Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Your Android Phone Is a Security Key

blog.google

Post reply on HN
Print view View original

61–70 of 144 posts

Re: Your Android Phone Is a Security Key

#61

Post by scarejunba »

ghaff wrote: post #12
jetrink wrote: post #8

Earlier quoted context omitted.

In what way is carrying a dedicated device not realistic? My second factor lives on my keyring and is only a bit larger than a typical door key. Everyone carries keys.

I don't carry my keys when I'm traveling if I'm not driving my own car. So, no, not everyone carries keys. ADDED: I do have other 2FA hardware as well. But I assume I'm not guaranteed to have it with me when I need it.

Ah, you have separate keyrings for your home keys and car keys? I'd say that's not usually the case.

Re: Your Android Phone Is a Security Key

#62

Post by BillinghamJ »

markstos wrote: post #57

Looks like Google has used the open Web Bluetooth specification (that only Chrome currently supports) along with the open FIDO Bluetooth spec ( https://fidoalliance.org/specs/fido-u2f-v1.2-ps-20170411/fid... ). A read-only, non-wireless security key like Yubikey would be even more secure, but this is an improvement over TOTP codes, which can be phished. This is also better than SMS 2FA, which is prone to phone-number…

I don't believe Web Bluetooth should be used with security keys (in fact, I believe communication with those is specifically blocked as a part of Web Bluetooth).

This is because the browser needs to pass the origin to the device and ensure the webpage can't impersonate another origin.

Re: Your Android Phone Is a Security Key

#63

Post by lucb1e »

ksec wrote: post #30

Off topic: This is the state of web we are in, and this is coming from Google. [1] I have literally 20% of the screen displaying useful information. The others are all useless navigation or related crap. Just seeing it nearly got me to puke. It is one those problem in general where the web page is responsive and mobile first. [1] https://ibb.co/fCfmW6h

Turning off JavaScript sometimes helps, but often just breaks the site. However, I also have a button to turn off CSS, which just flips a setting (dead simple addon, no security risk, can't break anything, and doesn't need a page refresh). I use it about once a week for articles with too low contrast, annoying fonts (this is getting better over the past year or so), or crappy sites like this.

The article after turning off CSS: https://snag.gy/RmXpxl.jpg

To my surprise, without JS the layout stayed the same, only the annoying elements on top and bottom when scrolling are no longer there. That's actually perfect in this case.

It's really weird to notice all the JavaScript still functioning despite just having transformed the site from Google to motherfuckingwebsite-style. The add-on I use: https://addons.mozilla.org/en-US/firefox/addon/css-toggler/

Re: Your Android Phone Is a Security Key

#64

Post by ghaff »

scarejunba wrote: post #61
ghaff wrote: post #12

Earlier quoted context omitted.

I don't carry my keys when I'm traveling if I'm not driving my own car. So, no, not everyone carries keys. ADDED: I do have other 2FA hardware as well. But I assume I'm not guaranteed to have it with me when I need it.

Ah, you have separate keyrings for your home keys and car keys? I'd say that's not usually the case.

No. I have a keypad on my door. So when I take a trip by air (which is common), I just leave my keys at home. But I agree that my scenario may not be super common.

Re: Your Android Phone Is a Security Key

#65

Post by zimmerfrei »

guelo wrote: post #13
Hamuko wrote: post #2

I don't know how I feel about making a device so endlessly hackable a "security key".

All Android devices certified by Google will have a hardware security module which should keep the keys secure. Some cheap non-certified devices (mostly Chinese) might not have hardware backed keystores, but I doubt those devices would be able to run this Google app.

>> All Android devices certified by Google will have a hardware security module which should keep the keys secure.

Source? I understood that having a HW-backed key store is still entirely optional for the purpose of Android certification.

On top of that, I noticed some ambiguity on whether a TEE like ARM TrustZone qualifies as a hardware-grade protection mechanism in the same way a discrete and dedicated crypto processor is (I think the two technologies provide very different assurance levels).

