12 ms·
Adding a security key to Gmail
- deleted 10y ago[deleted]
- samdk 10y agoThanks for writing this! One nitpick: the guide says "If you're curious why it's important to not have a phone number on your account, see the security key FAQ", but the linked security FAQ doesn't actually appear to say why it's important.
- idlewords 10y agoSorry about that, I'm updating that FAQ next. The answer is that SMS is not a secure second factor (it's easy to hijack and eavesdrop on), and in some cases when you give a service a phone number, it becomes possible to take over the account with just control of the phone number.
- cyphar 10y agoAnd some services that do phone calls can be tricked to save to voicemail (which was the case for Google, Facebook and various others previously): https://shubs.io/how-i-bypassed-2-factor-authentication-on-google-yahoo-linkedin-and-many-others/ https://shubs.io/how-i-bypassed-2-factor-authentication-on-g...
- mmahemoff 10y agoWhich is why password+SMS is sometimes called "1.5 factor auth"
- joshgel 10y agoGoogle now offers "Google prompt" which sends a push notification to your phone through the google app. How secure is this method?
- idlewords 10y agoMuch better than SMS, but not as good as a security key, because if you can fool someone into logging in to an impostor site, you can get their email account. It would be a reasonable backup in place of (or in addition to) Google Authenticator.
- avenoir 10y agoThere was an article floating around on HN a while ago about someone basically stating that an attacker was able to call their cellphone provider and use social engineering tactics to transfer their account to their own number. Ultimately circumventing second factor auth via SMS and gaining access to their Google account. I believe it was from an actual Google employee. So they were able to recover the account quickly.
- noxToken 10y agoBecause it can be a way to compromise your account[0]. HN discussion[1]: [0]: https://blog.coinbase.com/on-phone-numbers-and-identity-423db8577e58 https://blog.coinbase.com/on-phone-numbers-and-identity-423d... [1]: https://news.ycombinator.com/item?id=12597609 https://news.ycombinator.com/item?id=12597609
- wfunction 10y ago> We were also able to get in contact with an outstanding Verizon employee who understood the urgency and impact of our situation and shepherded our case through the byzantine halls of inter-carrier communications. We had control of the phone number back by 2 PM (which, if you’ve ever tried to get two phone companies to talk to each other, is a significant achievement. We were initially assuming we wouldn’t be able to regain control until the following week). How in the world is a random guy supposed to do this sort of thing? Anyone have any tips for people who get into these situations and who aren't already BFFs with C-level executives of phone companies or something like that?
- lrvick 10y agoI have answers/arguments along those lines here: https://github.com/lrvick/security-token-docs/blob/master/FAQs.md https://github.com/lrvick/security-token-docs/blob/master/FA... Would be interested in seeing contrasting views though!
- tptacek 10y agoThese are indeed answers, but they aren't the real answers. The real answer for "why not a smartphone app" is "because code generators are just as phishable as passwords". In the real world, that's how people are being compromised, not by elaborate phone exploit pivots but by phishing pages. It also speaks to why phone authenticators are acceptable backups to tokens. The real answer for "why not SMS" is "because both teenagers and intelligence services can get a phone number redirected; your phone number is not your phone." Obviously, you don't PIN-lock a U2F token; the answer to "what if it's stolen" is "whoever stole it probably doesn't have your password, which they'll need in order to use the token, so if your token is stolen remove it from your account and then fish $17.99 out of your couch cushions and buy a new one".
- lrvick 10y agoCode generators are super phishable and that is the whole reason to abandon them in the medium term. In the short term however they are all we have for most websites so protecting the secret in a hardwre token is as good as we can get. No matter how much you protect the secret though, not getting phished is left to the hopefully paranoid user, which is for sure not ideal, but we are probably years out from TOTP being replaced with U2F for most sites. TOTP via hardware tokens is a stopgap. Great comments though. Will update to reflect them.
- tptacek 10y agoCode generators are indeed phishable, which is why your primary login factor is a U2F token. Meanwhile, because of the way phishing works, if you go log in of your own volition to your Google Mail account, the TOTP code provides about as much security as the U2F key does. The idea behind the U2F/TOTP stack is to minimize your exposure to phishing attacks and at the same time minimize (to practically zero) the odds of you being locked out of your account. It accomplishes that nicely, which is why most of the other experts we talk to have U2F/TOTP/backup-codes as their Google 2FA stack.
