Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Downsides of Google Authenticator

zdnet.com

Post reply on HN
Print view View original

131–139 of 139 posts

Re: Downsides of Google Authenticator

#131

Post by lima »

diebeforei485 wrote: post #113
lima wrote: post #4

Strongly disagree with the premise of this article: - Passcode or biometric locks on an app are a gimmick and offer negligible value. - The keys not being backed up or or synchronised across devices is not a bug, but a feature. You're supposed to keep offline backup keys. Any sort of synchronization feature adds a ton of attack surface. - In particular, Authy, LastPass and 1password have a giant attack surface compar…

This sort of user-hostile approach is not a net positive for security, because most people don't want to have a bunch of offline backup codes for each one of the hundreds of websites they have signed up with.

Yes, but that is because TOTP is user-hostile. The solution is to migrate to a more secure and less hostile mechanism, not to compromise on security.

Re: Downsides of Google Authenticator

#132

Post by lima »

renton_tacos wrote: post #81
lima wrote: post #49

Earlier quoted context omitted.

> It is incorrect to say that they "are a gimmick and offer negligible value". I'm well aware of how the mechanism works. If the host OS or the app is compromised, it won't help - the attacker can just steal the codes after they're unlocked by the enclave. For physical theft, it only provides a meaningful advantage if the phone is unlocked. Someone stealing your unlocked phone to get at your 2FA codes is well outside…

>If the host OS or the app is compromised, it won't help - the attacker can just steal the codes after they're unlocked by the enclave. If the host OS or app is compromised, then it absolutely helps! The codes cannot be stolen until the user unlocks. Considering that the most recent iOS jailbreak was not persistent, due to their chain or trust, this is absolutely helpful. It's one component of defense in depth. In a…

I agree with you that it's a good defense in depth measure for exactly the reasons you describe.

Re: Downsides of Google Authenticator

#133

Post by dillondoyle »

camgunz wrote: post #102
dillondoyle wrote: post #83

Earlier quoted context omitted.

I'm curious about LastPass - it's what I use and work in politics.. Their security page says encrypted on device [1] before sending to them? is that not trustworthy or I'm not understanding? or maybe worried about compromised devices (where it's over anyways)? 1: https://www.lastpass.com/enterprise/security

I'd recommend 1password over LastPass. LastPass has had some real facepalm security issues, and 1Password has a reputation for passing some pretty strenuous audits. We used LastPass on the tech team at HFA and... I think everyone I know has switched to 1Password or something else. I do 1Password and Yubikeys.

thanks! I used to use 1password - are you sure there haven't been similar problems? [1] I'm happy to switch but it's hard to know what to trust without being a subject matter expert here...

https://www.theregister.co.uk/2017/02/28/flaws_in_password_m...

Re: Downsides of Google Authenticator

#134

Post by dnr »

kureikain wrote: post #127
dnr wrote: post #89

Earlier quoted context omitted.

I've used Google Authenticator for a long time, but the lack of backups is a really serious downside. What I would really like is encrypted backups using a strong passphrase that I can write down on paper (like Authy), but from a trusted source like Google, and with no other features to widen the attack surface (no internet access, no SMS). Without backups, having a phone die or get lost is a very frustrating experie…

Hi David, I built exactly this: https://github.com/yeo/bima I stored everything into a SQLite in `~/.bima/bima.db` Your OTP secret is encrypted using a master password that you chooese. I use AES GCM for encryption: https://github.com/yeo/bima/blob/master/shield/encrypt.go#L1... You then has 2 options to backup/sync among device it: 1. backup that file using dropbox, icloud, google drive 2. Enable sync to my backend.…

I definitely want to keep 2fa secrets on a phone, not my laptop, otherwise it's not a true second factor. If you have an Android build to try, I'll check it out.

Also, part of my ideal requirements is an app built by an entity that I trust as much as Google. Open source is great, and this app is simple enough that I can skim the code once, but I'm not going to do it for every update, and I might miss something. There's still something to be said for that kind of accumulated trust. (I might not trust Google as much as I used to, but I still keep my life on gmail, so I have to trust them pretty far.)

