Bypassing Google’s Two-Factor Authentication
blog.duosecurity.com
Bypassing Google’s Two-Factor Authentication
1–10 of 75 posts
Re: Bypassing Google’s Two-Factor Authentication
#2Interesting read as bypassing the same thing was needed for this hack: http://blog.cloudflare.com/the-four-critical-security-flaws-...
Re: Bypassing Google’s Two-Factor Authentication
#3I enabled this at some point in time, it's amazing how many services I use that rely on Google. After I got over 20 application specific passwords, which I guess are tell alls, I decided it wasn't worth the complication. The real problem with this was apps implementations of the two-factor auth. I haven't looked at any of the APIs (I know they don't exist for some services like Reader) but if the entirety of the auth was only typing in a code sent to your phone I would've stuck with it. It's when you get into these application specific passwords, especially when you have to create new ones on your phone, that I think it's more trouble than it's worth.
Re: Bypassing Google’s Two-Factor Authentication
#4The problem doesn't seem to be the ASP itself, but the failed (OAuth-like?) implementation.
"- OAuth tokens are created automatically, while ASPs are a thoroughly manual affair"
"- OAuth tokens use a flexible authorization model, and can be restricted to accessing only certain data or services in your account. By contrast, ASPs are — in terms of enforcement — not actually application-specific at all!"
Well, there's your problem. Application Specific Password isn't very specific at all.
Re: Bypassing Google’s Two-Factor Authentication
#5I reported this to Google about the same time, in June last year, and got a similar response. Interestingly, I published some notes on the issue almost exactly one week before the duosecurity researchers 'discovered' it ;)
http://grkvlt.blogspot.co.uk/2012/08/google-tfa-security-iss...
Re: Bypassing Google’s Two-Factor Authentication
#6I made a hosted api solution for easy two-factor/google authenticator (similar to what lastpass and stripe are using) integration here https://www.gauthify.com Its designed to integrate into the google authenticator app since many big players are already using it (SMS & Email option too).
With that aside I want to make it clear that the ASP aspect of Google Authenticator was bypassed and RFC 6238 (http://tools.ietf.org/html/rfc6238) timecode based two-factor authentication is still as solid as they were when it was written (I had a false sense of urgency to read this when I read the title).
Re: Bypassing Google’s Two-Factor Authentication
#7I enabled this at some point in time, it's amazing how many services I use that rely on Google. After I got over 20 application specific passwords, which I guess are tell alls, I decided it wasn't worth the complication. The real problem with this was apps implementations of the two-factor auth. I haven't looked at any of the APIs (I know they don't exist for some services like Reader) but if the entirety of the auth…
I'm not sure I follow, what services you are talking about that rely on Google? I only had to generate a few ASPs for my email clients, and little more. I use most of the Google-provided apps on Android though, so I never have to actually log in to my Google account from my phone/tablet, it might be the case that on iOS the situation is different?
Re: Bypassing Google’s Two-Factor Authentication
#8As an early google two step user, i've often wished those application specific passwords would bind to the first property that they're used for. From what I understand their current layered service architectures for some products makes this difficult for them to pull off.
For better or worse, google two step authentication is primarily to mitigate shared passwords, phishing and kiosk style keyloggers.
Re: Bypassing Google’s Two-Factor Authentication
#9So the security risk requires someone to somehow get your ASP? Correct me if I'm wrong, but I believe you can only make a new ASP when you are already signed in and it disappears after you 'hide' it or leave the page. It kind of seems like if you can get a user's ASP, the account is probably already compromised.
It's nice that they are fixing a couple loopholes, but not sure if it will actually help any.
Re: Bypassing Google’s Two-Factor Authentication
#10So the security risk requires someone to somehow get your ASP? Correct me if I'm wrong, but I believe you can only make a new ASP when you are already signed in and it disappears after you 'hide' it or leave the page. It kind of seems like if you can get a user's ASP, the account is probably already compromised. It's nice that they are fixing a couple loopholes, but not sure if it will actually help any.
The main issue with this is the automatic login functionality. If a person has 2 factor enabled on their account, and any of their devices (phones, tablets, etc) are stolen, it becomes trivial to act without a password to steal the entire account. If they have a lock screen password, it becomes harder to attack, but any compromised device would likely give an attacker a few hours prior to a user noticing and killing its tokens.