- orbitingpluto 10y agoThe HyperFIDO Mini (U2F Security Key) is the cheapest and smallest key I've found so far for $10. (Amazon) The Yubico are probably the best key chain candidate. No one wants to trust their key to a weak nylon thread. You can also set up a Google account to use more than one U2F key. As for Google 2FA, I think Google caused a lot of confusion by how they set up the Google Authenticator app. Always opt for the text generator codes instead of a barcode. You can then use the code to use on a second Google Authenticator app on another device. Google at one time stated that you could only set up 2FA on a single device, which makes most users leary as one could lose his or her phone.
- nsheridan 10y agoThere's noting stopping you from scanning the barcode multiple times
- orbitingpluto 10y agoDidn't it change the web page on your computer browser after you successfully added it into Google Authenticator? I suppose you could always take a photo of the QR code and then rescan that. Text seems simpler. edit: Anyone else remember this behavior? Old version? Browser specific?
- hdhzy 10y agoIt changes when you input current code. You can scan it multiple times, print it, and then input the code from one of your devices.
- captn3m0 10y agoAlso, if you have a rooted device, you can get the original secret from the SQLite database of the authenticator app.
- garethadams 10y ago
- phillc73 10y agoThe article mentions Yubikey at $18. As an alternative, the Nitrokey U2F is only €9 (€11 including delivery) https://shop.nitrokey.com/shop/product/nitrokey-u2f-5 https://shop.nitrokey.com/shop/product/nitrokey-u2f-5
- nspassov 10y agoPlus, unlike with Yubikey, Nitrokey has open-sourced both hardware and firmware [1]. [1] https://github.com/nitrokey https://github.com/nitrokey
- phillc73 10y agoTrue for their storage and encryption products. Unfortunately not for their U2F product. "Nitrokey U2F is a relabeled 3rd party product and hence not open source."[1] [1] https://shop.nitrokey.com/shop/product/nitrokey-u2f-5 https://shop.nitrokey.com/shop/product/nitrokey-u2f-5
- ptman 10y agoYubikey U2F is much higher quality physically than Nitrokey U2F. I wouldn't trust the nitrokey to last very long. I may be wrong, but that's just the impression from comparing them in my hands
- lyrrad 10y agoThe article says that any key will do. Is there any concern with buying a less expensive security key from a less established company, or even a third party seller on a site like Amazon? Could a malicious entity make an intentionally weak security key and sell it? How would such an attack be detectable?
- tptacek 10y agoU2F Yubikeys are so cheap and available (Amazon will ship them Prime) that I'm not sure why you'd waste time looking for alternatives.
- lrvick 10y agoI would stick to things like nitrokeys/yubikeys that have gone through rounds of side-channel attacks, research, and upgrades. The only one I can generally suggest for most people right now, in spite of it being closed, is the yubikey 4. Mostly because it can be configured to require a physical touch for each operation. Something a remote attacker can't do. I started putting some comparisons down here: https://github.com/lrvick/security-token-docs/blob/master/Devices.md https://github.com/lrvick/security-token-docs/blob/master/De...
- ubercow13 10y agoIs there any point in doing this if you do not use Chrome?
- hdhzy 10y agoOnly Chrome supports U2F. Firefox has experimental support of you enable special flags in about:config but I never got it to work. U2F will be superseded by Web Authentication [0] that includes U2F and will be supported by all major browsers. Edge includes draft spec API that uses TPM to store keys. [0]: https://w3c.github.io/webauthn/ https://w3c.github.io/webauthn/
- cntlzw 10y agoYou can use U2F in firefox with extension. Last time I tried it worked. However I use chrome most of the time so I am not sure if it still does. https://addons.mozilla.org/en-Us/firefox/addon/u2f-support-add-on/ https://addons.mozilla.org/en-Us/firefox/addon/u2f-support-a...
- james_pm 10y agoOpera also has native U2F support, although some services (I'm looking at you, Dropbox) refuse to show the token UI to anything but Chrome via browser UA checking.
