Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Bypassing Google’s Two-Factor Authentication

blog.duosecurity.com

Post reply on HN
Print view View original

21–30 of 75 posts

Re: Bypassing Google’s Two-Factor Authentication

#21

Post by 6thSigma »

cryptoz wrote: post #14
xyzzyz wrote: post #12

Could anyone explain to me what's the point of Google's two-factor authentication? I mean, before that, I used to have one password I had to guard carefully, and now I have ten passwords I have to guard carefully, and the one I enter most often requires me to additionally type some digits I have to read from my smartphone? What plausible attack scenario does two-factor authentication protect me from?

The really funny situation regarding the phone is that Google makes you do this when logging in on your phone too. So if you go buy a new phone, in order to log in you will have to undergo a few failed attempts, use their web log in form, which SMSs a password to the very same device you're using in the first place .

I think that's what the ASPs are for.

Re: Bypassing Google’s Two-Factor Authentication

#22

Post by xyzzyz »

objclxt wrote: post #18
xyzzyz wrote: post #12

Could anyone explain to me what's the point of Google's two-factor authentication? I mean, before that, I used to have one password I had to guard carefully, and now I have ten passwords I have to guard carefully, and the one I enter most often requires me to additionally type some digits I have to read from my smartphone? What plausible attack scenario does two-factor authentication protect me from?

Because the code is sent to a device Google know you have had physical possession of in the past. It's either sent by SMS, voice call, or to a pre-registered mobile app. The general point of two factor authentication is that you need physical access to something (phone, token generator, etc), meaning that if somebody across the world knew your password they'd still be unable to cause any damage - or rather, it would…

If they know my master password, they also need to have a phone, that is correct. But if they know a single application specific password, they can read my mail just fine. How does the two-factor authentication protect me in this case?

Re: Bypassing Google’s Two-Factor Authentication

#23

Post by xyzzyz »

Inufu wrote: post #13
xyzzyz wrote: post #12

Could anyone explain to me what's the point of Google's two-factor authentication? I mean, before that, I used to have one password I had to guard carefully, and now I have ten passwords I have to guard carefully, and the one I enter most often requires me to additionally type some digits I have to read from my smartphone? What plausible attack scenario does two-factor authentication protect me from?

If I want to hack your account, it's not enough to steal your password, I also need to steal your smartphone to generate the tokens. edit: I was referring to the Google Authenticator App, not sending the codes over SMS. That's imho less secure.

You don't have to steal a master password. It's enough to steal an application specific password, and if you do that, you won't need a smartphone to read my mail.

Re: Bypassing Google’s Two-Factor Authentication

#24

Post by wting »

xyzzyz wrote: post #12

Could anyone explain to me what's the point of Google's two-factor authentication? I mean, before that, I used to have one password I had to guard carefully, and now I have ten passwords I have to guard carefully, and the one I enter most often requires me to additionally type some digits I have to read from my smartphone? What plausible attack scenario does two-factor authentication protect me from?

Multi-factor authentication means choosing from:

1. something you know (password)

2. something you have (phone, yubikey)

3. something you are (biometrics)

With Google's two-factor, logging in requires something you know (password) and something you have (phone). The 10 passwords should be locked somewhere physically safe as a fail-safe.

Two-factor authentication protects against password leaks and brute force password attacks.[0] It now takes two security failures to access your account rather than one.

On a side note, this is why secret questions are worthless as a security measure. Backing up a password with another mental fact is still single factor authentication.

[0]: Unless the attackers were able to attain your fail-safe passwords, but unlikely given the entropy and presumably Google's security.

Re: Bypassing Google’s Two-Factor Authentication

#25

Post by xyzzyz »

wting wrote: post #24
xyzzyz wrote: post #12

Could anyone explain to me what's the point of Google's two-factor authentication? I mean, before that, I used to have one password I had to guard carefully, and now I have ten passwords I have to guard carefully, and the one I enter most often requires me to additionally type some digits I have to read from my smartphone? What plausible attack scenario does two-factor authentication protect me from?

