Your Android Phone Is a Security Key • Hacker News Board

Re: Your Android Phone Is a Security Key

#71

Post by Rafert » Wed, Apr 10, 2019, 9:06 PM UTC

sakisv wrote: post #19

I like the idea behind it in principle, since it will simplify 2FA for the masses and may lead more people to adopt it. But, apart from that: 1. It's only on Chrome (for now(?)) 2. It's only for Google products (for now (?)) 3. It's only on Android that Google fully controls remotely (and probably it will stay there). All these give even more power to Google at the expense of convenience and allows a single company t…

Before the announcement I've seen references to a 'caBLE'/ 'cloud assisted Bluetooth Low Energy' transport on the Web Authentication mailing list and W3C spec GitHub issues, this is exactly that. The VentureBeat article[0] confirms:

> “Under the covers, however, the phone and computer are communicating with the FIDO CTAP protocol over Bluetooth and the website and computer are communicating with the WebAuthn protocol and this adds the phishing-resistance. [...] But for now at least, the feature can only be used for 2FA on Google accounts. Google has submitted caBLE to FIDO and it’s under review by the working group.

[0]: https://venturebeat.com/2019/04/10/you-can-now-use-your-andr...

Re: Your Android Phone Is a Security Key

#72

Post by Rafert » Wed, Apr 10, 2019, 9:13 PM UTC

oneplane wrote: post #34

> Your Android Phone Is a Security Key no it's not. it's pretending to be, but without vendors actually maintaining and investing in their forks and the hardware having a known good security enclave, you might as well post your credentials on twitter.

That's a bit snarky. As other commenters mentioned, it can leverage TEEs using the Android Keystore for secure storage. And the way WebAuthn works means users are protected in case of a database breach (it contains only public keys) and the protocol protects against phishing. Both are ways better than usernames and passwords.

It got certified (at level 1[0]) too, in case that changes your mind: https://fidoalliance.org/android-now-fido2-certified-acceler...

[0]: https://fidoalliance.org/certification/authenticator-certifi...

Re: Your Android Phone Is a Security Key

#73

Post by vbezhenar » Wed, Apr 10, 2019, 9:16 PM UTC

oneplane wrote: post #34

> Your Android Phone Is a Security Key no it's not. it's pretending to be, but without vendors actually maintaining and investing in their forks and the hardware having a known good security enclave, you might as well post your credentials on twitter.

I don't see how it's less secure than storing passwords in ~/Documents/Passwords.txt. And it's a second factor, so combined with first factor the result is pretty secure. You can't browse other people phones, even without security enclave.

Re: Your Android Phone Is a Security Key

#74

Post by Rafert » Wed, Apr 10, 2019, 9:17 PM UTC

peterwwillis wrote: post #23

sakisv wrote: post #19

I like the idea behind it in principle, since it will simplify 2FA for the masses and may lead more people to adopt it. But, apart from that: 1. It's only on Chrome (for now(?)) 2. It's only for Google products (for now (?)) 3. It's only on Android that Google fully controls remotely (and probably it will stay there). All these give even more power to Google at the expense of convenience and allows a single company t…

The problem isn't even Google, it's just lack of actual support for services that need it. You have to have the right client, the right device, and every website has to implement it. Government websites won't support it, nor most financial services, your gym, school, job, etc. Sensitive records like your SSN will be kept in walled gardens accessible by a simple user and password, and maybe a security question. Most p…

Browser support is pretty good: https://caniuse.com/#feat=webauthn - and Google submitted the caBLE transport to the WebAuthn working group. Give it some time.

And don't count out governments just yet, U2F got some love: https://www.yubico.com/why-yubico/for-business/authenticatio...

Re: Your Android Phone Is a Security Key

#75

Post by rrdharan » Wed, Apr 10, 2019, 9:20 PM UTC

oneplane wrote: post #34

> Your Android Phone Is a Security Key no it's not. it's pretending to be, but without vendors actually maintaining and investing in their forks and the hardware having a known good security enclave, you might as well post your credentials on twitter.

We could test this claim pretty easily:

- you post your credentials on Twitter

- I'll store mine using this Android Phone

Let's see who gets hacked first!

Re: Your Android Phone Is a Security Key

#76

Post by Rafert » Wed, Apr 10, 2019, 9:21 PM UTC

wetpaws wrote: post #24

daphneokeefe wrote: post #20

Can someone explain how TFA (or any security feature that relies on my phone) works when the phone is unresponsive -- dead battery, no cell or internet reception, hardware failure.

U2F fits into this scheme nicely

WebAuthn is the successor to U2F. This is just another transport (caBLE/"cloud assisted Bluetooth") for this standard in addition to NFC, USB and a direct connection to a Bluetooth authenticator (e.g. Feitian and Google Titan key).

Re: Your Android Phone Is a Security Key

#77

Post by layoutIfNeeded » Wed, Apr 10, 2019, 9:31 PM UTC

eitland wrote: post #38

michaelmior wrote: post #26

Earlier quoted context omitted.

> all you need is an Android 7.0+ phone and a Bluetooth-enabled Chrome OS, macOS X or Windows 10 computer with a Chrome browser

Heh, Microsoft seems better than Google to support Linux in new products now. VS Vode is amazing, as is dotnet core. Who would have thought 5 years ago.

Of course they do. This is the “embrace” phase.

Re: Your Android Phone Is a Security Key

#78

Post by Rafert » Wed, Apr 10, 2019, 9:31 PM UTC

markstos wrote: post #57

Looks like Google has used the open Web Bluetooth specification (that only Chrome currently supports) along with the open FIDO Bluetooth spec ( https://fidoalliance.org/specs/fido-u2f-v1.2-ps-20170411/fid... ). A read-only, non-wireless security key like Yubikey would be even more secure, but this is an improvement over TOTP codes, which can be phished. This is also better than SMS 2FA, which is prone to phone-number…

FWIW that is a really old spec. The FIDO 2.0 Bluetooth transport is described at: https://fidoalliance.org/specs/fido-v2.0-rd-20180702/fido-cl...

But an article from VentureBeat[0] mentioned it's a new transport called 'cloud assisted Bluetooth Low Energy' or caBLE, which they've submitted to FIDO for standardization.

[0]: https://venturebeat.com/2019/04/10/you-can-now-use-your-andr...

Re: Your Android Phone Is a Security Key

#79

Post by godelski » Wed, Apr 10, 2019, 9:35 PM UTC

godelski wrote: post #10

This is great. Hopefully it'll get more people using 2FA. I don't think this is the best security practice, as others are nothing how insecure Android is. But it's better than nothing. It also pushes more people to use FIDO and 2FA. This is for the average person. If you want more get an yubi key or something.

Edit after trying: It is a little disappointing that it is Chrome only.

Re: Your Android Phone Is a Security Key

#80

Post by jgroszko » Wed, Apr 10, 2019, 9:48 PM UTC

doughj3 wrote: post #49

icebraining wrote: post #47

Earlier quoted context omitted.

Google has always given me other options, does it really enforce having a phone now?

I don't know how they determine what options to offer, but using my phone was the only one given, despite entering a correct password . The only other option, which I either found from the "Learn more" link or after exhausting the "login with your phone" attempts, was to create a support ticket for my G-suite account which, in this case, would have been slower than returning to home a few hours later where I had left…

There's an option on https://myaccount.google.com/security to turn off 2-step login.