Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Please turn on two-factor authentication

mattcutts.com

Post reply on HN
Print view View original

251–260 of 262 posts

Re: Please turn on two-factor authentication

#251

Post by jsnell »

smackfu wrote: post #85
Karunamon wrote: post #83

The reason I'm not using 2FA right now is twofold. First, because Google doesn't have half of their services using it for some undefined reason (for at least a year plus!). Also, the whole "app specific password" thing is a huge pain in the ass. (And appears to randomly stop working on say, IMAP mail). Second, because the mobile authenticator is not feasible for me right now. I do a lot of android development work (w…

Yes, can someone explain why Google Chrome doesn't support 2FA on the desktop or iOS? It's bizarre. (Well, I suppose it's tragically normal. I'm sure there is a corporate directive that says every Google service must support 2FA, but Chrome has an exception so they don't need to do it yet.)

I don't think your information is up to date. I have definitely been asked for a verification code when logging into Chrome 22. And yes, I mean the kind of code generated by the Google Authenticator app, not an app specific password.

Re: Please turn on two-factor authentication

#252

Post by subsection1h »

andrewcooke wrote: post #219

is there an authenticator that can run on my computer? i see an android app - is there something similar that can run on linux? or does that defeat the purpose because it's not going to be a push notification? (if so, anyway to fix that?). i'm not normally mobile. if i am travelling and need gmail, i will have my laptop. i don't have a smartphone and my dumbphone won't work abroad. EDIT2: oops. ignore previous edit.…

Here are a few implementations that supposedly run on Linux, but I haven't tried them yet:

https://code.google.com/p/cuteauthenticator/

https://github.com/mclamp/jauth

http://blog.jcuff.net/2011/02/cli-java-based-google-authenti...

Also, Android can apparently be run in VirtualBox, but I haven't tried that yet, either:

http://www.buildroid.org/blog/?page_id=121

Re: Please turn on two-factor authentication

#253

Post by veidr »

weaksauce wrote: post #216
JunkDNA wrote: post #187

Earlier quoted context omitted.

Agreed, I missed that tidbit. I guess I was focusing on the idea that someone can wipe your iPhone, iPad, and Mac without ever touching your gmail account. As a father of two year old and 4 month old girls, the photos are the part that of the story that I find the most distressing. Everything else is upsetting, but you can rebuild contact lists and things. Those pictures are completely irreplaceable and it is just gu…

That is terrible. Though, I don't understand why anyone would turn on a "find my Mac" feature that has the potential to wipe your entire hard drive remotely unless you have thorough backups. Time machine is dead easy to use; try pluging in a usb hard drive and it will ask you if you want to use this as a backup drive. Arc is something that anyone on the mac should use as well for backing up priceless pictures and fil…

+1 for Arq (just posting this to note the correct spelling, for those who want to Google it).

Re: Please turn on two-factor authentication

#254

Post by sigkill »

dredmorbius wrote: post #225
maxerickson wrote: post #197

Earlier quoted context omitted.

On the other hand, typical house locks are (apparently) only locks by way of cultural convention. (I say apparently because the ease of using things like bump keys is pretty widely publicized but I have never actually tried it myself)

Conventional locks are far less secure than most people would realize. That said, your house isn't directly connected to 2.26 billion people who can make hundreds (or thousands or billions) of bump-key attempts per second.

In that respect it's like a bcrypted safe with a 4 character password and limited bandwidth.

Re: Please turn on two-factor authentication

#256

Post by Karunamon »

jsnell wrote: post #251
smackfu wrote: post #85

Earlier quoted context omitted.

Yes, can someone explain why Google Chrome doesn't support 2FA on the desktop or iOS? It's bizarre. (Well, I suppose it's tragically normal. I'm sure there is a corporate directive that says every Google service must support 2FA, but Chrome has an exception so they don't need to do it yet.)

I don't think your information is up to date. I have definitely been asked for a verification code when logging into Chrome 22. And yes, I mean the kind of code generated by the Google Authenticator app, not an app specific password.

