41–50 of 149 posts
Can the title get changed? - E2E in this case is nebulous, this isn't a chat or email client, it isn't client client with Google acting as an intermediary. It is between your Google account/Google's Server and Google's software. - It isn't clear if during transportation it is encrypted (e.g. HTTPS?); since seemingly this post isn't about that (or if it is the evidence or technical information is lacking). The term "E…
I was really annoyed when iDrive, the backup service, pulled this stunt. Originally, they didn't have access to your encryption key. Then they put a dark pattern on their site to encourage users to give them the encryption key, to support the "the Cloud interface". Then you needed to give them the encryption key for some support functions.
> if someone obtains access to your Google Account, all of your 2FA secrets would be compromised. This overlooks that fact Google itself also has access to your 2FA secrets, which could be even worse considering Google could be requested to peer not just into the user's google account, but into accounts they have with other companies/organisations too.
Why would google have access to that material? Is their general secret mechanism not E2EE? I'm fairly cynical on google's approach to privacy but I would be shocked if they're normal syncing isn't actually secure and private.
TOTP (the six digit codes) is bad and outdated 2FA anyway. It's vulnerable to phishing. Use WebAuthn with security keys.
What do you all like to do for security key backups? I use yubikeys wherever I can, but I've got to admit that fetching all 5+ keys from their various locations and then replacing them every time I need to enroll in something gets old fast, especially when you get into locations like "buried in the mountains". The phishability of TOTP is indeed a big problem but being able to just save the seed (theoretically, somewh…
They should have handled it the same way they do Sync in chrome, and I expect they will eventually. But, as always, unless a service advertises that it's full E2EE and you can verify that, assume it's not.
One part of this that's funny to me:
>>>Also, 2FA QR codes typically contain other information such as account name and the name of the service (e.g. Twitter, Amazon, etc). Since Google can see all this data, it knows which online services you use, and could potentially use this information for personalized ads.
I guarantee you, Google knows which online services you use in about 800 other ways, it doesn't need to scrape it from your 2FA accounts.
- Has a contractual obligation to keep your data secure.
- Accepts financial responsibility for data compromise.
- Carries insurance and bonding to back that responsibility.
- Does not require binding arbitration or forbid class actions.
- Has their employees bonded in the way bank employees are bonded.
Well?
Earlier quoted context omitted.
The problem with security keys is that they're expensive and you have to carry them around. TOTP is cheap and much better 2FA than OTP over SMS.
Security keys can be built into the phone and still provide a reasonable expectation of security, e.g. Apple's Passkeys. Obviously, a YubiKey would be better, but Passkeys don't require you to carry an additional thing and are still more secure than TOTP apps.
I don’t like this idea. As a person whose had a phone break, like many others, tying auth to something so fragile should not be preferable. I’ll never forget my phone breaking and the process of trying to order a new one: the online shopping here, Shopee, demanded SMS 2FA (only option) which I needed to purchase a new phone so I found a different vendor but then my bank required SMS 2FA (only option) to do a transfer.
At least with these hardware security tokens, they’re pretty ‘dumb’ and often covered in epoxy or other weather-resistant material that makes them quite rugged & durable. Mine have gone through the wash and dangle from my motorbike’s keychain during the monsoons without issue.
> YubiKey
Please just use a generic term like “hardware security key/token” rather than endorsing a singular brand–especially one that is closed-source and looking to “go public” (https://news.ycombinator.com/item?id=35625065). If you think the closed nature of Google Authenticator is bad, consider an open hardware token option rather than a closed one.
Earlier quoted context omitted.
Chrome sync has let you set a separate password for end to end encryption for as long as I can remember, though badly until January 2020. https://bugs.chromium.org/p/chromium/issues/detail?id=820976
That's not end-to-end, that's just regular old symmetric encryption.
Just because there is only one key doesn't disqualify the solution from e2ee status. If the middleman does not have the key, it's still end to end secure.
to be fair, storing your 2FA seeds in 1Password is about the same, except 1Password supposedly can't see your secrets. but if a hacker gets access to your unlocked 1Password data it's the same
tl;dr2 use offline TOTP or similar for real 2FA