Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Warning: Google Authenticator upgrade loses all accounts

news.ycombinator.com

Post reply on HN
Print view View original

61–70 of 176 posts

Re: Warning: Google Authenticator upgrade loses all accounts

#61

Post by markwakeford »

markbao wrote: post #57
skeletonjelly wrote: post #53

Earlier quoted context omitted.

Have you tested this? Are the barcodes not time pertinent?

(I've studied two-factor authentication using HOTP and TOTP, and built a node.js implementation of it.) The QR codes simply divulge a URI with the secret key for generating tokens. They look like: otpauth://totp/[keyname]?secret=[secretkey] The secret key is used in the app in conjunction with a moving factor (usually 30-second intervals of time) to generate a numerical hash of sorts for that interval of time, which…

fine, outdo me haha. Saving the Key is useful with AWS MFA because if some reason you loose your MFA Virtual Key (app updates and you loose the key) you have to contact AWS to have it reset, Can't just do it yourself.

Re: Warning: Google Authenticator upgrade loses all accounts

#62

Post by enscr »

icecreampain wrote: post #56

I cannot fathom why people still rely on Google for their core business needs. At my last place of work I built an SMS system to be used as the second factor in the intranet login. I _could_ have used a 3rd party 2FA, but the most _logical_ reason to have our own system was ... well.. we didn't want to rely on anyone except ourselves. Didn't take me long and the most difficult part was finding enough USB-connected ph…

Our company started writing their own verilog & soon we'll have chips for our custom designed smartphones. Yay !

Till then, we are stuck with silly can phones :(

Re: Warning: Google Authenticator upgrade loses all accounts

#63

Post by arjie »

lalc wrote: post #58
devx wrote: post #54

This is the sort of "nightmare scenario" I'm afraid of, and why I'm still not using 2FA. I'd rather risk having only a weaker password, than risking losing my accounts for good. You can't get back into your accounts if something like this happens, right?

To get back into your account you're provided backup codes that you're supposed to store somewhere safe. Otherwise, if your phone were stolen you'd be out of luck, yes.

I was about to respond "Haha, no big deal, I use my Google Voice number". The flaw in this was readily apparent.

Re: Warning: Google Authenticator upgrade loses all accounts

#65

Post by [deleted] »

mik3y wrote: post #48
clarkm wrote: post #7

For those looking for Google Authenticator alternatives, I recommend either Duo Mobile from Duo Security or Authy. I ditched Google Authenticator a while ago and haven't missed it one bit -- having a single app manage my two-factor tokens / keys is much more convenient.

In light of this incident with GA, do either/any of the alternative support "export" of the underlying secrets, for instance to migrate to a new app?

[deleted]

Re: Warning: Google Authenticator upgrade loses all accounts

#66

Post by skeletonjelly »

markbao wrote: post #57
skeletonjelly wrote: post #53

Earlier quoted context omitted.

Have you tested this? Are the barcodes not time pertinent?

(I've studied two-factor authentication using HOTP and TOTP, and built a node.js implementation of it.) The QR codes simply divulge a URI with the secret key for generating tokens. They look like: otpauth://totp/[keyname]?secret=[secretkey] The secret key is used in the app in conjunction with a moving factor (usually 30-second intervals of time) to generate a numerical hash of sorts for that interval of time, which…

Awesome. Yeah I clearly am out of my depth :)

Re: Warning: Google Authenticator upgrade loses all accounts

#67

Post by kibibu »

ketralnis wrote: post #51
kibibu wrote: post #47

Earlier quoted context omitted.

I may be totally wrong, but isn't PBKDF2 useful exactly as a way to generate an encryption key from a password?

Sure, in the same way that MD5 is (although you'd want to use PBKDF2 instead of MD5). But you can't actually encrypt with PBKDF2 itself, much like you can't with MD5

From the linked discussion ([3] above):

> 1. We use a 256 bit key derived using a salt and PBKDF2.

> 2. AES is used in CBC mode with a different IV for each account.

> 3. The key is store on the cellphone only and is never transmitted

Re: Warning: Google Authenticator upgrade loses all accounts

#68

Post by mavhc »

icecreampain wrote: post #56

I cannot fathom why people still rely on Google for their core business needs. At my last place of work I built an SMS system to be used as the second factor in the intranet login. I _could_ have used a 3rd party 2FA, but the most _logical_ reason to have our own system was ... well.. we didn't want to rely on anyone except ourselves. Didn't take me long and the most difficult part was finding enough USB-connected ph…

You have your own mobile network? Sweet. I just use this open source thing that doesn't rely on anyone else

Re: Warning: Google Authenticator upgrade loses all accounts

#69

Post by jordanthoms »

ibejoeb wrote: post #64

To disable auto-update on recent Android: Play Store -> Search "Authenticator" -> Select "Google Authenticator" -> Press "Menu" -> Deselect "Auto-update"

I don't think this is happening on Android, seems to be an issue with an iOS update.

Re: Warning: Google Authenticator upgrade loses all accounts

#70

Post by darklajid »

Not an iPhone user, but I wonder if you could access the key data manually and restore it afterwards?

On Android that's possible (if you have root....) by accessing the key database (sqlite in that case). I did that to duplicate the keys from my handset to my tablet.

Post reply on HN