Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Bypassing Google’s Two-Factor Authentication

blog.duosecurity.com

Post reply on HN
Print view View original

31–40 of 75 posts

Re: Bypassing Google’s Two-Factor Authentication

#31

Post by Sidnicious »

cryptoz wrote: post #19
objclxt wrote: post #18

Earlier quoted context omitted.

Because the code is sent to a device Google know you have had physical possession of in the past. It's either sent by SMS, voice call, or to a pre-registered mobile app. The general point of two factor authentication is that you need physical access to something (phone, token generator, etc), meaning that if somebody across the world knew your password they'd still be unable to cause any damage - or rather, it would…

> Because the code is sent to a device Google know you have had physical possession of in the past. It's either sent by SMS, voice call, or to a pre-registered mobile app. None of those connect to device you've had "physical possession in the past". Only the present. Phone calls, SMS and apps are all portable across hardware.

At least on iOS, the Google Authenticator app doesn't allow its tokens to be backed up or transferred.

Re: Bypassing Google’s Two-Factor Authentication

#32

Post by [deleted] »

xyzzyz wrote: post #12

Could anyone explain to me what's the point of Google's two-factor authentication? I mean, before that, I used to have one password I had to guard carefully, and now I have ten passwords I have to guard carefully, and the one I enter most often requires me to additionally type some digits I have to read from my smartphone? What plausible attack scenario does two-factor authentication protect me from?

[deleted]

Re: Bypassing Google’s Two-Factor Authentication

#33

Post by sneak »

xyzzyz wrote: post #25
wting wrote: post #24

Earlier quoted context omitted.

Multi-factor authentication means choosing from: 1. something you know (password) 2. something you have (phone, yubikey) 3. something you are (biometrics) With Google's two-factor, logging in requires something you know (password) and something you have (phone). The 10 passwords should be locked somewhere physically safe as a fail-safe. Two-factor authentication protects against password leaks and brute force passwor…

I'm not talking about 10 passwords I have as a backup. I'm talking about 10 application specific password that are used every day by my phone, mail client, xmpp client etc. They just need to intercept any single of these password to compromise my mail account. How's this different from the situation before two-factor authentication?

Accessing your email box is a different matter than taking over the whole account. The former you can generally recover from.

Re: Bypassing Google’s Two-Factor Authentication

#34

Post by simon_weber »

Google's authentication schemes can be incredibly confusing, and they're something I've had to deal with while building an unofficial client to Google Music [0].

Here are two things worth knowing (that are somewhat covered by the article):

* aside from OAuth, any method of client auth is basically equivalent to SSO (ie, your entire Google account). As noted in the article, this includes app-specific passwords

* SSO is not meant for programmatic access. If you want code to have access to SSO credentials, it's easiest to use some other auth service, and then "upgrade" to SSO (the linked blog post describes one way of doing this) [1]

[0] https://github.com/simon-weber/Unofficial-Google-Music-API

[1] http://nelenkov.blogspot.com/2012/11/sso-using-account-manag...

Re: Bypassing Google’s Two-Factor Authentication

#35

Post by grey-area »

xyzzyz wrote: post #12

Could anyone explain to me what's the point of Google's two-factor authentication? I mean, before that, I used to have one password I had to guard carefully, and now I have ten passwords I have to guard carefully, and the one I enter most often requires me to additionally type some digits I have to read from my smartphone? What plausible attack scenario does two-factor authentication protect me from?

Could anyone explain to me what's the point of Google's two-factor authentication?

Without application specific passwords it's actually pretty secure. With ASP of course, according to this article, it's no more secure at all. So it looks like ASPs need to be revised/locked down. That doesn't mean that 2-factor security is useless in principle, just that this facet of it is insecure.

Re: Bypassing Google’s Two-Factor Authentication

#36

Post by agsamek »

xyzzyz wrote: post #12

Could anyone explain to me what's the point of Google's two-factor authentication? I mean, before that, I used to have one password I had to guard carefully, and now I have ten passwords I have to guard carefully, and the one I enter most often requires me to additionally type some digits I have to read from my smartphone? What plausible attack scenario does two-factor authentication protect me from?

The main advantage is that people need to remember lower entropy passwords or can use the same password in multiple places without compromising two factor protected system. Also two factor auth protects against keyloggers.

Re: Bypassing Google’s Two-Factor Authentication

#37

Post by [deleted] »

xyzzyz wrote: post #25
wting wrote: post #24

Earlier quoted context omitted.

Multi-factor authentication means choosing from: 1. something you know (password) 2. something you have (phone, yubikey) 3. something you are (biometrics) With Google's two-factor, logging in requires something you know (password) and something you have (phone). The 10 passwords should be locked somewhere physically safe as a fail-safe. Two-factor authentication protects against password leaks and brute force passwor…

I'm not talking about 10 passwords I have as a backup. I'm talking about 10 application specific password that are used every day by my phone, mail client, xmpp client etc. They just need to intercept any single of these password to compromise my mail account. How's this different from the situation before two-factor authentication?

[deleted]

Re: Bypassing Google’s Two-Factor Authentication

#38

Post by simon_weber »

xyzzyz wrote: post #25
wting wrote: post #24

Earlier quoted context omitted.

Multi-factor authentication means choosing from: 1. something you know (password) 2. something you have (phone, yubikey) 3. something you are (biometrics) With Google's two-factor, logging in requires something you know (password) and something you have (phone). The 10 passwords should be locked somewhere physically safe as a fail-safe. Two-factor authentication protects against password leaks and brute force passwor…

I'm not talking about 10 passwords I have as a backup. I'm talking about 10 application specific password that are used every day by my phone, mail client, xmpp client etc. They just need to intercept any single of these password to compromise my mail account. How's this different from the situation before two-factor authentication?

You are confused by the misleading "application-specific password" terminology. These passwords each allow the same degree of access: the password you use on your phone could be interchanged with the one on your xmpp client. Aside from being able to revoke each independently, there's not much benefit from having many of them.

These are not equivalent to 2-factor auth (which grants you the benefits described in an earlier comment). App-specific passwords exist only to allow you, a 2-factor user, to use applications which do not yet support 2-factor auth.

Re: Bypassing Google’s Two-Factor Authentication

#39

Post by Tyr42 »

sneak wrote: post #33
xyzzyz wrote: post #25

Earlier quoted context omitted.

I'm not talking about 10 passwords I have as a backup. I'm talking about 10 application specific password that are used every day by my phone, mail client, xmpp client etc. They just need to intercept any single of these password to compromise my mail account. How's this different from the situation before two-factor authentication?

Accessing your email box is a different matter than taking over the whole account. The former you can generally recover from.

That's the problem though, isn't it? They don't do password specific permissions, so any leak escalates up to taking over the whole account.

Re: Bypassing Google’s Two-Factor Authentication

#40

Post by rdl »

sneak wrote: post #33
xyzzyz wrote: post #25

Earlier quoted context omitted.

I'm not talking about 10 passwords I have as a backup. I'm talking about 10 application specific password that are used every day by my phone, mail client, xmpp client etc. They just need to intercept any single of these password to compromise my mail account. How's this different from the situation before two-factor authentication?

Accessing your email box is a different matter than taking over the whole account. The former you can generally recover from.

The Google "Application Specific Passwords" are actually complete passwords which give you access to all data in the account, which is the problem.
Post reply on HN