91–100 of 149 posts
Authy gets this right. Not sure why anyone would trust Google with their 2FA secrets.
How exactly?
It's a tradeoff. They could let (or require) a password be entered to encrypt/decrypt it on each device, but then people would be ticked off when they forget their password and can't recover their 2FA stuff. They should have handled it the same way they do Sync in chrome, and I expect they will eventually. But, as always, unless a service advertises that it's full E2EE and you can verify that, assume it's not. One pa…
> Google know www.reddit.com/r/degoogle
Earlier quoted context omitted.
But it is free, both by the casual definition (zero cost) and by FSF definition (Free Software).
He wants to distinguish between "free: you pay with your privacy and we share your data with whoever wants it!" or "free: but only basic features, want more? pay" and "free: because people like you help it being 100% free and we have no pressure to use your data and everything is open so you can look at the code"
Earlier quoted context omitted.
People should have stopped using SMS codes when NIST told them to stop six years ago. The fact that there are websites that still support it is an abomination and should come with hefty legal penalties.
People? It's banks, who all insist on SMS, not people,
Earlier quoted context omitted.
Google pushing malicious updates would leave forensic traces, not to mention it'd be difficult to establish a legal framework allowing a government to force Google to do so. In contrast, subpoena'ing data from the cloud is routine for police in countries all over the world.
This may sound like a naive question, but what stops countries with flexible ethical standards from abusing this power? For example, in the past I've worked with an AI company with presence in China, where the data of their Chinese clientele must be stored on a separate data centre operated by a local enterprise. Despite the provider being ISO compliant and holds internationally recognised certs, is there realistical…
Earlier quoted context omitted.
If you are talking about device backup, apple had it encrypted before Advanced data protection. If you are talking about other data, Google don't have it encrypted even today.
> If you are talking about device backup, apple had it encrypted before Advanced data protection. Not end to end: https://www.wired.com/story/apple-end-to-end-encryption-iclo...
It's a tradeoff. They could let (or require) a password be entered to encrypt/decrypt it on each device, but then people would be ticked off when they forget their password and can't recover their 2FA stuff. They should have handled it the same way they do Sync in chrome, and I expect they will eventually. But, as always, unless a service advertises that it's full E2EE and you can verify that, assume it's not. One pa…
I don't think Google will use those secrets to look into your other accounts, but they can be politely requested by some governments to divulge the secrets, and not tell you about it. Then those governments would have no problems looking into your other accounts. And I'm not talking only about the US government, other governments can have dubious standards for requesting user data, such as failure to parrot the "fact…
A lot of companies and institutions use GA for 2FA for their secure systems too. Google doesn't even need to willingly share, as soon as the possibility of extracting the data is there they paint a target on it. External attacks are now extremely low hanging fruit with that unencrypted traffic. And internal attacks like getting an employee with access to that unencrypted data to provide it (knowingly or unknowingly) are relatively low effort and don't require the overhead of any legal proceedings or complex exploits. And if this goes through official/legal channels, Google doesn't have one single shred of protection between that data and what authorities can (shockingly legally) ask for.
Having the data is a liability for Google. Transferring it insecurely is also a liability for the user.
After my phone was stolen last month, I switched to https://2fas.com and couldn't be any happier. It's free, open source and has tons of great features.
It's a tradeoff. They could let (or require) a password be entered to encrypt/decrypt it on each device, but then people would be ticked off when they forget their password and can't recover their 2FA stuff. They should have handled it the same way they do Sync in chrome, and I expect they will eventually. But, as always, unless a service advertises that it's full E2EE and you can verify that, assume it's not. One pa…
The problem is now they know your TOTP secrets, they are only one password away from pretending to be you. And actually, they serve you emails, so password is moot for most of the sites today.
It’s possible to have 2FA methods that are verify only (usually using public keys and signing), but TOTP is not one of them.