6 ms·
Here's a guide for how to set up SMS-free two-factor authentication on your Gmail account. It will cost you $18; if that's a hardship, contact me. https://tech
by idlewords 10y ago
Here's a guide for how to set up SMS-free two-factor authentication on your Gmail account. It will cost you $18; if that's a hardship, contact me.
https://techsolidarity.org/resources/security_key_gmail.htm https://techsolidarity.org/resources/security_key_gmail.htm
- gruez 10y agoYou dont even need to buy a $18 hardware token. You can use a software TOTP token (ie. google authenticator)
- cbhl 10y agoSo long as you never switch or factory reset phones, because Google Authenticator, by design, never reveals the private keys. (I've locked myself out of accounts because I broke my phone and had to get a new one.) Also, do you really trust your Android phone with your TOTP private key? How do you know there isn't malware running on it as root?
- deleted 10y ago[deleted]
- tlrobinson 10y agoIsn't that what the backup codes they give you when you enable it are for?
- tptacek 10y agoYes, not to mention that you can enroll more than one TOTP authenticator. There are legit complaints about Google Authenticator (foremost among them that it's a nightmare when you have more than 4-5 accounts), but "no backups" isn't one of them. Don't back up TOTP secrets.
- otterley 10y agoGoogle Authenticator provides a list of backup codes that you can print and put in your wallet, or store as a secure note (e.g. in 1Password): https://support.google.com/accounts/answer/1187538?hl=en https://support.google.com/accounts/answer/1187538?hl=en
- jasonjayr 10y agoOne advantage that software TOTP provides over hardware TOTP, is that you can print the QRCode w/ the private key, and lock it in a safe. This allows you a trivial means of cloning and backing up the token. Unfortunately, this is against best practices, since you have multiple copies of the private key lying around; but this has been an acceptable trade-off for me thus far.
- kej 10y agoJust print the TOTP QR code and store it in a safe place. Then you can set up an authenticator on the new phone with the same key as the old one.
- biafra 10y agoYou can authenticate more than one device. At least with Google accounts in the past. Meanwhile I use Titanium backup to backup authenticator and restore it on a different device.
- tscs37 10y agoThere are alternative TOTP apps that offer backup options.
- alasdair_ 10y agoI use google authenticator along with a printed list of recovery codes. Half are stored in my safe and half in another location offsite. I own a yubikey but it's useless as a permanent device since it needs a fullsize USB port - something my phone (and the latest gen macbook) lack.
- Natanael_L 10y agoThey have a new USB C equipped version
- idlewords 10y agoThat does not provide an equivalent level of protection. If I can get you to enter your Google credentials into a site I control with a TOTP token, I own your email. That is not true for a security key.
- wereHamster 10y ago> First, order a Yubikey! Any Yubikey will do; we recommend the blue one because it's cheapest. You can buy it for $18 on Amazon: <link to amazon> I wouldn't buy a security device from amazon. You can buy that device on the official yubico website.
- wccrawford 10y agoIn case anyone doesn't know it, Amazon doesn't always have legit products. Sometimes sellers provide clones that look real enough to fool Amazon, if Amazon is even checking. And clearly you don't want a fake security device.
- Afton 10y agoCan you give flavor on this: "Now we need to remove our phone number as backup method. (If you're curious why it's important to not have a phone number on your account, see the (https://techsolidarity.org/resources/security_key_faq.htm)[security https://techsolidarity.org/resources/security_key_faq.htm)[s... key FAQ].) " Unfortunately, the security key FAQ contains no info on why you shouldn't have your phonenumber. I assume it's because phone-number migrations can be used to take control of your accounts? EDIT: Yeah. Perhaps reading the article instead of just coming to the comments might have been useful.
- zyx321 10y agoIt's pretty obvious in the context of this story. You can recover your Google password if you have access to SMS on that number and can answer the "security" question.
- city41 10y agoThe guide suggests adding Google Authenticator as a backup. Doesn't that mean this isn't any more secure than just using Authenticator? Why can't a crook say they don't have the key, and proceed to hack Authenticator?
- idlewords 10y agoBecause that would require them to have physical access to your unlocked mobile device. It's equivalent to saying "why can't a crook just steal your security key". The threat model this setup is protecting against is phishing. For that purpose, a security key is much better than TOTP (authenticator app).
- city41 10y agoThat doesn't make any sense to me. If they require physical access to my unlocked phone, then isn't the phone just as secure as the yubikey? If so, why bother with the yubikey? If the phone has other attack vectors, such as compromising the OS, and is indeed less secure than the yubikey, then doesn't having it as a backup just lower the bar for security to the phone? As far as I can tell, there's nothing stopping from someone just ignoring the yubikey if authenticator is also an option.
- tptacek 10y agoU2F security keys are a mutual authentication mechanism. The key authenticates the site as the site authenticates the key. Phone TOTP applications can't do that.
- city41 10y agoThat still doesn't answer my question. If you read the guide that I am asking about, it advocates using security keys and also setting up phone TOTP as a backup. But I also don't need to know too badly, so I think I'll just move on.
- 10y ago