13 ms·
Your Android Phone Is a Security Key
- Hamuko 8y agoI don't know how I feel about making a device so endlessly hackable a "security key".
- lostmsu 8y agoAren't you already using Authenticator running on an Android device?
- dsfyu404ed 8y agoThat doesn't mean I think it's a good idea. A phone is better than nothing. A real token would be much better.
- ghaff 8y agoI'd argue using Authenticator is better than simply not using 2FA. Which is probably the choice for a lot of people for whom always carrying some dedicated hardware device is not really a realistic option.
- vcavallo 8y agoabsolutely. it’s a second thing to hack. just because it’s _possible_ to hack the second thing doesn’t mean it isn’t helpful.
- jetrink 8y agoIn what way is carrying a dedicated device not realistic? My second factor lives on my keyring and is only a bit larger than a typical door key. Everyone carries keys.
- ghaff 8y agoI don't carry my keys when I'm traveling if I'm not driving my own car. So, no, not everyone carries keys. ADDED: I do have other 2FA hardware as well. But I assume I'm not guaranteed to have it with me when I need it.
- scarejunba 8y agoAh, you have separate keyrings for your home keys and car keys? I'd say that's not usually the case.
- ghaff 8y agoNo. I have a keypad on my door. So when I take a trip by air (which is common), I just leave my keys at home. But I agree that my scenario may not be super common.
- deleted 8y ago[deleted]
- danans 8y agoIt's common in any situation where you share a car with other people.
- int_19h 8y agoWhich, in turn, is more common outside of US.
- Kalium 8y ago> In what way is carrying a dedicated device not realistic? For most people, it's so far outside what they're familiar with that it feels alien and incomprehensible. It makes absolutely no sense to them. So they're not going to do it or adopt it quickly. User education will catch up in time, but that will take quite a long time.
- 8y ago
- deleted 8y ago[deleted]
- deleted 8y ago[deleted]
- oarsinsync 8y agoGoogle Authenticator is just Google's front end to an open standard (TOTP). Authy, 1Password, various CLI apps, they all implement this same standard. Lots of independent websites market this form of 2FA as "Google Authenticator". It's kinda like asking people to enter their gmail address (rather than their email address). Eitherway, TOTP is a big step away from putting all your 2FA eggs in Google's basket.
- Animats 8y agoUm, yes. Plus it uses "Google Cloud". A security key device ought not to be remotely writeable.
- guelo 8y agoAll Android devices certified by Google will have a hardware security module which should keep the keys secure. Some cheap non-certified devices (mostly Chinese) might not have hardware backed keystores, but I doubt those devices would be able to run this Google app.
- JohnFen 8y agoIf a Google app is required for this, we've already entered the "can't be trusted" category.
- penagwin 8y agoNot doubting you, but were did you find that information? The only thing I see is "it’s built into devices running Android 7.0+" and I found that on multiple pages. As Android 7.0 is available to install on any device and I don't see anything about "certified android devices", I assume they mean ANY Android 7.0 device? Then again it only works with Google services atm, but I know you can sideload google play services so... https://support.google.com/accounts/answer/6103523 https://support.google.com/accounts/answer/6103523
- lern_too_spel 8y agoAndroid 7 supports key attestation. https://source.android.com/security/keystore/attestation https://source.android.com/security/keystore/attestation
- munchbunny 8y agoThat's great, but that doesn't actually guarantee that this new feature requires that the phone is using the hardware security module, just that you'd be able to prove if it it was. Don't get me wrong, it's still better than TOTP in many ways, but having the actual security coprocessor is a big distinction.
- lern_too_spel 8y agoThere is no practical difference. For people who need the security, this API can guarantee it.
- duxup 8y agoMy phone already prompts me when I login to a google account on another device. Is this new / different?
- sofaofthedamned 8y agoI thought that. AFAICT it's local via Bluetooth, as opposed to through Google servers and push messaging. Good idea, but better if it's open. Of course their motivation as normal may be to have users have their wifi/bluetooth on all the time so they can reliably collect more location data.
- cosinetau 8y agoI think the difference is that the prompt you describe still travels over the wire to get to your device, while this new thing used Bluetooth based on FIDO standards. So the access key the client logging in passes to the server is from the local device you trust.
- duxup 8y agoAh thank you! Sometimes google's announcements really make it hard to understand their products when there is overlap or similarities or what.