- barking 10y agoI'd like some advice about safely accessing gmail from your phone. In particular an android phone that might not have the latest version of android on it. Also for situations where not only do you access your gmail from your phone but also your google authenticator app is installed on it.
- b15h0p 10y agoThe recommended way are app passwords. You basically generate a password for each app that needs to access your mail account. You can easily revoke access for a single app in case something goes wrong. Also, nobody gets the chance to read your actual password.
- RJIb8RBYxzAMX9u 10y agoUnfortunately, you can't access GMail over its "native" protocol using app-specific passwords: it'll only work for IMAP. And the GMail client is a terrible IMAP client. My inbox and folders / labels would constantly desync. I'd moved to FastMail a while back and the problem persisted, so I'm reasonably sure it's the client. I'm actually using Outlook as my e-mail client now. It's surprisingly snappy for my minimal needs. Maybe I should switch to iCloud for e-mail, and aim for the trifecta...
- dotancohen 10y agoUpvoted because I would love an answer to this as well. An associate in the phone-cracking hobby has mentioned to me that _no_ Android phone is malware-free. They have cracks and methods for phones and OS versions that have yet to hit the market. I've understood from him that the only "secure" device is the iPhone, and even that is not secure from targeted (government) attacks. That said, I personally would never own an iPhone and I'm happily bliss on my Note 3 with Android 4.4. But I don't access my mail, bank, or anything else sensitive on the device. For me it is no more than a phone, camera, and Anki interface!
- cntlzw 10y agoBought a U2F Yubikey more than a year ago. It is pretty sturdy. Better buy two and use one as a backup. U2F is really convenient to use. Compare that to all the OTP apps out there.
- captn3m0 10y agoMy Yubikey recently died, so I'd +1 on this approach to have another as backup. They offered to replace it under warranty, though.
- lrvick 10y agoI am very curious what you did to kill it. I have been unable to with anything short of a hammer or soldering iron.
- lrvick 10y agoCan attest to sturdyness. I have washed and decased 2 of mine with acetone and they still work as expected. As an alternative to a second key as a backup, you can always keep a set of printable backup OTP tokens offline in a safe etc, ideally encrypted.
- hdhzy 10y agoU2F has some interesting properties. It cannot be phished (browser sends origin to the token), binds the credentials to username (you can use one token multiple times), can be attested (e.g. server can trust tokens only from manufacturer X), uses asymmetric crypto (P-256) instead of shared secrets.
- TorKlingberg 10y agoHow does the communication between the USB key and Google in a browser work? Will it work on all operating systems and browsers?
- r3bl 10y agoAs for the operating systems: in order to use it on your phone, you'll need to be careful to use a YubiKey with NFC support and have a phone that supports NFC. You won't have any trouble using it on Windows/Ubuntu/macOS. As for the browsers: Chrome/Chromium works fine. Firefox has an addon that adds security key support[0]. Unfortunately, this addon has a bug which causes high CPU load[1]. Firefox is also working on adding the native support for this, and I think that their ETA is somewhere in the second half of this year to get this thing to work natively. Unfortunately, even with the U2F addon on Firefox, you still won't be able to use it for Gmail, since Google hardcoded its browser to be the only one with U2F support, so you're going to have to change your user agent in order to use it, or default back to your second method of 2FA (Google Authenticator or something of the sorts). I have no knowledge about the U2F status on Safari and Edge. As far as I was able to discover, the only service that didn't hardcode Chrome as being the only browser at the moment with U2F support is GitHub, and using YubiKeys with Firefox + U2F addon on GitHub works without any issues (other than the occasional high CPU load that I've already mentioned). I wrote a short article on my blog about Yubikey usefulness for my usual setup about a year ago[2]. Things changed slightly to the better since then, but not by a lot. [0] https://addons.mozilla.org/en-US/firefox/addon/u2f-support-add-on/ https://addons.mozilla.org/en-US/firefox/addon/u2f-support-a... [1] https://github.com/prefiks/u2f4moz/issues/51 https://github.com/prefiks/u2f4moz/issues/51 [2] https://blog.r3bl.me/en/yubikey-review/ https://blog.r3bl.me/en/yubikey-review/
- timvdalen 10y agoThe article states: >If you're curious why it's important to not have a phone number on your account, see the security key FAQ. but this is not explained in the FAQ. I've never heard about this before, why is this important?
