Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Downsides of Google Authenticator

zdnet.com

Post reply on HN
Print view View original

51–60 of 139 posts

Re: Downsides of Google Authenticator

#51

Post by UncleMeat »

alexhutcheson wrote: post #29
tlb wrote: post #15

Earlier quoted context omitted.

Do you trust the security of your printer when you print codes? They are historically one of the biggest attack surfaces.

What's your threat model? Security researchers or nation-state level adversaries might theoretically be able to tap your printer and parse it for things that look like codes, but if you're receiving that level of expert human attention then you're probably already compromised in one of 1000 other ways.

The huge majority of people don’t have nation state threat models.

If you are worried about that then using a desktop computer in the first place is a bad idea.

Re: Downsides of Google Authenticator

#52

Post by ValentineC »

the_svd_doctor wrote: post #22
ValentineC wrote: post #14

I stopped using Google Authenticator in 2013 when my tokens disappeared after a software update [1]. They were restored in the next update, but I didn't like not having access to the raw TOTP data. I switched to Authy after the incident, and now use 1Password after I discovered their TOTP feature. [1] https://news.ycombinator.com/item?id=6325760

Isn’t that putting all eggs in the same basket?

It's a compromise for me: the killer feature is not having to depend on my phone to log into websites.

I suppose it might be even more secure if I kept tokens in a separate vault.

Re: Downsides of Google Authenticator

#53

Post by iudqnolq »

ocdtrekkie wrote: post #2

> Is it risky "centralizing" this data? Sure, but I don't see it any more risky as using a cloud-based password manager. Using a cloud-based password manager is a huge risk though. And if you've put both your passwords and your 2FA generators in the cloud, you now have single-factor authentication.

It's less secure, but the single factor is a stronger single factor than a password because it can't be reused. If someone mitms my login they get my password and otp code, which they ideally can't turn into something reusable (if the website requires 2FA to change security settings) and definitely can't use if they have a lag between collection and exploitation (like a keylogger that phones home every so often). This is acceptable to me, but I would prefer websites let me use a one time code as a single factor of authentication.

Re: Downsides of Google Authenticator

#54

Post by txcwpalpha »

This thread is a perfect example of why security is hard. Even if you give users the tools to improve their security (2FA apps), and even if you enforce they they use those apps, users will always find a way to create a loophole that completely negates the security enhancement you implemented.

If you’re putting all of your OTP codes in your password manager, that completely negates the entire point of two factor authentication.

And sure, maybe you think “well I’m not a high value target anyway, I don’t need to really secure my devices”, how many of you have work-related accounts signed into your devices? Even if you’re just a lowly engineer, I can guarantee you absolutely are a target of sophisticated hacker groups (ironically you may even be more of a target because these groups know that you don’t consider yourself a target and therefor are more lax with your security).

Re: Downsides of Google Authenticator

#55

Post by sV5OvuqTZXPSqw1 »

aneutron wrote: post #47
trickstra wrote: post #46

Earlier quoted context omitted.

Your biometrics are already getting analyzed from all angles somewhere in China just from all the face apps that predict which Disney princess you are. And you cannot change it like a password. So that's why it's a gimmick.

That is not very civil of you. OP is making a very solid point. Consider your threat model first. If you're a high value target, then yes it's probably a gimmick as you're more likely to have a gun to your head. But for other attack vectors that are more automatable and deployed at large (e.g. Trojan Apps), as OP suggests, it is a lot of things, but not a gimmick.

First, shoutout to HN for not blocking my Tor throwaway.

I am someone who would be considered to be a "high value target" since I have had some of these things happen to me and I'm certain they will happen again in the future. I work in a politically sensitive industry where it turns out these things are commonplace.

When I was younger I was always security conscious and took serious trade-offs to maintain my privacy. You could have called me paranoid, but I think I was more excited at the idea of being protected against all of these high-level threats, even if most of them were nonexistent at the time.

While this discipline certainly benefited me later in life, I've realized that I will never again get the chance to reasonably evaluate my threats as "average" and enjoy some of the simpler conveniences of technology that come at the cost of compromising some high-severity threat models. Of course I still think there are a lot of precautions the average person can take to protect their privacy without major trade-offs, but those don't usually include state actor-level threats against your devices.