- arnarbi 8y agoAs others pointed out, the difference is that the local connection to the phone, together with the Webauthn+FIDO protocols make this resistant to phishing. That comes at the cost of needing Bluetooth, which isn't available on all computers. I.e. it's more secure than the prompt you have now, but that will at least work everywhere. The right tradeoff between the security and the convenience/availability is something that is very context-dependent, and different for each user. Hence the multiple options.
- godelski 8y agoThis is great. Hopefully it'll get more people using 2FA. I don't think this is the best security practice, as others are nothing how insecure Android is. But it's better than nothing. It also pushes more people to use FIDO and 2FA. This is for the average person. If you want more get an yubi key or something.
- godelski 8y agoEdit after trying: It is a little disappointing that it is Chrome only.
- arnarbi 8y agoImplementing and maintaining the code in the browser that manages the local BLE channel to a FIDO authenticator is unfortunately a significant undertaking. We (the team behind this at Google) work actively with FIDO and the W3C on the open standards behind this so that other browsers can support this as well in the future.
- godelski 8y agoI'm very happy with the work and understand it is no trivial feat. But as a FF user I can't really try it out. > We (the team behind this at Google) work actively with FIDO and the W3C on the open standards behind this so that other browsers can support this as well in the future. Super excited to hear this.
- mattjack 8y agoThey don't make this very obvious but this only works in Chrome. So you'll have to use SMS codes, the Authenticator app, or backup codes everywhere else. (edit: they explicitly say so when activating it but not as clearly in the docs)
- michaelmior 8y ago> all you need is an Android 7.0+ phone and a Bluetooth-enabled Chrome OS, macOS X or Windows 10 computer with a Chrome browser
- eitland 8y agoHeh, Microsoft seems better than Google to support Linux in new products now. VS Vode is amazing, as is dotnet core. Who would have thought 5 years ago.
- layoutIfNeeded 8y agoOf course they do. This is the “embrace” phase.
- Dylan16807 8y agoI could see an argument about WSL being that. But making your software work on the linux desktop/server? I really don't see how that lets you get into a position toward extinguishing anything.
- eitland 8y agoEspecially not when they have open sourced it under a liberal license.
- realusername 8y agoNot really, that's because Windows Server isn't that popular and if they want developers to remain on Windows and still use MS tech for their deployment they need some sort of Linux support.
- codemac 8y agoIs there any way to get this working in Firefox? :(
- mjg59 8y agoAs far as I know, Firefox doesn't support BTLE U2F devices yet (I work at Google, but not on this project)
- correct_horse 8y agoIt probably depends on Web Bluetooth, which Firefox doesn't yet support, see https://developer.mozilla.org/en-US/docs/Web/API/Web_Bluetooth_API https://developer.mozilla.org/en-US/docs/Web/API/Web_Bluetoo... As an aside, I'm not sure that I want random JavaScript to be able to do Bluetooth stuff. At the least, I'd want the ability to limit it on a per-website basis.
- sakisv 8y agoI like the idea behind it in principle, since it will simplify 2FA for the masses and may lead more people to adopt it. But, apart from that: 1. It's only on Chrome (for now(?)) 2. It's only for Google products (for now (?)) 3. It's only on Android that Google fully controls remotely (and probably it will stay there). All these give even more power to Google at the expense of convenience and allows a single company to define "how things should be done". And I should clarify that I am not against this tech specifically. If anything, I think Google has some of the brightest minds, so technically I'm sure that the product will be great. The problem is that with great power comes something that Google (as a company) seems to be lacking lately.
- peterwwillis 8y agoThe problem isn't even Google, it's just lack of actual support for services that need it. You have to have the right client, the right device, and every website has to implement it. Government websites won't support it, nor most financial services, your gym, school, job, etc. Sensitive records like your SSN will be kept in walled gardens accessible by a simple user and password, and maybe a security question. Most people will still be at significant risk of exposure because the real targets of information theft aren't logged into by end-users. But your Gmail account will be locked down.
- icebraining 8y agoWell, that depends where you live. Google is available for everyone, not just technologically-backward places. Here millions are currently checking their pre-filled tax returns, which they have accessed using smartcard authentication, so Gmail ain't that far ahead.