- mavhc 10y agoI guess because it's relatively easy to redirect/capture an sms/phone call. Trick the phone company into moving your number to a new sim for example
- idlewords 10y agoYes. Also governments can see SMS in transit (a concern in many places), and SMS-es can show up on a lock screen. I'm updating the FAQ next; sorry for this dangling reference!
- probably_wrong 10y ago"We'll remove the phone number later" Too late, Google now has it and can correlate my profile with other sources. There's literally no other reason why Google doesn't let you enable 2FA without a phone number. I wish I didn't have to choose between security and privacy.
- masto 10y agoRelevant username, I see.
- rubatuga 10y agoGet a throwaway or a burner phone? If you're that concerned, pick up a 20$ prepaid and quit your whining
- idlewords 10y agoThere is a more benign reason Google requires a phone number—they're worried you'll lock yourself out of your account. I'll take the Pepsi challenge with anyone on Google bashing, but I think this one is not fair. It does hold for Facebook, though :-)
- lrvick 10y agoI would advise against Google Authenticator as a backup as it really defeats the point of a hardware token. Google Authenticator stores the TOTP secret in plaintext on your device where the potential exists for it to be stolen. An adversary that exploits your phone can generate TOTP tokens as they like and ignore the fact you have a hardware token. If you are going to use Google Authenticator it is your weakest link and a security token buys you no added security, only ease of use. The typical goal of a security token is to be able to assert: "No one can log into my account without this physical device or an offline backup token from my safe" To acheive this consider a device with built-in TOTP support in addition to U2F. All current Yubikeys fit the bill here as as well as some Nitrokey models. Desktop or Android users can use the either USB or NFC devices but it is worth noting that iOS lacks support for either which means you would need a desktop or Android device to fetch TOTP tokens for an iPhone. You can use the open source "Yubico Authenticator" apps to store your TOTP secrets in your key alongside your U2F secret. Now both methods use the same hardware and your phone/computer only get handed OTP codes from the key if present, but can't generate them itself. Added bonus is now you can now use security token backed login even on the majority of sites/browsers today that lack U2F support. Extra bonus is these keys can be used for ssh without any server changes. Security token all the things :)
- kasey_junk 10y agoIf only there were a similar guide to getting gpg agent working with the yubikey stored gpg keys and ssh. I've done it, but for the life of my I couldn't tell you how as it was mostly just trying magic incantations of things until it started working.
- lrvick 10y agoHere you go: Simple GPG setup: https://github.com/lrvick/security-token-docs/blob/master/Use_Cases/GPG/Simple_Setup.md https://github.com/lrvick/security-token-docs/blob/master/Us... Advanced GPG setup with backups: https://github.com/lrvick/security-token-docs/blob/master/Use_Cases/GPG/Advanced_Setup.md https://github.com/lrvick/security-token-docs/blob/master/Us... SSH Setup: https://github.com/lrvick/security-token-docs/blob/master/Use_Cases/SSH.md https://github.com/lrvick/security-token-docs/blob/master/Us... I also will be adding an alternate "quick ssh setup" guide via PKCS#11 flows to just store an existing ssh private key. Still I think GPG is the way to go in general given all the other use cases it opens up. Please file issues with anything you want to see! I have a lot of unpublished content I can get polished/up if people care.
- wxiluo 10y agoIf you want to use your Google Account on your iPhone's Mail, Calendar, or Contact apps. Security Key doesn't work with apps that come on your iPhone, but you can use Google apps instead.[0] I'm using Google Contact on my iPhone. It seems security key is not for me. :( [0]: https://support.google.com/accounts/answer/6103523 https://support.google.com/accounts/answer/6103523
- wh313 10y agoHave you tried using app specific passwords?
- deleted 10y ago[deleted]
- angry_octet 10y agoThe best part of the article: "If you're on a newer mac, you may have to use a USB adapter, like an animal"