Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Warning: Google Authenticator upgrade loses all accounts

news.ycombinator.com

Post reply on HN
Print view View original

41–50 of 176 posts

Re: Warning: Google Authenticator upgrade loses all accounts

#41

Post by orand »

derefr wrote: post #31
orand wrote: post #12

If they had released this two weeks later, iOS 7's auto-update feature would have bricked everyone's accounts. Google Auth 2.0 redefines two-factor auth: something you know + something you DON'T have. Their entire purpose in life is this second part and they completely and absolutely botched it. I can't believe this passed testing at both Google and Apple. There wasn't even a warning in the release notes.

I think Google's thinking on this is that 2FA tokens are definitely "one of those things you don't want stored in an subpoenable manner by your Cloud provider." If your 2FA token is synced to iCloud, for example, then it's no longer something you have --it's something else you know (your iCloud username+password.) "Something you Have"-type tokens provide security basically because they're immune to rubber-hose crypta…

I'm sorry, I don't follow your logic. Are you trying to say you think Google actually had a rationale for this behavior? Where does "the cloud" come into the equation? This data isn't being synced to iCloud. That defeats the whole purpose.

Re: Warning: Google Authenticator upgrade loses all accounts

#42

Post by sk5t »

derefr wrote: post #31
orand wrote: post #12

If they had released this two weeks later, iOS 7's auto-update feature would have bricked everyone's accounts. Google Auth 2.0 redefines two-factor auth: something you know + something you DON'T have. Their entire purpose in life is this second part and they completely and absolutely botched it. I can't believe this passed testing at both Google and Apple. There wasn't even a warning in the release notes.

I think Google's thinking on this is that 2FA tokens are definitely "one of those things you don't want stored in an subpoenable manner by your Cloud provider." If your 2FA token is synced to iCloud, for example, then it's no longer something you have --it's something else you know (your iCloud username+password.) "Something you Have"-type tokens provide security basically because they're immune to rubber-hose crypta…

I don't think this argument makes any sense with regard to TOTP, as Google (or Dropbox, Twitter, etc.) most certainly knows the seed/secret for your account at their service and could be forced to divulge it via court order. Or they could simply cough up the plaintext data sans faffing about with 2FA at all. 2FA of this sort only makes it harder for an attacker to get in.

Defense against rubber hose cryptanalysis comes into play where the key only exists in one place, such as the asymmetric private key on hardware security module, or perhaps a symmetric key stored on a physically-unavailable USB key. But 2FA like TOTP does not imply encryption, even though it relies on some cryptographic primitives.

Re: Warning: Google Authenticator upgrade loses all accounts

#44

Post by derefr »

orand wrote: post #41
derefr wrote: post #31

Earlier quoted context omitted.

I think Google's thinking on this is that 2FA tokens are definitely "one of those things you don't want stored in an subpoenable manner by your Cloud provider." If your 2FA token is synced to iCloud, for example, then it's no longer something you have --it's something else you know (your iCloud username+password.) "Something you Have"-type tokens provide security basically because they're immune to rubber-hose crypta…

I'm sorry, I don't follow your logic. Are you trying to say you think Google actually had a rationale for this behavior? Where does "the cloud" come into the equation? This data isn't being synced to iCloud. That defeats the whole purpose.

Because Google fundamentally wants everyone to use Google+ for everything, and their Google Accounts to sign into it. If they weren't thinking about the security implications, Google Authenticator would definitely be a "sync your credentials to your Google Account" app.

I assume that the implementation of 2FA was a 20%-time project (it's sort of sloppily integrated; you need to find a special page that isn't linked from anywhere whenever you need to add an application-specific password, for instance) which reeks of it not being orders from on high. So, the people who implemented 2FA at Google were probably just some people who fundamentally care about 2FA. People who know what "Something you Have" actually means.

Re: Warning: Google Authenticator upgrade loses all accounts

#46

Post by elithrar »

kibibu wrote: post #39
veidr wrote: post #32

What does it mean that it 'loses all accounts'? I use two factor auth but not this app, so I am not sure why people are going to have such a bad day...

You add your Google (and potentially other) accounts in the app - then you need to open the app to log in to your account. The app is "forgetting" and no longer displaying the accounts you add, such that you open Authenticator and it's empty. You can no longer log in to your Google account without one of the 10 printed one-time access codes you made when you first set it up.

> You can no longer log in to your Google account without one of the 10 printed one-time access codes you made when you first set it up.

* or a backup phone number that's been verified (i.e. send a verification code and confirmed).

Re: Warning: Google Authenticator upgrade loses all accounts

#47

Post by kibibu »

cdman wrote: post #38
guiambros wrote: post #29

Authy (YC W12, [1]) is a nice replacement for the GA app. Besides being more stable, it has also the "benefit" of allowing you to back up your keys, and recover in the case of a lost phone or deleted app. Thankfully, backing up is entirely optional, and turned off by default. While they claim backups are encrypted with PBKDF2 [3], I still would never ever use something that sends my tokens to a remote server, as it'd…

You had me until "backups are encrypted with PBKDF2". PBKDF2 is not encryption, it is a Key Derivation Function (it says so right in the name - KDF). Given that one of the developers is claiming that they are "encrypting" using PBKDF2 (which is in the same category as claiming that they are encrypting using MD5!), dissuades me from ever using it or recommending it.

I may be totally wrong, but isn't PBKDF2 useful exactly as a way to generate an encryption key from a password?

Re: Warning: Google Authenticator upgrade loses all accounts

#48

Post by mik3y »

clarkm wrote: post #7

For those looking for Google Authenticator alternatives, I recommend either Duo Mobile from Duo Security or Authy. I ditched Google Authenticator a while ago and haven't missed it one bit -- having a single app manage my two-factor tokens / keys is much more convenient.

In light of this incident with GA, do either/any of the alternative support "export" of the underlying secrets, for instance to migrate to a new app?

Re: Warning: Google Authenticator upgrade loses all accounts

#49

Post by derefr »

sk5t wrote: post #42
derefr wrote: post #31

Earlier quoted context omitted.

I think Google's thinking on this is that 2FA tokens are definitely "one of those things you don't want stored in an subpoenable manner by your Cloud provider." If your 2FA token is synced to iCloud, for example, then it's no longer something you have --it's something else you know (your iCloud username+password.) "Something you Have"-type tokens provide security basically because they're immune to rubber-hose crypta…

I don't think this argument makes any sense with regard to TOTP, as Google (or Dropbox, Twitter, etc.) most certainly knows the seed/secret for your account at their service and could be forced to divulge it via court order. Or they could simply cough up the plaintext data sans faffing about with 2FA at all. 2FA of this sort only makes it harder for an attacker to get in. Defense against rubber hose cryptanalysis com…

Keep in mind that Google Authenticator stores arbitrary third-party credentials, though. Subpoena Google and you could get Google's TOTP token for you, along with the rest of your account, sure. Sync Google Authenticator to Google, and suddenly they don't have to subpoena anyone else--just use their Gmail account to reset all their passwords for every other service, and use their TOTP tokens to sign into them. This basically removes the "Principle of Least Privilege" way that subpoenas work.
Post reply on HN