I wouldn't change a thing now, but when I talk to people who see no reason to take anything more than the average precautions, I no longer think it's "cool" to do anything more than that because I know for a fact I would too if I was in their shoes.

Re: Downsides of Google Authenticator

#56

Post by Fire-Dragon-DoL »

lima wrote: post #4

Strongly disagree with the premise of this article: - Passcode or biometric locks on an app are a gimmick and offer negligible value. - The keys not being backed up or or synchronised across devices is not a bug, but a feature. You're supposed to keep offline backup keys. Any sort of synchronization feature adds a ton of attack surface. - In particular, Authy, LastPass and 1password have a giant attack surface compar…

Well, an option to export to an encrypted file so that is easy to move between phones is an acceptable tradeoff. Using 1 day pf my time to authorize again all the websites is much worse (and i have to disable authenticator during that period). Sorry, I disagree. For the same reasons passwords are not good, an uncomfortable solution is not ok

Re: Downsides of Google Authenticator

#57

Post by ocdtrekkie »

seanwilson wrote: post #35
ocdtrekkie wrote: post #10

Earlier quoted context omitted.

All my 2FA codes are backed up. On paper. I have a physically-secured cache of the QR codes which can be pretty quickly imported into a new app.

What happens when you're traveling? What if some combination of your wallet, laptop, paper files or phone are stolen or destroyed by fire or water? Essentially, what's your backup plan so if the very worst happens when you're in the middle of nowhere you're not completely locked out?

If I'm traveling, and I lose my laptop, phone, and wallet, I really hope I can't restore access to my 2FA codes! Because if I can get access to my 2FA codes somewhere else in the world without those things, so can an attacker!

Re: Downsides of Google Authenticator

#58

Post by Fire-Dragon-DoL »

ocdtrekkie wrote: post #10
ls612 wrote: post #8

Earlier quoted context omitted.

Here’s the thing. I consider myself fairly responsible but I’ll bet I’m far more likely to lose my phone than it is that my Authy and Dashlane credentials are both compromised, which are my pw manager and Authenticator app. You have to choose your risks and for a lot of people an authy like feature is much safer overall than GA.

All my 2FA codes are backed up. On paper. I have a physically-secured cache of the QR codes which can be pretty quickly imported into a new app.

Paypal though has no backup codes...

Re: Downsides of Google Authenticator

#59

Post by ocdtrekkie »

tlb wrote: post #15
ocdtrekkie wrote: post #10

Earlier quoted context omitted.

All my 2FA codes are backed up. On paper. I have a physically-secured cache of the QR codes which can be pretty quickly imported into a new app.

Do you trust the security of your printer when you print codes? They are historically one of the biggest attack surfaces.

I mean, I think it's a lot less likely that someone compromises my printer which is behind all of the same network protection measures as my PC, scours it for previous printouts of QR codes (if it does retain them), to identify what account they can potentially hack... than that they compromise a 2FA cloud service directly and log into all my accounts.

What's the threat model here? If the CIA is in my home network, I'm sure they can get into my email account too.

Re: Downsides of Google Authenticator

#60

Post by inetknght »

aneutron wrote: post #47
trickstra wrote: post #46

Earlier quoted context omitted.

Your biometrics are already getting analyzed from all angles somewhere in China just from all the face apps that predict which Disney princess you are. And you cannot change it like a password. So that's why it's a gimmick.

That is not very civil of you. OP is making a very solid point. Consider your threat model first. If you're a high value target, then yes it's probably a gimmick as you're more likely to have a gun to your head. But for other attack vectors that are more automatable and deployed at large (e.g. Trojan Apps), as OP suggests, it is a lot of things, but not a gimmick.

> That is not very civil of you.

I think @trickstra was quite civil in their comment. And they also brought up a completely valid point:

> > And you cannot change it like a password. So that's why it's a gimmick.

Regardless of threat model, not being able to change biometrics makes them very high value to an opposing force. Using biometrics "for the masses" to whom they don't have that completely different threat model practically eliminates their ability to upgrade their threat model since their biometrics have potentially been compromised already. Therefore, it very much is a gimmick.

Post reply on HN