- Bluestrike2 8y agoAdmittedly, that's not a minor benefit. If someone has access to your Gmail account, there's all sorts of information there they can use to engineer access to other services. The naive optimist in me wants to think that making security keys accessible to more users, and getting them used to them, will lead to pressure for other services to follow suit. But then I think about how long people have been criticizing banks for ridiculous password policies that are seemingly universal in the industry, and I know better. Or bad security practices at organizations in general. I'd very much like to be proven wrong.
- daphneokeefe 8y agoCan someone explain how TFA (or any security feature that relies on my phone) works when the phone is unresponsive -- dead battery, no cell or internet reception, hardware failure.
- mattjack 8y agoIt won't--so you'd have to use the backup methods they made you set up, like SMS codes, Authenticator, printable backup codes, etc.
- krzyk 8y agoSMS and authenticator won't work on a dead phone either, so you are left with keeping a paper with backup codes.
- macspoofing 8y ago>so you are left with keeping a paper with backup codes. It's not magic, there isn't any other way.
- henryfjordan 8y agoOr a second key. What happens when your first and only Yubikey gets dropped in a puddle? You're also back to paper and backup codes.
- wetpaws 8y agoU2F fits into this scheme nicely
- Rafert 8y agoWebAuthn is the successor to U2F. This is just another transport (caBLE/"cloud assisted Bluetooth") for this standard in addition to NFC, USB and a direct connection to a Bluetooth authenticator (e.g. Feitian and Google Titan key).
- daphneokeefe 8y ago
- doughj3 8y ago> Now, you have one more option—and it’s already in your pocket. Starting today in beta, your phone can be your security key—it’s built into devices running Android 7.0+. You know, it's nice they phrase this as an "option", but in my experience Google has the habit of forcing me to have my phone on me when I login from a new location / new device, something I never asked for and apparently cannot disable.[0] This has locked me out of my Google account more than once which also locks me out of anything that sends 2FA to my Gmail or Gvoice. I guess I'm thankful that I've learned this in non-emergency scenarios, as I'm now prepping to degoogleify myself, but it's a user-hostile in my opinion. Security always has convenience trade-offs, but let the user decide where they want to draw that line. [0] https://pbs.twimg.com/media/D3WJ0UdXkAASs_O.png https://pbs.twimg.com/media/D3WJ0UdXkAASs_O.png
- icebraining 8y agoGoogle has always given me other options, does it really enforce having a phone now?
- doughj3 8y agoI don't know how they determine what options to offer, but using my phone was the only one given, despite entering a correct password. The only other option, which I either found from the "Learn more" link or after exhausting the "login with your phone" attempts, was to create a support ticket for my G-suite account which, in this case, would have been slower than returning to home a few hours later where I had left my phone.
- munchbunny 8y agoIs this based on a hardware security module in the phone? I don't see this written anywhere in the blog post. For something like this, especially with your phone, putting the private keys out of reach of the CPU/memory and hardened against side channel attacks is table stakes.
- arnarbi 8y agoFor phones that have a dedicated hardware module, such as the Pixel 3, yes the key material is generated and stored there. Using it requires a physical action that is hardwired to the hardware module. We think the most pressing need right now is to protect users against phishing, which is a much larger threat than malware. Thus we think there's a lot of value in enabling this for all phone models where it's possible to run the protocols. (I'm the TL for this at Google)
- rheerani 8y agoSo, can the button used be changed or does it have to be standardized across devices and which is why it's the volume down button? Because the squeeze function on Pixels or assistant buttons on other devices could be used instead, though that's just me wondering out loud for an alternative user-facing implementation because the use of volume button seems strange to me.
- arnarbi 8y agoOn Pixel 3, no, it cannot be changed. Only the volume down button is wired to the Titan-M. Why that button rather than others, I don't know.
