Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Downsides of Google Authenticator

zdnet.com

Post reply on HN
Print view View original

61–70 of 139 posts

Re: Downsides of Google Authenticator

#61

Post by lain »

Spivak wrote: post #3

Bitwarden is a pretty good solution for this! It's not the smoothest since the browser extensions don't know how to fill in your codes like they do your password but it's leaps and bounds above the UX for Google Authenticator. Being able to access my codes from any device with a web browser is very nice. INB4: "But this reduces your security." * Yes, but I'm already using a password manager with 64 char generated pas…

I've found the Bitwarden browser extension has an option to automatically copy the 6 digit code after the username+password autofill. Can't remember if it does it by default though. See:

Settings / Options / Disable Automatic TOTP Copy

Re: Downsides of Google Authenticator

#62

Post by Karunamon »

inetknght wrote: post #60
aneutron wrote: post #47

Earlier quoted context omitted.

That is not very civil of you. OP is making a very solid point. Consider your threat model first. If you're a high value target, then yes it's probably a gimmick as you're more likely to have a gun to your head. But for other attack vectors that are more automatable and deployed at large (e.g. Trojan Apps), as OP suggests, it is a lot of things, but not a gimmick.

> That is not very civil of you. I think @trickstra was quite civil in their comment. And they also brought up a completely valid point: > > And you cannot change it like a password. So that's why it's a gimmick. Regardless of threat model, not being able to change biometrics makes them very high value to an opposing force. Using biometrics "for the masses" to whom they don't have that completely different threat mod…

I'd say the threat model is critical. If your adversary is a state power targeting you personally, you have already lost. They'll just throw you in jail, or worse, until you put your thumb on the button.

If your adversary is a random thief, or the untrustworthy general public, then it works great, and is a significant upgrade from the zero security that most people had prior to the proliferation of biometrics on phones.

Re: Downsides of Google Authenticator

#64

Post by jdeibele »

BoppreH wrote: post #32
lima wrote: post #4

Strongly disagree with the premise of this article: - Passcode or biometric locks on an app are a gimmick and offer negligible value. - The keys not being backed up or or synchronised across devices is not a bug, but a feature. You're supposed to keep offline backup keys. Any sort of synchronization feature adds a ton of attack surface. - In particular, Authy, LastPass and 1password have a giant attack surface compar…

> You're supposed to keep offline backup keys. Any sort of synchronization feature adds a ton of attack surface. I find that a terrible design decision, because now every website has to implement their own backup code flow. PayPal, for example, is one of the most critical applications when talking about authentication, and while they support 2FA they don't give you any backup codes at all: https://www.paypal-communit…

At one point I was able to use two copies (phone and iPad) of Symantec VIP Access with Paypal. I changed phones and I wasn't able to use the new copy.

However, I was able to set up Authy as a secondary authenticator.

I don't have SMS as 2FA for PayPal.

Re: Downsides of Google Authenticator

#65

Post by mathijs »

goalieca wrote: post #38
mathijs wrote: post #19

Earlier quoted context omitted.

I agree with this comment completely. Adding a biometric lock would turn it into 3FA. Not sure if HN allows to plug your own apps, so please forgive: I made an app a while ago that aims to replace Google Authenticator for some of the reasons mentioned: it allows to back-up and transfer tokens without creating a large attack factor. Not having sync is a feature in this case as well. In fact, the app does not even have…

Biometric data should be considered identity and not authentication data. They can never be revoked or rotated for one. And who knows how many people have it on file. Not every auth server gets their own « key »

Makes sense. The principle of 2FA is to combine 'something you know' (a password) with 'something you own' (your phone). I guess the biometric lock is 'something you are' on top of that.

Re: Downsides of Google Authenticator

#66

Post by criddell »

BoppreH wrote: post #32
lima wrote: post #4

Strongly disagree with the premise of this article: - Passcode or biometric locks on an app are a gimmick and offer negligible value. - The keys not being backed up or or synchronised across devices is not a bug, but a feature. You're supposed to keep offline backup keys. Any sort of synchronization feature adds a ton of attack surface. - In particular, Authy, LastPass and 1password have a giant attack surface compar…

> You're supposed to keep offline backup keys. Any sort of synchronization feature adds a ton of attack surface. I find that a terrible design decision, because now every website has to implement their own backup code flow. PayPal, for example, is one of the most critical applications when talking about authentication, and while they support 2FA they don't give you any backup codes at all: https://www.paypal-communit…

The offline backup can be a printout of the QR code.

Re: Downsides of Google Authenticator

#69

Post by v01dlight »

txcwpalpha wrote: post #54

This thread is a perfect example of why security is hard. Even if you give users the tools to improve their security (2FA apps), and even if you enforce they they use those apps, users will always find a way to create a loophole that completely negates the security enhancement you implemented. If you’re putting all of your OTP codes in your password manager, that completely negates the entire point of two factor auth…

It's bad practice sure, but to say that it "completely negates the entire point of two factor authentication" is ignoring the main attack password managers are good at defending against: credential stuffing.

Example: If LinkedIn leaks my password, attackers can't use it to gain access to my Gmail because (thanks to the help of a password manager) I use different passwords for all sites. They also can't use it to gain access to LinkedIn because I have 2FA turned on. Even if my OTPs are saved in my password manager, they would need my master password for that.

And if they have someone's master password, they're probably screwed whether or not they have OTPs in their vault because they likely have credit card numbers, addresses, social security numbers, etc in there too.

Post reply on HN