Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Google Authenticator cloud sync: Google can see the secrets, even while stored

defcon.social

Post reply on HN
Print view View original

21–30 of 149 posts

Re: Google Authenticator cloud sync: Google can see the secrets, even while stored

#21

Post by judge2020 »

olliej wrote: post #18
nomilk wrote: post #5

> if someone obtains access to your Google Account, all of your 2FA secrets would be compromised. This overlooks that fact Google itself also has access to your 2FA secrets, which could be even worse considering Google could be requested to peer not just into the user's google account, but into accounts they have with other companies/organisations too.

Why would google have access to that material? Is their general secret mechanism not E2EE? I'm fairly cynical on google's approach to privacy but I would be shocked if they're normal syncing isn't actually secure and private.

Chrome passwords are encrypted with your Google password by default, it's just not e2ee. This isn't even encrypted in that way it seems.

The only real "threat" is your Google account itself being compromised by a third party able to phish their way into your account or bypass your 2fa mechanisms (e.g. by SMS sim swapping). As always, https://landing.google.com/advancedprotection/

The people here saying "privacy" are speaking of some doomsday scenario where Google itself leaks all of this data, which would be unprecedented and is unlikely with how many safeguards there are for employees to access any user data at all within Google.

Re: Google Authenticator cloud sync: Google can see the secrets, even while stored

#22

Post by cogitoergofutuo »

gojomo wrote: post #15
nomilk wrote: post #5

> if someone obtains access to your Google Account, all of your 2FA secrets would be compromised. This overlooks that fact Google itself also has access to your 2FA secrets, which could be even worse considering Google could be requested to peer not just into the user's google account, but into accounts they have with other companies/organisations too.

Under what conditions do you suggest "Google itself also has access to all your 2FA secrets"? (Without cloud backup, & without the installation of a malicious version of 'Google Authenticator', how would they – especially, say, on iOS?)

I think they are referring to the scenario where cloud backup is enabled.

Re: Google Authenticator cloud sync: Google can see the secrets, even while stored

#23

Post by Someone1234 »

Can the title get changed?

- E2E in this case is nebulous, this isn't a chat or email client, it isn't client client with Google acting as an intermediary. It is between your Google account/Google's Server and Google's software.

- It isn't clear if during transportation it is encrypted (e.g. HTTPS?); since seemingly this post isn't about that (or if it is the evidence or technical information is lacking). The term "E2EE" typically is referring to encryption from client client through a blind intermediary, but again that doesn't describe the relationship here.

The actual complaint SEEMS to be:

> Google Authenticator backup isn't encrypted at rest on Google's Servers

My big complaint is that this is a misuse of the term "E2E" (E2EE). It simply doesn't apply in this situation. That doesn't mean it isn't discussion worthy (e.g. not using HTTPS is a major red flag, and not encrypting at rest on Google's Servers is discussable).

In general the linked post doesn't do a good job describing what they found and how they found it.

Re: Google Authenticator cloud sync: Google can see the secrets, even while stored

#24

Post by lern_too_spel »

SXX wrote: post #20
heavyset_go wrote: post #13

Earlier quoted context omitted.

Apple regularly gives up customers' private data when requested, and they keep logs of it themselves[1]. [1] https://www.apple.com/legal/transparency/us.html

But Apple now has Advanced Data Protection that add E2EE for majority of iCloud data and they only keep keys on your devices. Not that I have absolute trust in Apple, but Google don't even have that.

Google had that four years before Advanced Data Protection existed. https://security.googleblog.com/2018/10/google-and-android-h...

Warning: this blog post has meaningless marketing-speak. It starts by saying Android is about choice but instead of announcing the ability to set your own backup provider, it just says how Google's Android backup service works, which is wholly unrelated to that first sentence.

Re: Google Authenticator cloud sync: Google can see the secrets, even while stored

#25

Post by exabrial »

sneak wrote: post #3

TOTP (the six digit codes) is bad and outdated 2FA anyway. It's vulnerable to phishing. Use WebAuthn with security keys.

Progress, not perfection.

Sms should never be used or offered, and needs congressional action to be stopped as a practice.

TOTP at least prevents turning Wireless carriers into security providers and is "good enough" for nearly everything.

