Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Google Authenticator cloud sync: Google can see the secrets, even while stored

defcon.social

Post reply on HN
Print view View original

31–40 of 149 posts

Re: Google Authenticator cloud sync: Google can see the secrets, even while stored

#31

Post by computerfriend »

exabrial wrote: post #25
sneak wrote: post #3

TOTP (the six digit codes) is bad and outdated 2FA anyway. It's vulnerable to phishing. Use WebAuthn with security keys.

Progress, not perfection. Sms should never be used or offered, and needs congressional action to be stopped as a practice. TOTP at least prevents turning Wireless carriers into security providers and is "good enough" for nearly everything. And yes, WebAuthn/U2F is top of totem pole and should be something we're striving for nearly everything.

> Sms should never be used or offered

It's better than nothing.

Re: Google Authenticator cloud sync: Google can see the secrets, even while stored

#32

Post by vivegi »

judge2020 wrote: post #21
olliej wrote: post #18

Earlier quoted context omitted.

Why would google have access to that material? Is their general secret mechanism not E2EE? I'm fairly cynical on google's approach to privacy but I would be shocked if they're normal syncing isn't actually secure and private.

Chrome passwords are encrypted with your Google password by default, it's just not e2ee. This isn't even encrypted in that way it seems. The only real "threat" is your Google account itself being compromised by a third party able to phish their way into your account or bypass your 2fa mechanisms (e.g. by SMS sim swapping). As always, https://landing.google.com/advancedprotection/ The people here saying "privacy" are…

> doomsday scenario where Google itself leaks all of this data, which would be unprecedented and is unlikely ... (emphasis added)

From the linked article [1]:

> December 2018: Google+ Bug Exposes 52.5 Million Users’ Data Google+ faced its second big breach of 2018 when a November update created an API bug that exposed data from 52.5 million Google+ accounts. Google fixed the bug within six days, and moved up Google+’s burial date from August to April 2019.

> Google originally decided to terminate Google+ after another breach became public earlier in 2018

and an earlier Google+ bug that was reported in WSJ [2]

> Google Exposed User Data, Feared Repercussions of Disclosing to Public

> Google opted not to disclose to users its discovery of a bug that gave outside developers access to private data. It found no evidence of misuse.

[1]: https://firewalltimes.com/google-data-breach-timeline

[2]: https://www.wsj.com/articles/google-exposed-user-data-feared... (Oct, 2018)

Re: Google Authenticator cloud sync: Google can see the secrets, even while stored

#33

Post by livueta »

sneak wrote: post #3

TOTP (the six digit codes) is bad and outdated 2FA anyway. It's vulnerable to phishing. Use WebAuthn with security keys.

What do you all like to do for security key backups?

I use yubikeys wherever I can, but I've got to admit that fetching all 5+ keys from their various locations and then replacing them every time I need to enroll in something gets old fast, especially when you get into locations like "buried in the mountains".

The phishability of TOTP is indeed a big problem but being able to just save the seed (theoretically, somewhere not next to the other credential) is really nice.

Re: Google Authenticator cloud sync: Google can see the secrets, even while stored

#34

Post by px43 »

gleenn wrote: post #7
sneak wrote: post #3

TOTP (the six digit codes) is bad and outdated 2FA anyway. It's vulnerable to phishing. Use WebAuthn with security keys.

Until people stop using SMS codes it's still way more safe from cell phone cloning attacks.

People should have stopped using SMS codes when NIST told them to stop six years ago. The fact that there are websites that still support it is an abomination and should come with hefty legal penalties.

Re: Google Authenticator cloud sync: Google can see the secrets, even while stored

#36

Post by px43 »

lern_too_spel wrote: post #26
judge2020 wrote: post #21

Earlier quoted context omitted.

Chrome passwords are encrypted with your Google password by default, it's just not e2ee. This isn't even encrypted in that way it seems. The only real "threat" is your Google account itself being compromised by a third party able to phish their way into your account or bypass your 2fa mechanisms (e.g. by SMS sim swapping). As always, https://landing.google.com/advancedprotection/ The people here saying "privacy" are…

Chrome sync has let you set a separate password for end to end encryption for as long as I can remember, though badly until January 2020. https://bugs.chromium.org/p/chromium/issues/detail?id=820976

That's not end-to-end, that's just regular old symmetric encryption.

Re: Google Authenticator cloud sync: Google can see the secrets, even while stored

#37

Post by ocdtrekkie »

hsbauauvhabzb wrote: post #17
ocdtrekkie wrote: post #4

Someone will, of course, claim Google would never do this, but this presumably would make it trivial for Google itself to log into all of your accounts. In many cases they are already syncing a copy of your passwords.

I’d love it if google did this to me. I wouldn’t settle for anything less than a 9 figure payout.

Bear in mind, you would probably not see this as a covert/criminal act, but something sold as a feature. "Our artificial intelligence now can assist you by analyzing your transaction habits with your bank and can help manage your Facebook account."

The sort of thing as a tech crowd would horrify many of us, but the public would largely go "oh neato".

Re: Google Authenticator cloud sync: Google can see the secrets, even while stored

#38

Post by waboremo »

goalieca wrote: post #14
heavyset_go wrote: post #13

Earlier quoted context omitted.

Apple regularly gives up customers' private data when requested, and they keep logs of it themselves[1]. [1] https://www.apple.com/legal/transparency/us.html

So far apple has not been compelled by the courts to make a tool so they could decrypt the e2e stuff which now pretty much includes all iCloud content. As far as we publicly know.

Prior to ADP, agencies like FBI could actually access a lot of information from Apple, primarily because Apple stored keys alongside your data. Which meant even though iMessage content was encrypted (and therefore useless), they could still get a lot of information from a request to Apple -- and Apple hands over quite a lot. FBI had a document all about that in 2021.

Also important to note, ADP is opt-in currently.

Re: Google Authenticator cloud sync: Google can see the secrets, even while stored

#39

Post by choppaface »

Someone1234 wrote: post #23

Can the title get changed? - E2E in this case is nebulous, this isn't a chat or email client, it isn't client client with Google acting as an intermediary. It is between your Google account/Google's Server and Google's software. - It isn't clear if during transportation it is encrypted (e.g. HTTPS?); since seemingly this post isn't about that (or if it is the evidence or technical information is lacking). The term "E…

there's really no reason google couldn't have implemented (as the article suggests) a prompt for a one-time password while the user initiates the credential transfer. and it's clear the transfer isn't completely protected. this is a sloppy product change.

Re: Google Authenticator cloud sync: Google can see the secrets, even while stored

#40

Post by cleanchit »

db3pt0 wrote: post #9
gleenn wrote: post #6

Earlier quoted context omitted.

It's 2FA so it would only get them half way there right?

> In many cases they are already syncing a copy of your passwords. No, that gets them the full way there. They have your 2FA codes, and if you use Chrome and opt into it syncing passwords for you (passwords.google.com), this gives them both pieces of the puzzle.

If you use chrome, they could just download your cookies if they really wanted to.
Post reply on HN