Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Warning: Google Authenticator upgrade loses all accounts

news.ycombinator.com

Post reply on HN
Print view View original

131–140 of 176 posts

Re: Warning: Google Authenticator upgrade loses all accounts

#131

Post by jobu »

gmac wrote: post #100

Too late for me, but a pleasingly fast and pro-active response from AWS (which rather shows Google up) just received by email: "If you are an AWS customer who uses Google Authenticator for iOS as a multi-factor authentication device to secure your AWS account via AWS MFA ( http://aws.amazon.com/mfa/ ), please read on. We are writing to inform you that Google has recently released an update to the Google Authenticator…

And no word yet from Google... Their lack of customer service is going to end up killing them in a number of markets. I would never use Google for any critical business function (email, payments, cloud computing).

Re: Warning: Google Authenticator upgrade loses all accounts

#132

Post by raverbashing »

henryaj wrote: post #97
chmars wrote: post #94

Earlier quoted context omitted.

Authy wants to 'make data available to nearby bluetooth devices' and – even if you don't allow for it – asks for Bluetooth to be turned on. What's the reason for this requests? I'd appreciate an application directly in the app. In doubt, I simply deny such requests. Screenshots: http://i.imgur.com/jTC5msY.png http://i.imgur.com/seytfhy.png

Authy has a desktop client that can request tokens from your phone via Bluetooth, so you don't need to generate a token and type it in manually. https://www.authy.com/thefuture

Good, so when the user requests a bluetooth connection you ask for permission or tell the user to turn bluetooth on

Don't ask the user to approve something he: doesn't know what you want to do with it and the thing screams "don't do it" at the particular situation

Re: Warning: Google Authenticator upgrade loses all accounts

#133

Post by ydant »

markbao wrote: post #129
skeletonjelly wrote: post #127

Earlier quoted context omitted.

Would this mean that these two values are stored locally? Could they be extracted from the GA app?

Technically, yes. The name of the key is set by default as the account name in the app. I haven't looked into how the secret is stored in the Google Authenticator app—hopefully it's stored securely or with some level of obfuscation, but the app definitely needs to be able to retrieve the secret key somehow to do the token calculation. One thing to note is that neither Google Authenticator nor Duo Security let you dis…

If you've disabled the built in protections on Android for the /data/data/ folder (such as "root"ing it), getting the keys out is as simple as:

$ su

# sqlite3 /data/data/com.google.android.apps.authenticator2/databases/databases 'select email, secret from accounts'

Re: Warning: Google Authenticator upgrade loses all accounts

#135

Post by corresation »

Somewhat related, but when I setup two factor authentication I securely saved the initial TOTP tokens (using barcode scanner to extract it) for exactly this sort of situation (well in my case it was that I switched smartphones enough that having it tied to one was nonsensical).

Re: Warning: Google Authenticator upgrade loses all accounts

#136

Post by nl »

A while ago the Android version was replaced by a new app (instead of just an upgrade), allegedly because the team LOST THE SIGNING KEY FOR THE ORIGINAL APP[1].

If there is one team you'd expect not to lose a signing key I would have thought it would be that one!

Everyone makes mistakes, but it's pretty scary to hear this happening too.

[1] http://www.androidpolice.com/2012/03/22/psa-googles-authenti...

Re: Warning: Google Authenticator upgrade loses all accounts

#137

Post by kmfrk »

jobu wrote: post #131
gmac wrote: post #100

Too late for me, but a pleasingly fast and pro-active response from AWS (which rather shows Google up) just received by email: "If you are an AWS customer who uses Google Authenticator for iOS as a multi-factor authentication device to secure your AWS account via AWS MFA ( http://aws.amazon.com/mfa/ ), please read on. We are writing to inform you that Google has recently released an update to the Google Authenticator…

And no word yet from Google... Their lack of customer service is going to end up killing them in a number of markets. I would never use Google for any critical business function (email, payments, cloud computing).

It's pretty ridiculous that I'll probably move from using GA for my Google accounts to Authy, but here we are.

Re: Warning: Google Authenticator upgrade loses all accounts

#138

Post by kungfooey »

Semaphor wrote: post #109
Tichy wrote: post #87

Earlier quoted context omitted.

Hm, the point of authenticator is to not use the phone, because phjone numbers may be more vulnerable. wasn't there a case of social hacking where the telco forwarded to hacker's phone?

That was a case of them circumventing the 2FA he had, they just granted access. Authenticator is a mobile phone app, how are you supposed not to use your phone with it?

You could set it up on a tablet.

Re: Warning: Google Authenticator upgrade loses all accounts

#139

Post by infinite8s »

josephagoss wrote: post #117
skeletonjelly wrote: post #53

Earlier quoted context omitted.

Have you tested this? Are the barcodes not time pertinent?

Yes I have tested this and it works. Of course make sure those screenshots are safe and encrypted too.

Or print them out and store them in a bank safe...

Re: Warning: Google Authenticator upgrade loses all accounts

#140

Post by nickmain »

rednotebook wrote: post #126
sjg wrote: post #121

Earlier quoted context omitted.

What's even worse is with a certain iOS update that may or may not be launching in the next few weeks will make this advice impossible. 3 words for you - Auto updating apps

Which can be turned off

Which 99% of iOS users won't do even if they are aware of it.
Post reply on HN