Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Warning: Google Authenticator upgrade loses all accounts

news.ycombinator.com

Post reply on HN
Print view View original

161–170 of 176 posts

Re: Warning: Google Authenticator upgrade loses all accounts

#161

Post by dunham »

MiguelHudnandez wrote: post #157

Shit. I am running the iOS 7 beta with automatic app updates, and I already have the new app. I am considering wiping my phone and restoring it from a previous backup with the old copy of the app. Edit: I was still logged in from my browser, and was able to activate the new version without entering a code from the deceased version of the app. From this, it seems theft of your cookies could let an attacker completely…

If you have a password on your backups, the codes are in your backed-up keychain. (Google Authenticator doesn't mark its keychain entries as "keep on device".) You'll need to patch iphone-dataprotection to handle a the iOS7 keychain format (I added a patch to the bug tracking database.)

Re: Warning: Google Authenticator upgrade loses all accounts

#163

Post by gbraad »

Luckily got a AWS reminder. And a shameless plug... my own 2FA app on http://gauth.apps.gbraad.nl can be used everywhere you have a webbrowser, offline when your browser supports it and updates without problems when a new version is available. Besides, no updates were needed in months due to good QA. ;-)

Re: Warning: Google Authenticator upgrade loses all accounts

#164

Post by swalkergibson »

DigitalSea wrote: post #124

Do Google even test the stuff they put out? This is a pretty severe mistake to make for a company as big as Google. Do they not have teams dedicated to testing this stuff? The small design studio I work at does a better job QA'ing their websites than Google does QA'ing major product upgrades... Disgraceful.

Don't be ridiculous. Of course they QA their projects. Shit happens. This issue is of a serious enough nature affecting enough people that there will almost certainly be a proper route back.

Re: Warning: Google Authenticator upgrade loses all accounts

#165

Post by serf »

nl wrote: post #136

A while ago the Android version was replaced by a new app (instead of just an upgrade), allegedly because the team LOST THE SIGNING KEY FOR THE ORIGINAL APP [1]. If there is one team you'd expect not to lose a signing key I would have thought it would be that one! Everyone makes mistakes, but it's pretty scary to hear this happening too. [1] http://www.androidpolice.com/2012/03/22/psa-googles-authenti...

woah, a crypto software team lost a signing key.

that's no good.

Re: Warning: Google Authenticator upgrade loses all accounts

#166

Post by Semaphor »

kungfooey wrote: post #138
Semaphor wrote: post #109

Earlier quoted context omitted.

That was a case of them circumventing the 2FA he had, they just granted access. Authenticator is a mobile phone app, how are you supposed not to use your phone with it?

You could set it up on a tablet.

Which are still quite a bit rarer than smartphones. Plus it makes your password way less portable.

Re: Warning: Google Authenticator upgrade loses all accounts

#167

Post by MiguelHudnandez »

zimpenfish wrote: post #106
dan1234 wrote: post #73

Earlier quoted context omitted.

I switched to HDE-OTP[0] a while ago and never looked back. I've not encountered any bugs with it and it's also better looking. [0] https://itunes.apple.com/gb/app/hde-otp-generator/id57124032...

You have a beautiful screen on your iPhone with great font rendering and ... it mimics a 7 segment LCD display. For shame.

Almost like building a notes app and putting leather stitching all around it.

Skeumorphism is dying, thankfully.

Re: Warning: Google Authenticator upgrade loses all accounts

#168

Post by matunos »

shurcooL wrote: post #156
madaxe wrote: post #147

Earlier quoted context omitted.

They'll join this thread in a while and call us all novices for not understanding that this is deliberate, well tested, and our fault. https://news.ycombinator.com/item?id=6166886

Because all companies always act like one of its employees did one time. Not defending Google, but pointing out the sweeping generalization.

To be fair, that wasn't just "one of its employees", it was the head of Google Chrome Security.

Re: Warning: Google Authenticator upgrade loses all accounts

#169

Post by Tichy »

Semaphor wrote: post #109
Tichy wrote: post #87

Earlier quoted context omitted.

Hm, the point of authenticator is to not use the phone, because phjone numbers may be more vulnerable. wasn't there a case of social hacking where the telco forwarded to hacker's phone?

That was a case of them circumventing the 2FA he had, they just granted access. Authenticator is a mobile phone app, how are you supposed not to use your phone with it?

I measnt not use the phone network, because the SMS could be diverted.

Re: Warning: Google Authenticator upgrade loses all accounts

#170

Post by CamperBob2 »

madaxe wrote: post #147
jobu wrote: post #131

Earlier quoted context omitted.

And no word yet from Google... Their lack of customer service is going to end up killing them in a number of markets. I would never use Google for any critical business function (email, payments, cloud computing).

They'll join this thread in a while and call us all novices for not understanding that this is deliberate, well tested, and our fault. https://news.ycombinator.com/item?id=6166886

I don't think the people arguing with Justin in that thread are novices or naive users, but they do seem to be unaware that when you lend your computer to someone, you should set them up with their own user account if you don't want them surfing through your stuff.

It's funny how the tech community browbeat Microsoft for years about how Windows should have been designed as a multiuser system like Unix, and then when Microsoft finally took their advice and made the necessary user-level security improvements, their efforts were ignored.

Post reply on HN