Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Google Authenticator cloud sync: Google can see the secrets, even while stored

defcon.social

Post reply on HN
Print view View original

51–60 of 149 posts

Re: Google Authenticator cloud sync: Google can see the secrets, even while stored

#51

Post by jkingsman »

IceWreck wrote: post #12
sneak wrote: post #3

TOTP (the six digit codes) is bad and outdated 2FA anyway. It's vulnerable to phishing. Use WebAuthn with security keys.

The problem with security keys is that they're expensive and you have to carry them around. TOTP is cheap and much better 2FA than OTP over SMS.

This is sort of willfully missing the point, I concede, but I have my U2F token physically embedded in my arm and have minimal fear of losing it/being without it. Right now it runs OpenPGP and a Yubikey U2F emulator, but it can run just about any flavor of MFA with the appropriate companion app (full subdermal Java Card platform).

https://dangerousthings.com/product/flexsecure/

Hard agree, though, TOTP >>>>>> OTP via SMS

Re: Google Authenticator cloud sync: Google can see the secrets, even while stored

#52

Post by jeroenhd »

px43 wrote: post #36
lern_too_spel wrote: post #26

Earlier quoted context omitted.

Chrome sync has let you set a separate password for end to end encryption for as long as I can remember, though badly until January 2020. https://bugs.chromium.org/p/chromium/issues/detail?id=820976

That's not end-to-end, that's just regular old symmetric encryption.

Assymetric keys aren't a requirement for E2EE. In fact, in most cases, assymetric encryption is only used to exchange a symmetric key to use for data decryption anyway. Assymetric cryptography is way too inefficient to encrypt and decrypt more than short secrets.

The whole reason you'd enable this feature is for when you lose your phone and need to provision a replacement. There's not really any way to do the whole key exchange dance if you don't have access to the original source. A password derived key is essential in this case.

Re: Google Authenticator cloud sync: Google can see the secrets, even while stored

#53

Post by jeroenhd »

modeless wrote: post #8

What? Why would this not get the same end-to-end encryption as Android backups? They'd have to do extra work to make this less secure. Edit: oh I guess because it supports syncing between Android and iOS? Still lame, they should at least have an option to use the normal Android backup system. Which should have been the default since the start.

Even if they synchronize cross platform, there's no reason why they can't take the Android backup algorithm and stuff it into their iOS app. Google owns both side of the connection here and the Android code is even open source.

Re: Google Authenticator cloud sync: Google can see the secrets, even while stored

#54

Post by throwawaaarrgh »

computerfriend wrote: post #31
exabrial wrote: post #25

Earlier quoted context omitted.

Progress, not perfection. Sms should never be used or offered, and needs congressional action to be stopped as a practice. TOTP at least prevents turning Wireless carriers into security providers and is "good enough" for nearly everything. And yes, WebAuthn/U2F is top of totem pole and should be something we're striving for nearly everything.

> Sms should never be used or offered It's better than nothing.

you could say the same about any shitty security, but most people don't want shitty security

Re: Google Authenticator cloud sync: Google can see the secrets, even while stored

#55

Post by jeroenhd »

sneak wrote: post #3

TOTP (the six digit codes) is bad and outdated 2FA anyway. It's vulnerable to phishing. Use WebAuthn with security keys.

WebAuthn doesn't work with apps. At the moment, FIDO2 relies on either your Big Tech account of choice or an expensive USB key. TOTP is free. There are no backups, so you also need to manually get your second USB key out of that safe place (the fire resistant safe in another physical location people talk about) every time you need to register a 2FA device.

WebAuthn and friends are definitely an improvement, but it's not quite a perfect replacement yet.

Besides, even some banks still use SMS for 2FA at this point. TOTP would make a lot of sites more secure already.

Re: Google Authenticator cloud sync: Google can see the secrets, even while stored

#57

Post by shawnz »

Someone1234 wrote: post #23

Can the title get changed? - E2E in this case is nebulous, this isn't a chat or email client, it isn't client client with Google acting as an intermediary. It is between your Google account/Google's Server and Google's software. - It isn't clear if during transportation it is encrypted (e.g. HTTPS?); since seemingly this post isn't about that (or if it is the evidence or technical information is lacking). The term "E…

> The actual complaint SEEMS to be: Google Authenticator backup isn't encrypted at rest on Google's Servers

Encryption at rest would NOT solve the problem being described here. Even if the data was encrypted both in transit and at rest, that does not mean that Google is incapable of getting access to the data. The data needs to be encrypted from the moment it leaves the device until the moment it arrives back on the user's device again (e.g. client to client E2EE), which is a stronger criteria than encryption in transit and at rest.

Re: Google Authenticator cloud sync: Google can see the secrets, even while stored

#58

Post by lern_too_spel »

j16sdiz wrote: post #30
lern_too_spel wrote: post #24

Earlier quoted context omitted.

Google had that four years before Advanced Data Protection existed. https://security.googleblog.com/2018/10/google-and-android-h... Warning: this blog post has meaningless marketing-speak. It starts by saying Android is about choice but instead of announcing the ability to set your own backup provider, it just says how Google's Android backup service works, which is wholly unrelated to that first sentence.

If you are talking about device backup, apple had it encrypted before Advanced data protection. If you are talking about other data, Google don't have it encrypted even today.

> If you are talking about device backup, apple had it encrypted before Advanced data protection.

Not end to end: https://www.wired.com/story/apple-end-to-end-encryption-iclo...

Re: Google Authenticator cloud sync: Google can see the secrets, even while stored

#59

Post by jxy »

patmcc wrote: post #45

It's a tradeoff. They could let (or require) a password be entered to encrypt/decrypt it on each device, but then people would be ticked off when they forget their password and can't recover their 2FA stuff. They should have handled it the same way they do Sync in chrome, and I expect they will eventually. But, as always, unless a service advertises that it's full E2EE and you can verify that, assume it's not. One pa…

The problem is now they know your TOTP secrets, they are only one password away from pretending to be you.

And actually, they serve you emails, so password is moot for most of the sites today.

Re: Google Authenticator cloud sync: Google can see the secrets, even while stored

#60

Post by anonymousiam »

vivegi wrote: post #32
judge2020 wrote: post #21

Earlier quoted context omitted.

Chrome passwords are encrypted with your Google password by default, it's just not e2ee. This isn't even encrypted in that way it seems. The only real "threat" is your Google account itself being compromised by a third party able to phish their way into your account or bypass your 2fa mechanisms (e.g. by SMS sim swapping). As always, https://landing.google.com/advancedprotection/ The people here saying "privacy" are…

> doomsday scenario where Google itself leaks all of this data, which would be unprecedented and is unlikely ... (emphasis added) From the linked article [1]: > December 2018: Google+ Bug Exposes 52.5 Million Users’ Data Google+ faced its second big breach of 2018 when a November update created an API bug that exposed data from 52.5 million Google+ accounts. Google fixed the bug within six days, and moved up Google+’…

Don't forget about this: https://www.businessinsider.com/google-fired-employees-abusi...
Post reply on HN