3 ms·

Am I correct in seeing that U2F can't be enabled for G-Suite accounts yet? I can't find the setting in the Admin panel.

by timvdalen 8y ago

tptacek 8y ago
No, you can definitely enroll U2F keys in GSuite accounts.
- seanhunter 8y ago
  Yup. To the extent I use gsuite, I use it with a yubikey for authentication.
mimming 8y ago
Generally yes, but the admin has the power to either enforce it (for some or all users) or disable it domain wide. If you were to create a new GSuite domain today, it'd be allowed for all users.
BillinghamJ 8y ago
U2F can, but the Advanced Protection program can't currently.
- rocqua 8y ago
  from https://landing.google.com/advancedprotection/ https://landing.google.com/advancedprotection/ : I’m interested in Advanced Protection for my work account - Can I enroll a G Suite Account in Advanced Protection? With the help of your Administrator, it’s possible to replicate the features of Advanced Protection on a G Suite account. Take a look at this help center article to get started. the help center link: https://support.google.com/a/answer/9010419 https://support.google.com/a/answer/9010419
- tialaramex 8y ago
  Advanced Protection changes your relationship with the administrators (Google). But for GSuite the administrators are some other member of your organisation, so Google can't make a web page that changes that relationship. If your company decides that the New York employee named "Steve Smith" and the London employee "Stephen Smith" are the same person, and either should be able to request account password reset for steve.smith@company.example, both of these chaps are going to have a bad time. Google can _tell_ them this is a terrible idea, but GSuite is a company product, so ultimately it's their terrible idea if that's what they want to do. The _technical_ features of Advanced Protection seem to be mostly: Use FIDO Security Keys (U2F/ WebAuthn), disable stuff we know is useful but insecure. You can opt into those technical changes for your GSuite, either for everybody or a selected group e.g. "Company Security Nerds" or "Executive Level Employees" or "Everybody except Pamela. Damn it Pamela". But the non-technical feature is hard and probably just not replicable at all.
  - BillinghamJ 8y ago
    Yes essentially the issue is that it's possible to permanently and irrecoverably lose access to your account with the Advanced Protection program enabled. But that clearly wouldn't work when your account admin can just reset things. So you can have an equivalent set of options configured, but it isn't exactly the same.
rocqua 8y ago
from https://landing.google.com/advancedprotection/ https://landing.google.com/advancedprotection/ : I’m interested in Advanced Protection for my work account - Can I enroll a G Suite Account in Advanced Protection? With the help of your Administrator, it’s possible to replicate the features of Advanced Protection on a G Suite account. Take a look at this help center article to get started. the help center link: https://support.google.com/a/answer/9010419 https://support.google.com/a/answer/9010419

Am I correct in seeing that U2F can't be enabled for G-Suite accounts yet? I can't find the setting in the Admin panel.

tptacek 8y ago

No, you can definitely enroll U2F keys in GSuite accounts.

seanhunter 8y ago
Yup. To the extent I use gsuite, I use it with a yubikey for authentication.

mimming 8y ago

Generally yes, but the admin has the power to either enforce it (for some or all users) or disable it domain wide. If you were to create a new GSuite domain today, it'd be allowed for all users.

BillinghamJ 8y ago

U2F can, but the Advanced Protection program can't currently.

rocqua 8y ago
from https://landing.google.com/advancedprotection/ https://landing.google.com/advancedprotection/ : I’m interested in Advanced Protection for my work account - Can I enroll a G Suite Account in Advanced Protection? With the help of your Administrator, it’s possible to replicate the features of Advanced Protection on a G Suite account. Take a look at this help center article to get started. the help center link: https://support.google.com/a/answer/9010419 https://support.google.com/a/answer/9010419
tialaramex 8y ago
Advanced Protection changes your relationship with the administrators (Google). But for GSuite the administrators are some other member of your organisation, so Google can't make a web page that changes that relationship. If your company decides that the New York employee named "Steve Smith" and the London employee "Stephen Smith" are the same person, and either should be able to request account password reset for steve.smith@company.example, both of these chaps are going to have a bad time. Google can _tell_ them this is a terrible idea, but GSuite is a company product, so ultimately it's their terrible idea if that's what they want to do. The _technical_ features of Advanced Protection seem to be mostly: Use FIDO Security Keys (U2F/ WebAuthn), disable stuff we know is useful but insecure. You can opt into those technical changes for your GSuite, either for everybody or a selected group e.g. "Company Security Nerds" or "Executive Level Employees" or "Everybody except Pamela. Damn it Pamela". But the non-technical feature is hard and probably just not replicable at all.
- BillinghamJ 8y ago
  Yes essentially the issue is that it's possible to permanently and irrecoverably lose access to your account with the Advanced Protection program enabled. But that clearly wouldn't work when your account admin can just reset things. So you can have an equivalent set of options configured, but it isn't exactly the same.

rocqua 8y ago

from https://landing.google.com/advancedprotection/ https://landing.google.com/advancedprotection/ : I’m interested in Advanced Protection for my work account - Can I enroll a G Suite Account in Advanced Protection? With the help of your Administrator, it’s possible to replicate the features of Advanced Protection on a G Suite account. Take a look at this help center article to get started. the help center link: https://support.google.com/a/answer/9010419 https://support.google.com/a/answer/9010419