Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Please turn on two-factor authentication

mattcutts.com

Post reply on HN
Print view View original

171–180 of 262 posts

Re: Please turn on two-factor authentication

#171

Post by peterwwillis »

staticfish wrote: post #165
nagisa wrote: post #147

Earlier quoted context omitted.

You still need to hunt for phone (on top of that you must have one) to log in...

Be honest. When was the last time you were sitting at your (or any other) machine while away from your mobile phone? Also, you only need the authenticator revolving token every 30 days.

What do you mean you only need it every 30 days? You keep the same session active for 30 days?!

(And yes, I don't keep my phone next to me when i'm at home. Half the time i'm trying to figure out where the hell I left it)

Re: Please turn on two-factor authentication

#172

Post by sigkill »

roc wrote: post #106
smackfu wrote: post #97

OK, so I turn on two-factor authentication for GMail, but... 1) I immediately have to create a application specific password to actually read my mail on my iPhone. 2) If anyone ever gets access to that secret password, or any of the others I create, they have full access to my email and any password resets they generate. 3) I will have no idea this is happening since I would expect my mail to access that app password…

You only type that application specific password once. You're not typing it to log in via wifi at coffee shops, airports, etc. You're not typing it every day for a keylogger to pick up, should your machine be compromised in the future. You're not typing it into borrowed machines or net cafe machines in some hotel business center. So, no, it isn't perfect, but it's a heck of an improvement. That is, if you believe you…

Calling it an "application specific password" is actually a misnomer. WE create the app-labels. For all practical purposes it's a backdoor entry into your account.

So, I'd say for absolute 2FA, you must give up Chrome browser profiles, device mail sync (till Google comes up with a compatible client) and Google Talk/any Jabber client. I don't care about Chrome browser profiles but I need/want my Android phone to have full connectivity viz. push mail and gtalk access to my account. I could always keep a separate browser window on the PC with my gmail signed in and IM notifications enabled for my third point.

Overall, I feel losing my Android connectivity is not worth the 2FA.

Re: Please turn on two-factor authentication

#173

Post by girlvinyl »

_delirium wrote: post #46
nl wrote: post #11

Earlier quoted context omitted.

You can run the Authenticator app on an iPod. But 2-factor does mean there in an expectation you will have to carry some kind of token device.

You shouldn't have to carry an electronic device, though: a list of codes on paper can work fine. That's how the NemID system works, for example ( http://en.wikipedia.org/wiki/NemID ): I have a big list of challenge/response codes that I carry in my wallet, and each is used once. I use that one successfully to log into my bank with two-factor authentication, but since I have no cell phone, iPod, iPad, or Android devi…

You're not limited to 10 total, you're just limited to 10 at a time. Once you use those up, you just go get more.

Re: Please turn on two-factor authentication

#174

Post by peterwwillis »

teraflop wrote: post #164
peterwwillis wrote: post #159

Earlier quoted context omitted.

That, and I don't trust "an app." The whole reason I want a second factor is to get away from computers as primary authentication mediums, and a smart phone is a computer. I don't think anyone realizes how much malware is in the Android marketplace. And that's beside the malware that vendors and carriers install on there by default. Do not trust your phone.

The Authenticator app is open-source [1] and extremely minimal. It doesn't run with permissions to access any data on the phone, or even communicate over the network; all it does is read the system clock every 30 seconds and compute an HMAC. [1] http://code.google.com/p/google-authenticator/

The app isn't what worries me, it's what else is running on the phone. Android malware comes in the form of a rootkit, usually, which means it has total control over your device.

Not scared? How about this article[1] from over a year ago, which details over 50 apps in the Marketplace using a rootkit which not only controls anything you do, but can download new code to keep changing at a whim?

[1] http://www.guardian.co.uk/technology/blog/2011/mar/02/androi...

Re: Please turn on two-factor authentication

#175

Post by esolyt »

JunkDNA wrote: post #31

I was worried this would be a major pain when I enabled it, but I have to say, it has been much more painless than I thought it would be. Most of the time, I don't even think about it. Most of my consumption of google mail is through clients on my laptops, iPhone, or iPad. So in that sense, it's not much different from a regular password. The difference is that someone else has a much harder time cracking my account.…

Yes, it would. The idea behind two factor authentication is that an attacker now needs two things to access your account: Your password and your phone. With two factor authentication, even if an attacker acquires or changes your password (which is what happened in Matt's case), they still won't be able to login to your account.

