Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Downsides of Google Authenticator

zdnet.com

Post reply on HN
Print view View original

71–80 of 139 posts

Re: Downsides of Google Authenticator

#71

Post by 0x0 »

jki275 wrote: post #9
lima wrote: post #4

Strongly disagree with the premise of this article: - Passcode or biometric locks on an app are a gimmick and offer negligible value. - The keys not being backed up or or synchronised across devices is not a bug, but a feature. You're supposed to keep offline backup keys. Any sort of synchronization feature adds a ton of attack surface. - In particular, Authy, LastPass and 1password have a giant attack surface compar…

As long as you use encrypted backups with iPhone, your GA keys are backed up and you can restore a new phone with them also.

Last time I did a backup/restore between iphones using encrypted itunes usb, GA came up empty. Had to go through painful account recovery / lost 2fa procedures on a dozen accounts. Now I use "OTPAuth" instead. Even comes with an Apple Watch app!

Re: Downsides of Google Authenticator

#72

Post by latchkey »

danShumway wrote: post #34

Last time I checked, by default, Authy codes were susceptible to SIM-swap attacks.[0] This is a bad article. You should perhaps consider switching off of Authenticator to an Open Source manager like AndOTP; I think that's something reasonable to propose. But I don't understand the argument that I should be very concerned a lack of biometric locks, but not concerned about invalidating the "something you have " part of…

Authy only has SIM issues if you give it your phone number. Don't do that.

Re: Downsides of Google Authenticator

#73

Post by latchkey »

lisper wrote: post #48

I stopped using Authy because it has auto-update that you cannot disable. One day it auto-updated itself to a version that would not run on my OS. Also, it's an electron app, so it is absurdly heavyweight for the tiny bit of functionality it provides. I ended up writing my own TOTP app. It's about 50 lines of common lisp code.

Authy Desktop

  Memory / Real / Shared

  71.3 MB 116.8 MB 96.3 MB

Re: Downsides of Google Authenticator

#74

Post by pyt »

prophesi wrote: post #27
sschueller wrote: post #16

Use an alternative like andOTP or Authenticator Plus which allow you to backup your keys.

+1 to andOTP. It's on F-Droid and still gets semi-regular updates. It's a bit obnoxious that it requires a password, but that just means an autofill from my password manager for free at-rest encrypted storage.

I believe if you use the Android Keystore, you can use it without a password and just authenticate with a fingerprint when it starts up.

Re: Downsides of Google Authenticator

#75

Post by ender341341 »

lima wrote: post #4

Strongly disagree with the premise of this article: - Passcode or biometric locks on an app are a gimmick and offer negligible value. - The keys not being backed up or or synchronised across devices is not a bug, but a feature. You're supposed to keep offline backup keys. Any sort of synchronization feature adds a ton of attack surface. - In particular, Authy, LastPass and 1password have a giant attack surface compar…

> In particular, Authy, LastPass and 1password have a giant attack surface compared to a simple app like Google Authenticator. They also rely on centralized services and if you also keep your passwords in there, you eliminate the whole point of two factor authentication.

1pass user, while I know that it's not as secure as keeping them separated I view it as if someone has access to my 1password vault unencrypted I'm already screwed, but having 2FA coming from 1 tool still protects me from the case of my username/password pair getting leaked or MITMed.

Re: Downsides of Google Authenticator

#76

Post by lisper »

latchkey wrote: post #73
lisper wrote: post #48

I stopped using Authy because it has auto-update that you cannot disable. One day it auto-updated itself to a version that would not run on my OS. Also, it's an electron app, so it is absurdly heavyweight for the tiny bit of functionality it provides. I ended up writing my own TOTP app. It's about 50 lines of common lisp code.

