151–160 of 176 posts
Earlier quoted context omitted.
What's even worse is with a certain iOS update that may or may not be launching in the next few weeks will make this advice impossible. 3 words for you - Auto updating apps
Which can be turned off
Chris Messina has a solution: https://twitter.com/chrismessina/status/375118991280205824
That's only good for Google accounts. Dropbox and others aren't reset as easily.
You can also recover your Dropbox account from any connected computer. It'll log you in on the web console without a password or 2FA.
Earlier quoted context omitted.
Sure, in the same way that MD5 is (although you'd want to use PBKDF2 instead of MD5). But you can't actually encrypt with PBKDF2 itself, much like you can't with MD5
From the linked discussion ([3] above): > 1. We use a 256 bit key derived using a salt and PBKDF2. > 2. AES is used in CBC mode with a different IV for each account. > 3. The key is store on the cellphone only and is never transmitted
Depending on the actual implementation (if everything is just one encrypted blob or if individual records are encrypted separately) using the same IV for all data in one account can be pretty bad.
Earlier quoted context omitted.
Authy wants to 'make data available to nearby bluetooth devices' and – even if you don't allow for it – asks for Bluetooth to be turned on. What's the reason for this requests? I'd appreciate an application directly in the app. In doubt, I simply deny such requests. Screenshots: http://i.imgur.com/jTC5msY.png http://i.imgur.com/seytfhy.png
It gets even more confusing: Authy asks me for my mobile phone number – once to 'securely identify' me and once to create an account, apparently with Authy. Why is an account necessary for such an app? Can't I use Authy without an account?
Not an iPhone user, but I wonder if you could access the key data manually and restore it afterwards? On Android that's possible (if you have root....) by accessing the key database (sqlite in that case). I did that to duplicate the keys from my handset to my tablet.
Yes, if you have synced with iTunes before the update. If that's the case you have to delete the updated app from the phone, connect phone to iTunes (do not sync or transfer purchases) and copy over the old app from iTunes to phone and it will restore the old version + app data.
Earlier quoted context omitted.
And no word yet from Google... Their lack of customer service is going to end up killing them in a number of markets. I would never use Google for any critical business function (email, payments, cloud computing).
They'll join this thread in a while and call us all novices for not understanding that this is deliberate, well tested, and our fault. https://news.ycombinator.com/item?id=6166886
Not defending Google, but pointing out the sweeping generalization.
I am considering wiping my phone and restoring it from a previous backup with the old copy of the app.
Edit: I was still logged in from my browser, and was able to activate the new version without entering a code from the deceased version of the app.
From this, it seems theft of your cookies could let an attacker completely take over your account and two-factor device if they know your account password and you have chosen to trust the victim computer.
For those looking for Google Authenticator alternatives, I recommend either Duo Mobile from Duo Security or Authy. I ditched Google Authenticator a while ago and haven't missed it one bit -- having a single app manage my two-factor tokens / keys is much more convenient.
I switched to HDE-OTP[0] a while ago and never looked back. I've not encountered any bugs with it and it's also better looking. [0] https://itunes.apple.com/gb/app/hde-otp-generator/id57124032...
Too late for me, but a pleasingly fast and pro-active response from AWS (which rather shows Google up) just received by email: "If you are an AWS customer who uses Google Authenticator for iOS as a multi-factor authentication device to secure your AWS account via AWS MFA ( http://aws.amazon.com/mfa/ ), please read on. We are writing to inform you that Google has recently released an update to the Google Authenticator…