Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

A future without passwords

blog.google

Post reply on HN
Print view View original

121–130 of 227 posts

Re: A future without passwords

#121

Post by probably_wrong »

paranoidrobot wrote: post #91

I don't trust Google to fill this role of being arbiter of access to things. After it took me a week to recover access to a GSuite account that I knew the password for (long, unique, stored in a password manager), that I could confirm access via the recovery email, and that had my phone number attached - but Google were insisting that I was a hacker, and Support-robots refused to help me or assign a human until I fou…

I feel your pain. I lost my GMail account under very similar circumstances. That means that I also lost my Amazon and Reddit accounts because they send me "verify it's you" emails that I can no longer access.

It's been almost two months now. I managed to get through to a human but they misunderstood my problem, referred me to the wrong documentation, and then stopped replying altogether. I am now shopping for lawyers to sue them under the GDPR for something that any other company would have resolved in an hour or less.

Do not trust Google to be your gatekeeper.

Re: A future without passwords

#122

Post by mceachen »

scambier wrote: post #116
tomerbd wrote: post #112

Earlier quoted context omitted.

what do you use for photos storage ?

Not OP. While I've personally not yet fully migrated out of Google, I found Synching and Resilio Sync quite useful to transparently backup photos to my own computer. And to prevent losses, I have a Backblaze subscription. While I do have a VPS, it only has like 20GB, so I've yet to find an affordable and easy photo sharing solution.

You can set up PhotoStructure to build smaller (4k, 1080p, whatever you want) previews on your home server, and rsync just the previews dir and DB periodically up to your VPS. A couple of my beta users do this. (I'm the author, btw).

https://photostructure.com/faq/why-photostructure/

Re: A future without passwords

#123

Post by matt_f »

riffraff wrote: post #104
askvictor wrote: post #78

Earlier quoted context omitted.

A well-designed MFA system has multiple fall backs available. Google's has options to fall back to sending an SMS (not the highest level of security, but security is always a trade-off), so if you're phone's broken you can move the SIM to another one. Or a phone call to a pre-registered landline that will read out a code to you. As well as the paper/printable emergency codes. That said, there's always going to be com…

Google also has a TOTP fallback, which solves the "I want my second factor to be my laptop" perfectly.

Really? How is this activated or enabled?

Re: A future without passwords

#124

Post by matt_f »

It looks like Google 2FA will support using a Yubikey or something like it, which in my mind is preferable to being required to use the Google mobile app.

> You'll enter your password [...] Then, a code will be sent to your phone via text, voice call, or our mobile app. Or, if you have a Security Key, you can insert it into your computer’s USB port.

https://www.google.com/landing/2step/#tab=how-it-works

Re: A future without passwords

#125

Post by tialaramex »

mikedilger wrote: post #85
pmlnr wrote: post #26

https://myaccount.google.com/signinoptions/two-step-verifica... > Google prompts > "To stop getting prompts on a particular phone, sign out of that phone." Well, f* you too. I genuinely hate this idiotic future where I'm not given a choice. I have a yubikey, a TOTP, and backup codes. Leave my phone out of this.

If you don't have a google-enabled android device (as I don't), and you've registered your Yubikey with google (as I have), they won't use the Yubikey they will SMS you instead. Seems like they prefer google prompt, then SMS, then the actually secure stuff.

I just went to the bother to confirm that, exactly as I expected, Google just asks me for my Security Key when I sign in. This is what their UI says they will do, and sure enough it is in fact what they actually do.

So whatever you're seeing is not in fact some sort of Google policy to prefer insecure SMS.

Re: A future without passwords

#126

Post by noyesno »

paranoidrobot wrote: post #91

I don't trust Google to fill this role of being arbiter of access to things. After it took me a week to recover access to a GSuite account that I knew the password for (long, unique, stored in a password manager), that I could confirm access via the recovery email, and that had my phone number attached - but Google were insisting that I was a hacker, and Support-robots refused to help me or assign a human until I fou…

Can you share the incantation that summed a human, for future reference?

Re: A future without passwords

#127

Post by simondotau »

qzw wrote: post #29

Am I the only one who doesn’t want a future without passwords? There are problems with them, of course, but all the alternatives also have serious usability/security issues. And just when we’re starting to get wider 2FA adoption, companies want to get rid of one of the factors. So we’re back to one factor that’s ultimately secured by a device password/passcode anyway. Plus if/when you’re not able to access the device…

Personally I think the basic building blocks of the password manager workflow is pretty damn close to perfect. Maybe the contemporary password manager could be refined further, but I do like the building blocks:

1. There is an encrypted blob which contains distinct authentication tokens/passwords/whatever for every website/service I have an account at. This blob can be moved around, synced and updated however I like, with zero concern about who has a copy of it.

2. I decrypt this blob locally on device, using a combination of multiple factors such as what I know (a passphrase) and what I have (e.g. a copy of a static but un-guessable and un-rememberable account key, which is copied to all my devices, potentially stored at rest inside a secure enclave).

3. The decrypted blob then authenticates me on services using data which is entirely random and arbitrary.

I could only imagine how much more perfect this arrangement could be with total industry uniformity. Imagine if a common, uniform password manager API was integrated into computers from the earliest days, and all browsers integrating this system service from the very beginning of the Web. Every website could have been built be built around this workflow, not to mention every binary application on desktops and smartphones.

Re: A future without passwords

#128

Post by h4waii »

ProAm wrote: post #33
qzw wrote: post #29

Am I the only one who doesn’t want a future without passwords? There are problems with them, of course, but all the alternatives also have serious usability/security issues. And just when we’re starting to get wider 2FA adoption, companies want to get rid of one of the factors. So we’re back to one factor that’s ultimately secured by a device password/passcode anyway. Plus if/when you’re not able to access the device…

No only that anytime you use Google's 2fa, you let them know where you are and what you are doing. Privacy is a commodity we have willingly and unwillingly given up.

Wha?

Can you provide some more information on how using Google's security prompt provides "where you are and what you are doing"?

Re: A future without passwords

#129

Post by tjoff »

askvictor wrote: post #78
teeray wrote: post #5

I’m not crazy about these “consult your phone to log in” things. There’s just so many more moving parts. Sometimes the push notification doesn’t make it through. Other times the acknowledgment from the phone doesn’t make it back. Occasionally my phone is doing updates when I urgently need to log in. I’d love for the “something you have” to be “my laptop.” It has a TPM; we can do this securely. Something like the MBP’…

A well-designed MFA system has multiple fall backs available. Google's has options to fall back to sending an SMS (not the highest level of security, but security is always a trade-off), so if you're phone's broken you can move the SIM to another one. Or a phone call to a pre-registered landline that will read out a code to you. As well as the paper/printable emergency codes. That said, there's always going to be com…

Not everyone has a SIM to begin with. Or it is lost with the phone.

Anything that has a single or dual point of failure is dead on arrival. Too bad you will realize only after you are locked out of all your digital life.

Re: A future without passwords

#130

Post by PikachuEXE »

Free is the most expensive one

I am using 2FA with backup code stored and using unique generated passwords for each service

It's not easy nor simple but still better than trusting Google that offers "free" service and wanting "something" in return

Post reply on HN