Multi-factor authentication means choosing from: 1. something you know (password) 2. something you have (phone, yubikey) 3. something you are (biometrics) With Google's two-factor, logging in requires something you know (password) and something you have (phone). The 10 passwords should be locked somewhere physically safe as a fail-safe. Two-factor authentication protects against password leaks and brute force passwor…

I'm not talking about 10 passwords I have as a backup. I'm talking about 10 application specific password that are used every day by my phone, mail client, xmpp client etc. They just need to intercept any single of these password to compromise my mail account. How's this different from the situation before two-factor authentication?

Re: Bypassing Google’s Two-Factor Authentication

#26

Post by tannerc »

stephengillie wrote: post #15
jgrahamc wrote: post #2

Interesting read as bypassing the same thing was needed for this hack: http://blog.cloudflare.com/the-four-critical-security-flaws-...

I said it then, I'll say it again -- The solution is obvious: allow per-password permissions. For instance, if I make an app-specific password to sync my bookmarks, that password shouldn't provide access to my Gmail or my settings. Why isn't this already a feature?

What are possible reasons per-password permissions hasn't been a feature implemented by major websites yet?

Is it simply that the way they do it now is easier to create/manage?

Seems like a no-brainer.

Re: Bypassing Google’s Two-Factor Authentication

#27

Post by marshray »

xyzzyz wrote: post #25
wting wrote: post #24

Earlier quoted context omitted.

Multi-factor authentication means choosing from: 1. something you know (password) 2. something you have (phone, yubikey) 3. something you are (biometrics) With Google's two-factor, logging in requires something you know (password) and something you have (phone). The 10 passwords should be locked somewhere physically safe as a fail-safe. Two-factor authentication protects against password leaks and brute force passwor…

I'm not talking about 10 passwords I have as a backup. I'm talking about 10 application specific password that are used every day by my phone, mail client, xmpp client etc. They just need to intercept any single of these password to compromise my mail account. How's this different from the situation before two-factor authentication?

All I can figure is it makes it easier to revoke one password without changing all the others.

Re: Bypassing Google’s Two-Factor Authentication

#28

Post by marshray »

sbronstein wrote: post #20

> We think it’s a rather significant hole in a strong authentication system if a user still has some form of “password” that is sufficient to take over full control of his account. I don't really understand this sentence...they say that Google (post-fix) no longer enables access to security-specific pages unless you do two factor auth, so doesn't that mean that post-fix you cannot fully take over someone's Google acc…

I think the "still" was meant to refer to "after the addition of the 2nd factor to the auth process" rather than "after the fix to the vulnerability described here".

It's making the case that this does represent a "real" vulnerability, even if certain aspects of the behavior were understood and expected by the system designers.

Re: Bypassing Google’s Two-Factor Authentication

#29

Post by JumpCrisscross »

I had this vulnerability cast into sharp relief recently through my Apple ID compromising my contacts. I sync my Gmail and Gmail contacts via IMAP to my iPhone and iPad using application-specific passwords. Both devices are backed up on iCloud. When my Apple ID was compromised the crook restored my iCloud backup to a new device, complete, to my horror, with the application specific passwords, which were used to stream out my contacts.

New devices and novel data requests do not revoke application-specific passwords which, as the article notes, are anything but specific. Also, Apple's security support is a 24-hour round-trip via an email technician.

Re: Bypassing Google’s Two-Factor Authentication

#30

Post by SmileyKeith »

tiziano88 wrote: post #7
SmileyKeith wrote: post #3

I enabled this at some point in time, it's amazing how many services I use that rely on Google. After I got over 20 application specific passwords, which I guess are tell alls, I decided it wasn't worth the complication. The real problem with this was apps implementations of the two-factor auth. I haven't looked at any of the APIs (I know they don't exist for some services like Reader) but if the entirety of the auth…

I'm not sure I follow, what services you are talking about that rely on Google? I only had to generate a few ASPs for my email clients, and little more. I use most of the Google-provided apps on Android though, so I never have to actually log in to my Google account from my phone/tablet, it might be the case that on iOS the situation is different?

I'm sorry I said that strangely. The point I was trying to get across that you use Google logins a lot. For example I have 4 email accounts on 4 or 5 devices, in multiple mail applications along with service specific apps like the Google plus or similar apps. Which ends up with a lot of application specific passwords.
Post reply on HN