Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Warning: Google Authenticator upgrade loses all accounts

news.ycombinator.com

Post reply on HN
Print view View original

31–40 of 176 posts

Re: Warning: Google Authenticator upgrade loses all accounts

#31

Post by derefr »

orand wrote: post #12

If they had released this two weeks later, iOS 7's auto-update feature would have bricked everyone's accounts. Google Auth 2.0 redefines two-factor auth: something you know + something you DON'T have. Their entire purpose in life is this second part and they completely and absolutely botched it. I can't believe this passed testing at both Google and Apple. There wasn't even a warning in the release notes.

I think Google's thinking on this is that 2FA tokens are definitely "one of those things you don't want stored in an subpoenable manner by your Cloud provider." If your 2FA token is synced to iCloud, for example, then it's no longer something you have--it's something else you know (your iCloud username+password.)

"Something you Have"-type tokens provide security basically because they're immune to rubber-hose cryptanalysis: if you really just don't have the key to a safe, nothing an attacker does can make you give it to them. As such, tokens are also the factor that protect you from contempt-of-court charges if you're compelled to provide it. (Though they can then ask you "who does have a key?"; if this is an accomplice, it's best if they live in a separate country, and hopefully one which doesn't like the US very much.)

Re: Warning: Google Authenticator upgrade loses all accounts

#33

Post by bruceboughton »

PLejeck wrote: post #19

I'm just gonna point out that the previous update was somewhere around 2 years ago, and it's just now getting retina, so we should be glad there's even this much.

Yeah, now I can view my missing one time codes in retina, edge to edge quality. Yay!

Re: Warning: Google Authenticator upgrade loses all accounts

#35

Post by orand »

bobbles wrote: post #25
orand wrote: post #12

If they had released this two weeks later, iOS 7's auto-update feature would have bricked everyone's accounts. Google Auth 2.0 redefines two-factor auth: something you know + something you DON'T have. Their entire purpose in life is this second part and they completely and absolutely botched it. I can't believe this passed testing at both Google and Apple. There wasn't even a warning in the release notes.

>There wasn't even a warning in the release notes Do you think they would have released it if they knew about it?

Probably not, but I use several apps that put a big "BACK UP YOUR APP DATA BEFORE UPGRADING" in their upgrade release notes. I'm just shocked they didn't know about it because the upgrade process wasn't even in their test plan.

Re: Warning: Google Authenticator upgrade loses all accounts

#36

Post by cstuder »

PLejeck wrote: post #17
elithrar wrote: post #10

Earlier quoted context omitted.

> I actually just switched to Duo Mobile earlier today because of iOS 7 issues with Authenticator; this just cements my decision to switch. I moved all my non-critical stuff over (to test it out), saw the Google Authenticator update, and then had to go and reconfigure those accounts anyway. I highly recommend making sure your backup phone number is updated and verified and/or you have backup codes prepped.

Luckily I was still logged into all my accounts (my Dropbox account suddenly dropped from Google's app like a week ago) Duo seems to be quite nice, I doubt I'll end up using the backup codes. Incidentally, GitHub has it right - "download a text file of your backup codes" is much easier than "print this page nad hope you don't lose it"; I find find(1) outpaces my frantic drawer-emptying.

I've just noticed that Google has the download-as-text functionality now too.

Re: Warning: Google Authenticator upgrade loses all accounts

#38

Post by cdman »

guiambros wrote: post #29

Authy (YC W12, [1]) is a nice replacement for the GA app. Besides being more stable, it has also the "benefit" of allowing you to back up your keys, and recover in the case of a lost phone or deleted app. Thankfully, backing up is entirely optional, and turned off by default. While they claim backups are encrypted with PBKDF2 [3], I still would never ever use something that sends my tokens to a remote server, as it'd…

You had me until "backups are encrypted with PBKDF2". PBKDF2 is not encryption, it is a Key Derivation Function (it says so right in the name - KDF). Given that one of the developers is claiming that they are "encrypting" using PBKDF2 (which is in the same category as claiming that they are encrypting using MD5!), dissuades me from ever using it or recommending it.

Re: Warning: Google Authenticator upgrade loses all accounts

#39

Post by kibibu »

veidr wrote: post #32

What does it mean that it 'loses all accounts'? I use two factor auth but not this app, so I am not sure why people are going to have such a bad day...

You add your Google (and potentially other) accounts in the app - then you need to open the app to log in to your account.

The app is "forgetting" and no longer displaying the accounts you add, such that you open Authenticator and it's empty.

You can no longer log in to your Google account without one of the 10 printed one-time access codes you made when you first set it up.

Re: Warning: Google Authenticator upgrade loses all accounts

#40

Post by gmac »

veidr wrote: post #32

What does it mean that it 'loses all accounts'? I use two factor auth but not this app, so I am not sure why people are going to have such a bad day...

You get greeted by a "let's begin" screen, and all your accounts/credentials have magically gone away. This happened to me 5 minutes ago.

Edit: tweet with picture: https://twitter.com/jawj/status/375144792126410752

Post reply on HN