Authy Desktop Memory / Real / Shared 71.3 MB 116.8 MB 96.3 MB

  > du -sh Authy\ Desktop.app/
  142M Authy Desktop.app/
  
  > du -sh Clozure\ CL.app/
  35M Clozure CL.app/

Re: Downsides of Google Authenticator

#77

Post by J5892 »

ender341341 wrote: post #75
lima wrote: post #4

Strongly disagree with the premise of this article: - Passcode or biometric locks on an app are a gimmick and offer negligible value. - The keys not being backed up or or synchronised across devices is not a bug, but a feature. You're supposed to keep offline backup keys. Any sort of synchronization feature adds a ton of attack surface. - In particular, Authy, LastPass and 1password have a giant attack surface compar…

> In particular, Authy, LastPass and 1password have a giant attack surface compared to a simple app like Google Authenticator. They also rely on centralized services and if you also keep your passwords in there, you eliminate the whole point of two factor authentication. 1pass user, while I know that it's not as secure as keeping them separated I view it as if someone has access to my 1password vault unencrypted I'm…

As a LastPass user, my main defense against the possibility of someone accessing my LastPass account is the fact that all of my important accounts have 2FA completely separate from LastPass.

So if someone got a hold of my LastPass master password, they can't access my google account, banking, etc.

Re: Downsides of Google Authenticator

#78

Post by anonsivalley652 »

Since FreeOTP (iOS and Android) is open-source and free, it seems trivial to add an export/import feature that can store/load from an password-protected (argon2), encrypted (AES) file.

https://freeotp.github.io

https://github.com/freeotp/freeotp-ios

https://github.com/freeotp/freeotp-android

This isn't suitable because it doesn't allow saving it as a file:

https://github.com/freeotp/freeotp-ios/pull/129

Re: Downsides of Google Authenticator

#79

Post by danShumway »

latchkey wrote: post #72
danShumway wrote: post #34

Last time I checked, by default, Authy codes were susceptible to SIM-swap attacks.[0] This is a bad article. You should perhaps consider switching off of Authenticator to an Open Source manager like AndOTP; I think that's something reasonable to propose. But I don't understand the argument that I should be very concerned a lack of biometric locks, but not concerned about invalidating the "something you have " part of…

Authy only has SIM issues if you give it your phone number. Don't do that.

The linked article is recommending Authy over Authenticator because backing up codes on multiple devices is too hard. If you're going to disable remote backup on Authy, then there's almost no advantage to switching away from Authenticator in the first place. Authy also doesn't allow local export of tokens, so there's no advantage there. I guess with Authenticator you lose the ability to lock your local tokens with a 4-digit pin, but who cares? 4-digit pins are not secure.

I just checked on an old installation of Authy, and as far as I can tell there is no way to remove a phone number from the app itself, only change it. Maybe when you're installing you can skip that step. You can turn off remote backup entirely, but see above.

If you use Authy, fine. It's still better than nothing. Really, getting people to use 2FA at all is the important battle, and the fight over which 2FA app is best is probably a waste of time. But Zdnet should not have written an article recommending people switch away from Authenticator to Authy when Authy's primary selling point is actually an attack vector that its own support website recommends disabling[0].

More to the point, the setting makes me trust Authy less in other security areas, because it's an attack vector that they easily could have plugged years ago -- and it makes me think they haven't actually thought that much about security. It's just bad UX to ask users for an encryption password when a single setting will non-transparently bypass that password requirement for some tokens.

[0]: https://support.authy.com/hc/en-us/articles/360012427914-Is-...

Re: Downsides of Google Authenticator

#80

Post by worble »

orev wrote: post #36
ocdtrekkie wrote: post #10

Earlier quoted context omitted.

All my 2FA codes are backed up. On paper. I have a physically-secured cache of the QR codes which can be pretty quickly imported into a new app.

I see people say this a lot in the tech community, but it’s a preposterous expectation that regular users would be doing something like this. MFA needs to usable by everyone, not just the tech elite.

At some point something has to give though. Security and convenience are constantly at odds with each other. My opinion is that it's far better to convince people that it's worth the inconvenience rather than watering the security down to the point where it's basically pointless. And if they take the consideration that the extra security isn't worth it for them, then that's the choice they make.
Post reply on HN