Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Warning: Google Authenticator upgrade loses all accounts

news.ycombinator.com

Post reply on HN
Print view View original

121–130 of 176 posts

Re: Warning: Google Authenticator upgrade loses all accounts

#121

Post by sjg »

gmac wrote: post #100

Too late for me, but a pleasingly fast and pro-active response from AWS (which rather shows Google up) just received by email: "If you are an AWS customer who uses Google Authenticator for iOS as a multi-factor authentication device to secure your AWS account via AWS MFA ( http://aws.amazon.com/mfa/ ), please read on. We are writing to inform you that Google has recently released an update to the Google Authenticator…

What's even worse is with a certain iOS update that may or may not be launching in the next few weeks will make this advice impossible. 3 words for you - Auto updating apps

Re: Warning: Google Authenticator upgrade loses all accounts

#123

Post by rajavekedoby »

gmac wrote: post #100

Too late for me, but a pleasingly fast and pro-active response from AWS (which rather shows Google up) just received by email: "If you are an AWS customer who uses Google Authenticator for iOS as a multi-factor authentication device to secure your AWS account via AWS MFA ( http://aws.amazon.com/mfa/ ), please read on. We are writing to inform you that Google has recently released an update to the Google Authenticator…

gmac I agree that Linda`s stori is really great, on monday I bought a new GMC from having made $6642 this last five weeks and-just over, $10 thousand this past-munth. it's certainly the most-rewarding I have ever done. I actually started 10-months ago and immediately began to earn more than $80.. per-hour. check it out big57.com

Re: Warning: Google Authenticator upgrade loses all accounts

#124

Post by DigitalSea »

Do Google even test the stuff they put out? This is a pretty severe mistake to make for a company as big as Google. Do they not have teams dedicated to testing this stuff? The small design studio I work at does a better job QA'ing their websites than Google does QA'ing major product upgrades... Disgraceful.

Re: Warning: Google Authenticator upgrade loses all accounts

#126

Post by rednotebook »

sjg wrote: post #121
gmac wrote: post #100

Too late for me, but a pleasingly fast and pro-active response from AWS (which rather shows Google up) just received by email: "If you are an AWS customer who uses Google Authenticator for iOS as a multi-factor authentication device to secure your AWS account via AWS MFA ( http://aws.amazon.com/mfa/ ), please read on. We are writing to inform you that Google has recently released an update to the Google Authenticator…

What's even worse is with a certain iOS update that may or may not be launching in the next few weeks will make this advice impossible. 3 words for you - Auto updating apps

Which can be turned off

Re: Warning: Google Authenticator upgrade loses all accounts

#127

Post by skeletonjelly »

markbao wrote: post #57
skeletonjelly wrote: post #53

Earlier quoted context omitted.

Have you tested this? Are the barcodes not time pertinent?

(I've studied two-factor authentication using HOTP and TOTP, and built a node.js implementation of it.) The QR codes simply divulge a URI with the secret key for generating tokens. They look like: otpauth://totp/[keyname]?secret=[secretkey] The secret key is used in the app in conjunction with a moving factor (usually 30-second intervals of time) to generate a numerical hash of sorts for that interval of time, which…

Would this mean that these two values are stored locally? Could they be extracted from the GA app?

Re: Warning: Google Authenticator upgrade loses all accounts

#128

Post by bigiain »

cstuder wrote: post #36
PLejeck wrote: post #17

Earlier quoted context omitted.

Luckily I was still logged into all my accounts (my Dropbox account suddenly dropped from Google's app like a week ago) Duo seems to be quite nice, I doubt I'll end up using the backup codes. Incidentally, GitHub has it right - "download a text file of your backup codes" is much easier than "print this page nad hope you don't lose it"; I find find(1) outpaces my frantic drawer-emptying.

I've just noticed that Google has the download-as-text functionality now too.

I wonder how many machines have those backup auth token text files sitting on the Desktop or in the Downloads folder?

Re: Warning: Google Authenticator upgrade loses all accounts

#129

Post by markbao »

skeletonjelly wrote: post #127
markbao wrote: post #57

Earlier quoted context omitted.

(I've studied two-factor authentication using HOTP and TOTP, and built a node.js implementation of it.) The QR codes simply divulge a URI with the secret key for generating tokens. They look like: otpauth://totp/[keyname]?secret=[secretkey] The secret key is used in the app in conjunction with a moving factor (usually 30-second intervals of time) to generate a numerical hash of sorts for that interval of time, which…

Would this mean that these two values are stored locally? Could they be extracted from the GA app?

Technically, yes. The name of the key is set by default as the account name in the app. I haven't looked into how the secret is stored in the Google Authenticator app—hopefully it's stored securely or with some level of obfuscation, but the app definitely needs to be able to retrieve the secret key somehow to do the token calculation.

One thing to note is that neither Google Authenticator nor Duo Security let you display the secret itself in the app. Another thing to note is that Google Authenticator keys seem to be backed up if you back up your iPhone to a computer using iTunes (mine were still there after a restore).

Re: Warning: Google Authenticator upgrade loses all accounts

#130

Post by hrjet »

What I worry about is a hacker feigning to be another user and claiming that they can't access their google account anymore because of a botched update.

I guess Google support might get too many reset requests to show due diligence in verifying authenticity of the requests.

Post reply on HN