like the blink tag. Especially in a mobile browser. I know where the navigation bar is, if I want to use it, I'll scroll back up and touch something on it. If I want to read related articles, I'll scroll down past your piece, which is where that kind of nonsense always is. But it gets better: you know what's almost always sticky? Those…

Put this javascript into the URL field of a bookmark (thereby making it a "bookmarklet" [1]) and then select the bookmark [2] on any page that has those sticky elements. Once run, the sticky elements will be gone. Note multi-lines below, but it will all be one line in the URL field.:

    javascript:(function () {                               
      var i,elements=document.querySelectorAll('body *');   
      for (i=0;i
uBlock Origin's custom filters can also be used to delete those sticky elements as well.

[1] https://en.wikipedia.org/wiki/Bookmarklet

[2] on Firefox for Android, 'selecting' the bookmark to run on a page entails touching the URL bar, then selecting the bookmark item into which you placed the javascript from the bookmarks list that will appear.

Re: Your Android Phone Is a Security Key

#139

Post by eitland »

Dylan16807 wrote: post #112
layoutIfNeeded wrote: post #77

Earlier quoted context omitted.

Of course they do. This is the “embrace” phase.

I could see an argument about WSL being that. But making your software work on the linux desktop/server? I really don't see how that lets you get into a position toward extinguishing anything.

Especially not when they have open sourced it under a liberal license.

Re: Your Android Phone Is a Security Key

#140

Post by arnarbi »

rheerani wrote: post #133
arnarbi wrote: post #116

Earlier quoted context omitted.

For phones that have a dedicated hardware module, such as the Pixel 3, yes the key material is generated and stored there. Using it requires a physical action that is hardwired to the hardware module. We think the most pressing need right now is to protect users against phishing, which is a much larger threat than malware. Thus we think there's a lot of value in enabling this for all phone models where it's possible…

So, can the button used be changed or does it have to be standardized across devices and which is why it's the volume down button? Because the squeeze function on Pixels or assistant buttons on other devices could be used instead, though that's just me wondering out loud for an alternative user-facing implementation because the use of volume button seems strange to me.

On Pixel 3, no, it cannot be changed. Only the volume down button is wired to the Titan-M. Why that button rather than others, I don't know.
Post reply on HN