Re: Your Android Phone Is a Security Key

#66

Post by verdverm »

penagwin wrote: post #53
oneplane wrote: post #34

> Your Android Phone Is a Security Key no it's not. it's pretending to be, but without vendors actually maintaining and investing in their forks and the hardware having a known good security enclave, you might as well post your credentials on twitter.

Yeah I don't see how this is any different from the standard Google Authenticator style affair. Without a security enclave (which devices are starting to include) I don't see how this is an improvement.

Connects via Bluetooth to the device you wish to sign into.

Re: Your Android Phone Is a Security Key

#67

Post by lern_too_spel »

penagwin wrote: post #53
oneplane wrote: post #34

> Your Android Phone Is a Security Key no it's not. it's pretending to be, but without vendors actually maintaining and investing in their forks and the hardware having a known good security enclave, you might as well post your credentials on twitter.

Yeah I don't see how this is any different from the standard Google Authenticator style affair. Without a security enclave (which devices are starting to include) I don't see how this is an improvement.

Android 7 added support for key attestation, making it possible to verify that a key came from a secure enclave. That's presumably why the blog post says Android 7 and above. https://source.android.com/security/keystore

Re: Your Android Phone Is a Security Key

#68

Post by lern_too_spel »

penagwin wrote: post #54
guelo wrote: post #13

Earlier quoted context omitted.

All Android devices certified by Google will have a hardware security module which should keep the keys secure. Some cheap non-certified devices (mostly Chinese) might not have hardware backed keystores, but I doubt those devices would be able to run this Google app.

Not doubting you, but were did you find that information? The only thing I see is "it’s built into devices running Android 7.0+" and I found that on multiple pages. As Android 7.0 is available to install on any device and I don't see anything about "certified android devices", I assume they mean ANY Android 7.0 device? Then again it only works with Google services atm, but I know you can sideload google play services…

Android 7 supports key attestation. https://source.android.com/security/keystore/attestation

Re: Your Android Phone Is a Security Key

#69

Post by Bluestrike2 »

peterwwillis wrote: post #23
sakisv wrote: post #19

I like the idea behind it in principle, since it will simplify 2FA for the masses and may lead more people to adopt it. But, apart from that: 1. It's only on Chrome (for now(?)) 2. It's only for Google products (for now (?)) 3. It's only on Android that Google fully controls remotely (and probably it will stay there). All these give even more power to Google at the expense of convenience and allows a single company t…

The problem isn't even Google, it's just lack of actual support for services that need it. You have to have the right client, the right device, and every website has to implement it. Government websites won't support it, nor most financial services, your gym, school, job, etc. Sensitive records like your SSN will be kept in walled gardens accessible by a simple user and password, and maybe a security question. Most p…

Admittedly, that's not a minor benefit. If someone has access to your Gmail account, there's all sorts of information there they can use to engineer access to other services.

The naive optimist in me wants to think that making security keys accessible to more users, and getting them used to them, will lead to pressure for other services to follow suit. But then I think about how long people have been criticizing banks for ridiculous password policies that are seemingly universal in the industry, and I know better. Or bad security practices at organizations in general. I'd very much like to be proven wrong.

Re: Your Android Phone Is a Security Key

#70

Post by jdietrich »

zavi wrote: post #48
sakisv wrote: post #19

I like the idea behind it in principle, since it will simplify 2FA for the masses and may lead more people to adopt it. But, apart from that: 1. It's only on Chrome (for now(?)) 2. It's only for Google products (for now (?)) 3. It's only on Android that Google fully controls remotely (and probably it will stay there). All these give even more power to Google at the expense of convenience and allows a single company t…

This is 2FA for Google accounts so of course it's on Google products?

Google Authenticator works with any service that uses the TOTP or HOTP standards.

https://en.wikipedia.org/wiki/Google_Authenticator

Post reply on HN