Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Bypassing Google’s Two-Factor Authentication

blog.duosecurity.com

Post reply on HN
Print view View original

11–20 of 75 posts

Re: Bypassing Google’s Two-Factor Authentication

#11

Post by Zikes »

6thSigma wrote: post #9

So the security risk requires someone to somehow get your ASP? Correct me if I'm wrong, but I believe you can only make a new ASP when you are already signed in and it disappears after you 'hide' it or leave the page. It kind of seems like if you can get a user's ASP, the account is probably already compromised. It's nice that they are fixing a couple loopholes, but not sure if it will actually help any.

Presumably the ASP could be intercepted via MITM, when it's being passed to the application for which it was generated.

Re: Bypassing Google’s Two-Factor Authentication

#12

Post by xyzzyz »

Could anyone explain to me what's the point of Google's two-factor authentication? I mean, before that, I used to have one password I had to guard carefully, and now I have ten passwords I have to guard carefully, and the one I enter most often requires me to additionally type some digits I have to read from my smartphone? What plausible attack scenario does two-factor authentication protect me from?

Re: Bypassing Google’s Two-Factor Authentication

#13

Post by Inufu »

xyzzyz wrote: post #12

Could anyone explain to me what's the point of Google's two-factor authentication? I mean, before that, I used to have one password I had to guard carefully, and now I have ten passwords I have to guard carefully, and the one I enter most often requires me to additionally type some digits I have to read from my smartphone? What plausible attack scenario does two-factor authentication protect me from?

If I want to hack your account, it's not enough to steal your password, I also need to steal your smartphone to generate the tokens.

edit: I was referring to the Google Authenticator App, not sending the codes over SMS. That's imho less secure.

Re: Bypassing Google’s Two-Factor Authentication

#14

Post by cryptoz »

xyzzyz wrote: post #12

Could anyone explain to me what's the point of Google's two-factor authentication? I mean, before that, I used to have one password I had to guard carefully, and now I have ten passwords I have to guard carefully, and the one I enter most often requires me to additionally type some digits I have to read from my smartphone? What plausible attack scenario does two-factor authentication protect me from?

The really funny situation regarding the phone is that Google makes you do this when logging in on your phone too. So if you go buy a new phone, in order to log in you will have to undergo a few failed attempts, use their web log in form, which SMSs a password to the very same device you're using in the first place.

Re: Bypassing Google’s Two-Factor Authentication

#15

Post by stephengillie »

jgrahamc wrote: post #2

Interesting read as bypassing the same thing was needed for this hack: http://blog.cloudflare.com/the-four-critical-security-flaws-...

I said it then, I'll say it again -- The solution is obvious: allow per-password permissions.

For instance, if I make an app-specific password to sync my bookmarks, that password shouldn't provide access to my Gmail or my settings. Why isn't this already a feature?

Re: Bypassing Google’s Two-Factor Authentication

#16

Post by 6thSigma »

Shank wrote: post #10
6thSigma wrote: post #9

So the security risk requires someone to somehow get your ASP? Correct me if I'm wrong, but I believe you can only make a new ASP when you are already signed in and it disappears after you 'hide' it or leave the page. It kind of seems like if you can get a user's ASP, the account is probably already compromised. It's nice that they are fixing a couple loopholes, but not sure if it will actually help any.

The main issue with this is the automatic login functionality. If a person has 2 factor enabled on their account, and any of their devices (phones, tablets, etc) are stolen, it becomes trivial to act without a password to steal the entire account. If they have a lock screen password, it becomes harder to attack, but any compromised device would likely give an attacker a few hours prior to a user noticing and killing…

The loop hole seems to require the plain text ASP though.

Re: Bypassing Google’s Two-Factor Authentication

#17

Post by [deleted] »

Inufu wrote: post #13
xyzzyz wrote: post #12

Could anyone explain to me what's the point of Google's two-factor authentication? I mean, before that, I used to have one password I had to guard carefully, and now I have ten passwords I have to guard carefully, and the one I enter most often requires me to additionally type some digits I have to read from my smartphone? What plausible attack scenario does two-factor authentication protect me from?

If I want to hack your account, it's not enough to steal your password, I also need to steal your smartphone to generate the tokens. edit: I was referring to the Google Authenticator App, not sending the codes over SMS. That's imho less secure.

[deleted]

Re: Bypassing Google’s Two-Factor Authentication

#18

Post by objclxt »

xyzzyz wrote: post #12

Could anyone explain to me what's the point of Google's two-factor authentication? I mean, before that, I used to have one password I had to guard carefully, and now I have ten passwords I have to guard carefully, and the one I enter most often requires me to additionally type some digits I have to read from my smartphone? What plausible attack scenario does two-factor authentication protect me from?

Because the code is sent to a device Google know you have had physical possession of in the past. It's either sent by SMS, voice call, or to a pre-registered mobile app.

The general point of two factor authentication is that you need physical access to something (phone, token generator, etc), meaning that if somebody across the world knew your password they'd still be unable to cause any damage - or rather, it would take a lot more effort.

Re: Bypassing Google’s Two-Factor Authentication

#19

Post by cryptoz »

objclxt wrote: post #18
xyzzyz wrote: post #12

Could anyone explain to me what's the point of Google's two-factor authentication? I mean, before that, I used to have one password I had to guard carefully, and now I have ten passwords I have to guard carefully, and the one I enter most often requires me to additionally type some digits I have to read from my smartphone? What plausible attack scenario does two-factor authentication protect me from?

Because the code is sent to a device Google know you have had physical possession of in the past. It's either sent by SMS, voice call, or to a pre-registered mobile app. The general point of two factor authentication is that you need physical access to something (phone, token generator, etc), meaning that if somebody across the world knew your password they'd still be unable to cause any damage - or rather, it would…

> Because the code is sent to a device Google know you have had physical possession of in the past. It's either sent by SMS, voice call, or to a pre-registered mobile app.

None of those connect to device you've had "physical possession in the past". Only the present. Phone calls, SMS and apps are all portable across hardware.

Re: Bypassing Google’s Two-Factor Authentication

#20

Post by sbronstein »

> We think it’s a rather significant hole in a strong authentication system if a user still has some form of “password” that is sufficient to take over full control of his account.

I don't really understand this sentence...they say that Google (post-fix) no longer enables access to security-specific pages unless you do two factor auth, so doesn't that mean that post-fix you cannot fully take over someone's Google account without two factor auth?

Post reply on HN