I just logged out and back in to test this.. still get prompted for an app password. It's good to see they're rolling it out, though!

Re: Please turn on two-factor authentication

#257

Post by aoprisan »

tokenrove wrote: post #206
Lagged2Death wrote: post #4

Am I the only person in the world who doesn't have a cell phone? It annoys me that the two-factor auth setups at sites (like Google) assume I have one and don't even have an option for "I don't have a cell phone, please stop nagging me about this."

No; I know dozens of people, including myself, who do not have cell phones, and have no intention of getting one. I find this an extremely obnoxious assumption by Google (and others) -- it's not like we're luddites; it's frequently the programmers I know who are least willing to carry a cell phone.

the assumption is made that 99% of customers would have a cell phone and thus invested engineering resources into it

Re: Please turn on two-factor authentication

#258

Post by Johngibb »

alfiejohn_ wrote: post #237
Johngibb wrote: post #229

Earlier quoted context omitted.

I think having a second gmail address just for emailin yourself files for public computers might work for you. Keep your personal email safe, and forward what you need to the other address. It's a good compromise. Don't underestimate how vulnerable you are when your email gets hacked - virtually every service you use can be accessed by the forgotten password mechanism when your email is breached. I'm pretty lazy and…

The problem of having to type in your password on an unsecured machine still exists. To access files in this situation, a better approach would have been to upload the file to a webserver. You can then safely download it from the library computer without anything being compromised.

You'd only have to type in the password for an email you don't care about from the unsecured computer, as long as you knew ahead of time to forward the things you needed to print from the library computer. The web server method seems a little less secure since rather than having your files behind a non-two factor email account, they're publicly available. How is that better?

Re: Please turn on two-factor authentication

#259

Post by robomartin »

lee wrote: post #232
robomartin wrote: post #220

All this talk about security and multiple authentication levels yet, your browser --if you use Chrome-- is the worst security leak in a persons digital life. It would take almost anyone a minute in front of a computer to fire-up Chrome and have every single login and password available in plain text. I've written about this before and so have countless of other techies. A non-techie has not a single clue, making them…

Curious, could you point to a blog post or article that explains how to do this?

Here's what a thief could do:

Open Chrome

Go to Settings

Click on "Show Advanced Settings"

Click on "Managed Saved Passwords"

Click on a saved password

Click on "Show"

Write down or copy/paste/email the login in this fashion one-by-one.

If they are after a pile of logins, keep clicking "Show" all the way down the list. Capture the screen and email/print or simply take your smartphone and snap a picture.

Scroll through the entire login list to get it all.

Takes very little time to get all of someone's private login data in this fashion. An, since the vast majority of Internet users re-use login user id's and passwords across many services I would imagine it might not take long to identify this pattern and have access to every login.

Locking the workstation behind a password doesn't help either for a number of reasons, not the least of which is that workstation password removal, recovery or cracking tools are widely and easily available.

Re: Please turn on two-factor authentication

#260

Post by robomartin »

danweber wrote: post #234
robomartin wrote: post #220

All this talk about security and multiple authentication levels yet, your browser --if you use Chrome-- is the worst security leak in a persons digital life. It would take almost anyone a minute in front of a computer to fire-up Chrome and have every single login and password available in plain text. I've written about this before and so have countless of other techies. A non-techie has not a single clue, making them…

I think most people are aware that the passwords saved in their browser are, well, saved in their browser, and if someone unkind gains access to the browser they gain access to all the sites with saved passwords.

The point is that Chrome doesn't even make an attempt to slow down potential thieves. And, while I understand that absolute security is impossible, Chrome makes it so even a technology neophyte can steal your digital life with a few minutes of low-effort point-and-click action.

I use Chrome all the time. As a developer I am keenly aware of the issues and manage the risk. I will not allow anyone in my family to use Chrome because the potential security leak could have dire consequences.

Post reply on HN