Re: Please turn on two-factor authentication

#177

Post by mike-cardwell »

bcl wrote: post #86
mike-cardwell wrote: post #69

I hear a lot of people advising to turn on two factor auth on Google because of this incident, but I haven't heard anyone say that we should be deleting our card details from Amazon. Well, I have, and you should too. Lots of places use the last 4 digits of your card as "authentication", and Amazon happily displays those details in your account.

Note that they had to break into the account in order to view those last 4 digits. You seem to be implying that they show them to anyone. Either way, using the last 4 digits as 'security' is just stupid. You can get those from a receipt.

I implied nothing of the sort.

Just because a hacker can get the last 4 digits by physically being near you so they can obtain your receipts, doesn't mean that it's therefore worthless to remove that capability from hackers who are not physically near you.

Besides, you should be shredding/burning your receipts anyway.

Re: Please turn on two-factor authentication

#178

Post by mithaler »

smackfu wrote: post #85
Karunamon wrote: post #83

The reason I'm not using 2FA right now is twofold. First, because Google doesn't have half of their services using it for some undefined reason (for at least a year plus!). Also, the whole "app specific password" thing is a huge pain in the ass. (And appears to randomly stop working on say, IMAP mail). Second, because the mobile authenticator is not feasible for me right now. I do a lot of android development work (w…

Yes, can someone explain why Google Chrome doesn't support 2FA on the desktop or iOS? It's bizarre. (Well, I suppose it's tragically normal. I'm sure there is a corporate directive that says every Google service must support 2FA, but Chrome has an exception so they don't need to do it yet.)

Dunno about iOS, but Chrome does on the desktop; it asks you for an application-specific password when you turn on sync.

Re: Please turn on two-factor authentication

#179

Post by mike-cardwell »

tammer wrote: post #140

Quick question for all you security experts: Which is more secure: LastPass with 2factor, or a gpg encrypted password safe on my home server accessed by a passphrase-locked rsa-encrypted key? I've been trying to decide for the past few weeks. Copying and pasting passwords isn't as annoying as I thought it would be, and it seems like keeping my pwsafe locally reduces the attack vector of the LastPass servers. Then aga…

LastPass is only one persistent XSS flaw away from having your password store completely compromised. I found a non-persistent one last year which exposed a lot of information about you, but not your password:

https://grepular.com/LastPass_Vulnerability_Exposes_Account_...

Specifically it exposed your email address, your password reminder, the list of sites you log into and the history of your logins, including which sites you logged into, the time and dates you logged into them, and the IP addresses you logged in from.

EDIT: I used to use LastPass but now I use a GPG encrypted file, which I sync between machines. I set up a simple helper script so I can just type for example "password facebook" at a terminal and it will do a gpg --decrypt on the text file, grab the facebook password, display it, and also copy it into my clipboard for ten seconds.

Re: Please turn on two-factor authentication

#180

Post by wccrawford »

loeschg wrote: post #151
JunkDNA wrote: post #31

I was worried this would be a major pain when I enabled it, but I have to say, it has been much more painless than I thought it would be. Most of the time, I don't even think about it. Most of my consumption of google mail is through clients on my laptops, iPhone, or iPad. So in that sense, it's not much different from a regular password. The difference is that someone else has a much harder time cracking my account.…

I used two-factor authentication for about a year, and I just got so sick of it. I had no issue with the whole logging in and using the time-sensitive code from my Android phone. It was the support for all the other Google apps that drove me crazy. I got really tired of needing to generate new temporary passwords for access through iCal, Mail, and I think even sites like StackOverflow. Perhaps I was at a point in lif…

Plus, don't the special passwords for specific apps (that don't use 2-factor auth) violate the whole point of 2-factor in the first place?

Now, you've got several passwords that work, instead of 1 and a keyfob. Ugh.

Edit: Apparently, you can't log into the web interface with those passwords. That's a step in the right direction, but still not fully secure.

Post reply on HN