Re: Downsides of Google Authenticator

#135

Post by dnr »

eikenberry wrote: post #120
dnr wrote: post #89

Earlier quoted context omitted.

I've used Google Authenticator for a long time, but the lack of backups is a really serious downside. What I would really like is encrypted backups using a strong passphrase that I can write down on paper (like Authy), but from a trusted source like Google, and with no other features to widen the attack surface (no internet access, no SMS). Without backups, having a phone die or get lost is a very frustrating experie…

Use the text based secret and save a copy in an encrypted file and keep it on a usb memory stick. Put that in a safety deposit box if are paranoid enough. Either way, you lose your phone you have all your auth secrets available to re-enter.

Right, so ideally I would like to keep something in a safe deposit box (or similar), but the point is I don't want to keep going back and forth to the bank every time I sign up for a new account with 2fa. That's why I want one long-lived secret that I can put there, and have the TOTP secrets encrypted with that one.

Re: Downsides of Google Authenticator

#136

Post by trickstra »

Karunamon wrote: post #62
inetknght wrote: post #60

Earlier quoted context omitted.

> That is not very civil of you. I think @trickstra was quite civil in their comment. And they also brought up a completely valid point: > > And you cannot change it like a password. So that's why it's a gimmick. Regardless of threat model, not being able to change biometrics makes them very high value to an opposing force. Using biometrics "for the masses" to whom they don't have that completely different threat mod…

I'd say the threat model is critical. If your adversary is a state power targeting you personally, you have already lost. They'll just throw you in jail, or worse, until you put your thumb on the button. If your adversary is a random thief, or the untrustworthy general public, then it works great, and is a significant upgrade from the zero security that most people had prior to the proliferation of biometrics on phon…

You are missing the point - it would be an upgrade, if it wasn't coupled with the proliferation of random apps scanning faces and fingerprints and people randomly giving out their biometrics to anyone. It won't take long before script kiddies will crawl the internet using the latest biometric leak just checking which other services the victims used.

Re: Downsides of Google Authenticator

#137

Post by manicdee »

latchkey wrote: post #72
danShumway wrote: post #34

Last time I checked, by default, Authy codes were susceptible to SIM-swap attacks.[0] This is a bad article. You should perhaps consider switching off of Authenticator to an Open Source manager like AndOTP; I think that's something reasonable to propose. But I don't understand the argument that I should be very concerned a lack of biometric locks, but not concerned about invalidating the "something you have " part of…

Authy only has SIM issues if you give it your phone number. Don't do that.

The only time I have ever seen Authy recommended was by sites using SMS TFA.

I wanted to use TOTP or a challenge-response key but none of the sites I use Authy for support that.

Re: Downsides of Google Authenticator

#138

Post by parasense »

I'm not sure the author on zdnet understand the security implications for "Device surfing". That is conceptually convenient, but really a terrible idea! A new token should be generated for each separate device, but not all token providers support multiple floating tokens.

It's always a battle of convinience versus security, and I get it... people think that because some services have lowered security to allow device surfing, yet without knowing the implications, that it's then just some kind of abstract non-issue taken care of by magical security things not understood. In other words it takes a big leap of faith, that was improper.

Re: Downsides of Google Authenticator

#139

Post by camgunz »

dillondoyle wrote: post #133
camgunz wrote: post #102

Earlier quoted context omitted.

I'd recommend 1password over LastPass. LastPass has had some real facepalm security issues, and 1Password has a reputation for passing some pretty strenuous audits. We used LastPass on the tech team at HFA and... I think everyone I know has switched to 1Password or something else. I do 1Password and Yubikeys.

thanks! I used to use 1password - are you sure there haven't been similar problems? [1] I'm happy to switch but it's hard to know what to trust without being a subject matter expert here... https://www.theregister.co.uk/2017/02/28/flaws_in_password_m...

Oh yeah it's had issues. As a more paranoid than most user I don't use the browser extension or the internal browser in the mobile app, which I catch more than a little flak for haha.

Mostly I'm making an appeal to authority to tptacek [1].

https://duckduckgo.com/?q=tptacek+1password+site%3Anews.ycom...

Post reply on HN