Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Google Authenticator cloud sync: Google can see the secrets, even while stored

defcon.social

Post reply on HN
Print view View original

111–120 of 149 posts

Re: Google Authenticator cloud sync: Google can see the secrets, even while stored

#111

Post by kevincox »

zamnos wrote: post #108

> likely even while they’re stored on their servers. I'm all for castigating Google for not encrypting the TOTP seed which is (apparently) transmitted in the clear, but there's no actual proof (one way or the other) that the secrets are/are not being stored encrypted. Thus claiming "even while stored" claim is a bit much.

Yeah, there isn't such thing as an unencrypted disk at Google. Most things are encrypted multiple times in different layers before hitting physical media. Not E2EE which is a serious concern, but definitely encrypted in some form in transit (exceptions for intra-datacenter transfers) and at rest.

Re: Google Authenticator cloud sync: Google can see the secrets, even while stored

#113

Post by ddalex »

mschuster91 wrote: post #83
ddalex wrote: post #81

Earlier quoted context omitted.

The whole writeup seems like missing the forest for the trees - Google as root access on the Android device where this app runs, so they can certainly see everything if they want ....

Google pushing malicious updates would leave forensic traces, not to mention it'd be difficult to establish a legal framework allowing a government to force Google to do so. In contrast, subpoena'ing data from the cloud is routine for police in countries all over the world.

So your threat model is a sovereign state able to subpoena cloud data.

Under this model, if Google gets a court order to root-break a specific phone (push malicious update), they will be forced to, and that's all the legal framework necessary, so end-to-end encryption doesn't protect you in this case either.

Re: Google Authenticator cloud sync: Google can see the secrets, even while stored

#114

Post by ddalex »

Closi wrote: post #89
ddalex wrote: post #81

Earlier quoted context omitted.

The whole writeup seems like missing the forest for the trees - Google as root access on the Android device where this app runs, so they can certainly see everything if they want ....

There is a lot of difference between being as secure as practically possible with password data, and allowing anyone with root access to see all your password data.

But it's the same thing - the threat model described is not safeguarded by end to end encryption when the encryption device itself is compromised.

"secure as practically possible" depends a lot on what practically means, and that is just a function of cost vs threat level. If you believe that Google will access your private data, you should not be using a Google-developed application and OS in the first place.

Re: Google Authenticator cloud sync: Google can see the secrets, even while stored

#115

Post by hammyhavoc »

patmcc wrote: post #45

It's a tradeoff. They could let (or require) a password be entered to encrypt/decrypt it on each device, but then people would be ticked off when they forget their password and can't recover their 2FA stuff. They should have handled it the same way they do Sync in chrome, and I expect they will eventually. But, as always, unless a service advertises that it's full E2EE and you can verify that, assume it's not. One pa…

Is decrypting via a password literally not how Authy, BitWarden et al handle it?

Re: Google Authenticator cloud sync: Google can see the secrets, even while stored

#116

Post by hammyhavoc »

ggm wrote: post #2

It's a dual facing problem. Not only do users have no defence against google snooping, but google has no defence against requests to snoop: Apple seems to drive harder to "we'd help if we could, but we can't: to us its just blobs"

Users have defence against snooping, it's not using Google in the first place if this is a consideration in their threat model.

Does or should grandma care? No.

Should a political dissenter living in an oppressive regime think twice? Yes.

Re: Google Authenticator cloud sync: Google can see the secrets, even while stored

#117

Post by 007asdflkjsfd »

ddalex wrote: post #81
patmcc wrote: post #45

It's a tradeoff. They could let (or require) a password be entered to encrypt/decrypt it on each device, but then people would be ticked off when they forget their password and can't recover their 2FA stuff. They should have handled it the same way they do Sync in chrome, and I expect they will eventually. But, as always, unless a service advertises that it's full E2EE and you can verify that, assume it's not. One pa…

The whole writeup seems like missing the forest for the trees - Google as root access on the Android device where this app runs, so they can certainly see everything if they want ....

you are so correct. people don't even question this anymore.

Everyone also might have "google play protect" enabled on their phones which allow google to pack and ship all and every app at regular intervals (no mention anywhere if it include user data) to their servers for threat analysis.

Re: Google Authenticator cloud sync: Google can see the secrets, even while stored

#118

Post by 007asdflkjsfd »

px43 wrote: post #36
lern_too_spel wrote: post #26

Earlier quoted context omitted.

Chrome sync has let you set a separate password for end to end encryption for as long as I can remember, though badly until January 2020. https://bugs.chromium.org/p/chromium/issues/detail?id=820976

That's not end-to-end, that's just regular old symmetric encryption.

[flagged]

Re: Google Authenticator cloud sync: Google can see the secrets, even while stored

#119

Post by dtech »

ddalex wrote: post #113
mschuster91 wrote: post #83

Earlier quoted context omitted.

Google pushing malicious updates would leave forensic traces, not to mention it'd be difficult to establish a legal framework allowing a government to force Google to do so. In contrast, subpoena'ing data from the cloud is routine for police in countries all over the world.

So your threat model is a sovereign state able to subpoena cloud data. Under this model, if Google gets a court order to root-break a specific phone (push malicious update), they will be forced to, and that's all the legal framework necessary, so end-to-end encryption doesn't protect you in this case either.

That's a lot more detectable, and has a high risk of coming out, see e.g. Pegasus. Cloud access is nearly invisible.
Post reply on HN