Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Your Android Phone Is a Security Key

blog.google

Post reply on HN
Print view View original

111–120 of 144 posts

Re: Your Android Phone Is a Security Key

#111

Post by Johnny555 »

jetrink wrote: post #8
ghaff wrote: post #6

Earlier quoted context omitted.

I'd argue using Authenticator is better than simply not using 2FA. Which is probably the choice for a lot of people for whom always carrying some dedicated hardware device is not really a realistic option.

In what way is carrying a dedicated device not realistic? My second factor lives on my keyring and is only a bit larger than a typical door key. Everyone carries keys.

I don't normally drive a car (I take transit to work) so I don't carry car keys. I have an electronic lock on my door at home, so I don't carry house keys. I don't carry keys of any type.

My phone case has a slot for credit cards, so all I normally carry with me is my phone, a credit card, my work badge, and my transit pass.

Re: Your Android Phone Is a Security Key

#112

Post by Dylan16807 »

layoutIfNeeded wrote: post #77
eitland wrote: post #38

Earlier quoted context omitted.

Heh, Microsoft seems better than Google to support Linux in new products now. VS Vode is amazing, as is dotnet core. Who would have thought 5 years ago.

Of course they do. This is the “embrace” phase.

I could see an argument about WSL being that. But making your software work on the linux desktop/server? I really don't see how that lets you get into a position toward extinguishing anything.

Re: Your Android Phone Is a Security Key

#113

Post by doughj3 »

binarycrusader wrote: post #110
doughj3 wrote: post #105

Earlier quoted context omitted.

Sorry for being thick, but I'm not seeing it. This is a G-suite account (though I'm the only user / admin) so maybe it's different.

From my G-Suite account (where I'm the only user / admin), it shows two-step verification settings here: https://myaccount.google.com/signinoptions/two-step-verifica...

That seems to redirect me to the same page linked earlier in this thread (https://myaccount.google.com/security). Taking a look in my admin console, it looks like "Allow users to turn on 2-step verification" is unchecked, so presumably 2-step verification is not enabled for this account. That's exactly what I want, but it seems Google is failing to abide when they think I'm a "hacker". Other people have had the same frustrations[0][1] but there is apparently no way to stop Google requiring additional verification at their whim. Ultimately that means Google controls when I can and can't login to my account, so it ceases to be a usable product for me.

I appreciate your help, though!

[0] https://support.google.com/mail/forum/AAAAK7un8RUP1RC23nwRZ4

[1] https://support.google.com/mail/forum/AAAAK7un8RUZvZQQfsawrE

Re: Your Android Phone Is a Security Key

#114

Post by arnarbi »

plttn wrote: post #102
gretch wrote: post #100

Earlier quoted context omitted.

disclosure: I work at google The thing you have now communicates that yes click over the internet. This new thing communicates through a local channel (bluetooth). Communicating over a local channel prevents phishing. Consider this attack: Attacker hosts googlee.com and you get tricked into going there. The login site looks exactly like the google site. You type in username/password just like normal. In that moment t…

As there's very little documentation on this right now: couple of related questions (feel free to ignore them I don't want to guilt you into it) 1. It doesn't seem to be using the Titan M flow on my Pixel 3 currently 2. After reinstalling GMS on my phone to try and get the Titan M working, it stayed registered as a key, but the prompt never shows up on my device. I guess this is more of a "flag for internal review" v…

Thanks for this! I'm the TL for this at Google.

Re 1: The Titan-M specific flow is still rolling out, you should see your phone switch to the volume-down UI soon.

Re 2: I've flagged this and we'll look into it.

Re: Your Android Phone Is a Security Key

#115

Post by arnarbi »

daphneokeefe wrote: post #20

Can someone explain how TFA (or any security feature that relies on my phone) works when the phone is unresponsive -- dead battery, no cell or internet reception, hardware failure.

The feature described in the article will work when your phone is offline. We'll publish instructions soon on how, but it will e.g. involve manually waking the screen to trigger the local communication.

Of course it won't work if your battery is dead. :)

Re: Your Android Phone Is a Security Key

#116

Post by arnarbi »

munchbunny wrote: post #29

Is this based on a hardware security module in the phone? I don't see this written anywhere in the blog post. For something like this, especially with your phone, putting the private keys out of reach of the CPU/memory and hardened against side channel attacks is table stakes.

For phones that have a dedicated hardware module, such as the Pixel 3, yes the key material is generated and stored there. Using it requires a physical action that is hardwired to the hardware module.

We think the most pressing need right now is to protect users against phishing, which is a much larger threat than malware. Thus we think there's a lot of value in enabling this for all phone models where it's possible to run the protocols.

(I'm the TL for this at Google)

Re: Your Android Phone Is a Security Key

#117

Post by kkarakk »

doughj3 wrote: post #22

> Now, you have one more option—and it’s already in your pocket. Starting today in beta, your phone can be your security key—it’s built into devices running Android 7.0+. You know, it's nice they phrase this as an "option", but in my experience Google has the habit of forcing me to have my phone on me when I login from a new location / new device, something I never asked for and apparently cannot disable.[0] This has…

I think it makes sense to me, security that only works part of the time can be bypassed when it doesn't work.

However i've never encountered a TFA service that let you disable it in certain scenarios so i may be wrong

Re: Your Android Phone Is a Security Key

#118

Post by arnarbi »

markstos wrote: post #57

Looks like Google has used the open Web Bluetooth specification (that only Chrome currently supports) along with the open FIDO Bluetooth spec ( https://fidoalliance.org/specs/fido-u2f-v1.2-ps-20170411/fid... ). A read-only, non-wireless security key like Yubikey would be even more secure, but this is an improvement over TOTP codes, which can be phished. This is also better than SMS 2FA, which is prone to phone-number…

This does not use Web Bluetooth, but rather an implementation directly in the browser through WebAuthn. A critical part of the phishing resistance of WebAuthn is that websites do not get to talk directly to the authenticator.

To make this work, we made an extension to WebAuthn+FIDO for pairing-free BLE as Rafert points out. We're already in the process of making that open together with these standards bodies, stay tuned!

Re: Your Android Phone Is a Security Key

#119

Post by arnarbi »

duxup wrote: post #9

My phone already prompts me when I login to a google account on another device. Is this new / different?

As others pointed out, the difference is that the local connection to the phone, together with the Webauthn+FIDO protocols make this resistant to phishing.

That comes at the cost of needing Bluetooth, which isn't available on all computers. I.e. it's more secure than the prompt you have now, but that will at least work everywhere.

The right tradeoff between the security and the convenience/availability is something that is very context-dependent, and different for each user. Hence the multiple options.

Re: Your Android Phone Is a Security Key

#120

Post by arnarbi »

godelski wrote: post #79
godelski wrote: post #10

This is great. Hopefully it'll get more people using 2FA. I don't think this is the best security practice, as others are nothing how insecure Android is. But it's better than nothing. It also pushes more people to use FIDO and 2FA. This is for the average person. If you want more get an yubi key or something.

Edit after trying: It is a little disappointing that it is Chrome only.

Implementing and maintaining the code in the browser that manages the local BLE channel to a FIDO authenticator is unfortunately a significant undertaking.

We (the team behind this at Google) work actively with FIDO and the W3C on the open standards behind this so that other browsers can support this as well in the future.

Post reply on HN