4 ms·

For some reason Google Smart Lock doesn't allow you to use a U2F Yubikey as a backup to the phone-based prompt. Seems totally absurd as a Yubikey is the perfect

by gomox 8y ago

For some reason Google Smart Lock doesn't allow you to use a U2F Yubikey as a backup to the phone-based prompt. Seems totally absurd as a Yubikey is the perfect backup to a lost phone. Also did I mention that if you use 2FA, Google's "find my phone" functionality asks you to use your phone to authorize the login before you can find it? Yes. You heard that right. Use your phone to find your phone. Don't ask me how I know.

CDSlice 8y ago
Well, presumably you are using 2FA because you don't want anyone that stole your password to be able to access your account, so do you really want anybody with access to your password to track your location?
- e40 8y ago
  Isn't the that, in the lost phone case, you can never answer that query?
  - tialaramex 8y ago
    Google prompts you (maybe even requires) to enable at least two distinct ways to get in. Now, of course it's possible you've tied both of those to your phone, but I put it to you that this makes it your fault. If my other method works, even if it's a huge pain (e.g. maybe my other FIDO key is at home and I've flown to Tokyo) then I do still have options. Maybe not options I _love_ but that's security for you. If you have a massive house fire that both destroys your bank documents and leaves you so badly burned you can hardly talk let alone sign your name, good luck the first time you try to withdraw cash from that bank account. If you set Advanced Protection both distinct ways have to be FIDO Security Keys, and whilst it's conceivable you could own a phone that functions as _one_ FIDO key (I would expect Apple to do this for example) it doesn't make any sense to have a single phone serving as _both_ your keys, even a non-technical person can hopefully spot that.
- gomox 8y ago
  Even though my intuition is that the lousy product manager who made that decision did it because of this reasoning, I would venture that 99.999% of the people prefer to find their phone when they lose it than having this guarantee by default. If someone has my password and is trying to track me down, all you have to do is let me know that this is happening with a notification on my phone so I can rapidly change my password by using the device I am holding in my hand. If you are the kind of person where this small time window of physical location disclosure is a significant vulnerability, you shouldn't carry a Google-manufactured phone without putting it in an RF-proof bag anyway.
cjcampbell 8y ago
Regarding the first point, I assume that has to do with the lack of support for NFC based U2F on Apple devices. Bluetooth is still the lowest common denominator.
- gomox 8y ago
  NFC has nothing to do with this as I am talking about a regular U2F YubiKey that I could use by physically plugging into a computer in the rare scenario where I might lose my phone.
technofiend 8y ago
I feel your pain. Did the exact same thing to myself before enrolling two u2f keys. I turned that off after switching to hardware keys and printing out the back up codes.

by gomox 8y ago

CDSlice 8y ago

Well, presumably you are using 2FA because you don't want anyone that stole your password to be able to access your account, so do you really want anybody with access to your password to track your location?

e40 8y ago
Isn't the that, in the lost phone case, you can never answer that query?
- tialaramex 8y ago
  Google prompts you (maybe even requires) to enable at least two distinct ways to get in. Now, of course it's possible you've tied both of those to your phone, but I put it to you that this makes it your fault. If my other method works, even if it's a huge pain (e.g. maybe my other FIDO key is at home and I've flown to Tokyo) then I do still have options. Maybe not options I _love_ but that's security for you. If you have a massive house fire that both destroys your bank documents and leaves you so badly burned you can hardly talk let alone sign your name, good luck the first time you try to withdraw cash from that bank account. If you set Advanced Protection both distinct ways have to be FIDO Security Keys, and whilst it's conceivable you could own a phone that functions as _one_ FIDO key (I would expect Apple to do this for example) it doesn't make any sense to have a single phone serving as _both_ your keys, even a non-technical person can hopefully spot that.
gomox 8y ago
Even though my intuition is that the lousy product manager who made that decision did it because of this reasoning, I would venture that 99.999% of the people prefer to find their phone when they lose it than having this guarantee by default. If someone has my password and is trying to track me down, all you have to do is let me know that this is happening with a notification on my phone so I can rapidly change my password by using the device I am holding in my hand. If you are the kind of person where this small time window of physical location disclosure is a significant vulnerability, you shouldn't carry a Google-manufactured phone without putting it in an RF-proof bag anyway.

cjcampbell 8y ago

Regarding the first point, I assume that has to do with the lack of support for NFC based U2F on Apple devices. Bluetooth is still the lowest common denominator.

gomox 8y ago
NFC has nothing to do with this as I am talking about a regular U2F YubiKey that I could use by physically plugging into a computer in the rare scenario where I might lose my phone.

technofiend 8y ago

I feel your pain. Did the exact same thing to myself before enrolling two u2f keys. I turned that off after switching to hardware keys and printing out the back up codes.