And yes, WebAuthn/U2F is top of totem pole and should be something we're striving for nearly everything.

Re: Google Authenticator cloud sync: Google can see the secrets, even while stored

#26

Post by lern_too_spel »

judge2020 wrote: post #21
olliej wrote: post #18

Earlier quoted context omitted.

Why would google have access to that material? Is their general secret mechanism not E2EE? I'm fairly cynical on google's approach to privacy but I would be shocked if they're normal syncing isn't actually secure and private.

Chrome passwords are encrypted with your Google password by default, it's just not e2ee. This isn't even encrypted in that way it seems. The only real "threat" is your Google account itself being compromised by a third party able to phish their way into your account or bypass your 2fa mechanisms (e.g. by SMS sim swapping). As always, https://landing.google.com/advancedprotection/ The people here saying "privacy" are…

Chrome sync has let you set a separate password for end to end encryption for as long as I can remember, though badly until January 2020. https://bugs.chromium.org/p/chromium/issues/detail?id=820976

Re: Google Authenticator cloud sync: Google can see the secrets, even while stored

#27

Post by jchw »

Someone1234 wrote: post #23

Can the title get changed? - E2E in this case is nebulous, this isn't a chat or email client, it isn't client client with Google acting as an intermediary. It is between your Google account/Google's Server and Google's software. - It isn't clear if during transportation it is encrypted (e.g. HTTPS?); since seemingly this post isn't about that (or if it is the evidence or technical information is lacking). The term "E…

End-to-end is being used to mean encrypted on the client and decrypted on other clients. "Encrypted at rest" is overloaded, it's often used to refer to secrets stored encrypted by an HSM or something where the key is still accessible by whoever is storing the data; pretty common for compliance where the threat model being addressed is someone stealing a hard drive from a data center, but not very useful for when you want a secret to remain secret even to the server operator.

This is pretty common use for the term E2EE as far as I can tell. That all of the "clients" for which the encryption would be end-to-end for are all run by the same user is not really a big deal; I've seen it used similarly for things like "end-to-end encrypted notes" and that sort of thing. Example: https://standardnotes.com/

Re: Google Authenticator cloud sync: Google can see the secrets, even while stored

#28

Post by amarshall »

Someone1234 wrote: post #23

Can the title get changed? - E2E in this case is nebulous, this isn't a chat or email client, it isn't client client with Google acting as an intermediary. It is between your Google account/Google's Server and Google's software. - It isn't clear if during transportation it is encrypted (e.g. HTTPS?); since seemingly this post isn't about that (or if it is the evidence or technical information is lacking). The term "E…

E2EE is a valid term. Just because both ends are controlled by the same person doesn’t make it not “client ↔ client”. Just because Google wrote the software and stores the backups does not mean that those backups should be readable to someone (e.g. Google servers) with access only to the backup. E2EE means that no one other then the end-users can see the data—in this case, that is just the one user. Neither transit encryption nor encryption at rest provide that.

Encryption at rest is not really part of the discussion. There’s no way to verify client side that it is happening, and it does not prevent Google servers from seeing the plaintext backup.

> In general the linked post doesn't do a good job describing what they found and how they found it

Seemed pretty clear: they did MITM to bypass any transit encryption and saw the plaintext secrets being sent, and thus Google servers can see all the secrets.

Re: Google Authenticator cloud sync: Google can see the secrets, even while stored

#30

Post by j16sdiz »

lern_too_spel wrote: post #24
SXX wrote: post #20

Earlier quoted context omitted.

But Apple now has Advanced Data Protection that add E2EE for majority of iCloud data and they only keep keys on your devices. Not that I have absolute trust in Apple, but Google don't even have that.

Google had that four years before Advanced Data Protection existed. https://security.googleblog.com/2018/10/google-and-android-h... Warning: this blog post has meaningless marketing-speak. It starts by saying Android is about choice but instead of announcing the ability to set your own backup provider, it just says how Google's Android backup service works, which is wholly unrelated to that first sentence.

If you are talking about device backup, apple had it encrypted before Advanced data protection.

If you are talking about other data, Google don't have it encrypted even today.

Post reply on HN