- ksec 8y agoOff topic: This is the state of web we are in, and this is coming from Google. [1] I have literally 20% of the screen displaying useful information. The others are all useless navigation or related crap. Just seeing it nearly got me to puke. It is one those problem in general where the web page is responsive and mobile first. [1] https://ibb.co/fCfmW6h https://ibb.co/fCfmW6h
- NikolaNovak 8y agoI fully 101% agree with you in principle, but in this particular case my experience is wildly different. As soon as I scrolled, the navigation got out of the way, and all I have is text - with author's decision to keep large wide white margins. (Vanilla Chrome on Windows - no extensions/plugins/blockers, no reader mode, etc) https://imgur.com/5DOqvj1 https://imgur.com/5DOqvj1
- ksec 8y agoWell in my case. Hide Related Article at the bottom wont go unless I actually click it. The gigantic three layer navigation bar appears when I scroll up just a little. On Safari 12.1 macOS
- phyzome 8y agoWhat happens when you scroll up a tiny amount? Do the floating dickbars come back? In my case, I didn't opt in to running the site's javascript... so there were no floating bars. :-)
- modwilliam 8y agoLooks like you're zoomed in or have a larger default font size, so it's not fair to say this is the state of the web
- theDoug 8y agoBut looking at a web page nearly made his body vomit!
- 8y ago
- oneplane 8y ago> Your Android Phone Is a Security Key no it's not. it's pretending to be, but without vendors actually maintaining and investing in their forks and the hardware having a known good security enclave, you might as well post your credentials on twitter.
- penagwin 8y agoYeah I don't see how this is any different from the standard Google Authenticator style affair. Without a security enclave (which devices are starting to include) I don't see how this is an improvement.
- oneplane 8y agoI think that using a soft token or push notifications are better than nothing, but a company putting a (often known vulnerable) phone at the same level as a security key seems like setting a bad precedent. Then again, at least it's not SMS-verification. Perhaps in future leaks and scrapes of end-user deviced we don't just get data dumps and passwords, but also internal key seeds and tokens... It's the secure enclave and the purpose-built firmware that makes a security key a security key. I'm sure some specific Android devices have a safe implementation, and I'm sure that some SIM cards and perhaps the recent iPhone Secure Elements have properties that allow them to be safely used as a security key, but putting it forward that phones can be seen and used that way in general lacks that important distinction.
- verdverm 8y agoConnects via Bluetooth to the device you wish to sign into.
- lern_too_spel 8y agoAndroid 7 added support for key attestation, making it possible to verify that a key came from a secure enclave. That's presumably why the blog post says Android 7 and above. https://source.android.com/security/keystore https://source.android.com/security/keystore
- christiaanbrand 8y ago
- foobiekr 8y agoMost security keys don’t have app stores full of malware.
- jayd16 8y agoNow they do.
- markstos 8y agoLooks like Google has used the open Web Bluetooth specification (that only Chrome currently supports) along with the open FIDO Bluetooth spec ( https://fidoalliance.org/specs/fido-u2f-v1.2-ps-20170411/fido-u2f-bt-protocol-v1.2-ps-20170411.html https://fidoalliance.org/specs/fido-u2f-v1.2-ps-20170411/fid... ). A read-only, non-wireless security key like Yubikey would be even more secure, but this is an improvement over TOTP codes, which can be phished. This is also better than SMS 2FA, which is prone to phone-number theft. It's also better than Push notifications for 2FA, which relay on third-party servers. This solution uses Bluetooth between your phone and the Chrome browser, offering a good balance of security and convenience.
- scarejunba 8y agoYou can already use a Yubikey with Google. I have mine set up.
- BillinghamJ 8y agoI don't believe Web Bluetooth should be used with security keys (in fact, I believe communication with those is specifically blocked as a part of Web Bluetooth). This is because the browser needs to pass the origin to the device and ensure the webpage can't impersonate another origin.
- Rafert 8y agoFWIW that is a really old spec. The FIDO 2.0 Bluetooth transport is described at: https://fidoalliance.org/specs/fido-v2.0-rd-20180702/fido-client-to-authenticator-protocol-v2.0-rd-20180702.html#ble https://fidoalliance.org/specs/fido-v2.0-rd-20180702/fido-cl... But an article from VentureBeat[0] mentioned it's a new transport called 'cloud assisted Bluetooth Low Energy' or caBLE, which they've submitted to FIDO for standardization. [0]: https://venturebeat.com/2019/04/10/you-can-now-use-your-android-phone-as-a-2fa-security-key-for-google-accounts/ https://venturebeat.com/2019/04/10/you-can-now-use-your-andr...
- arnarbi 8y agoThis does not use Web Bluetooth, but rather an implementation directly in the browser through WebAuthn. A critical part of the phishing resistance of WebAuthn is that websites do not get to talk directly to the authenticator. To make this work, we made an extension to WebAuthn+FIDO for pairing-free BLE as Rafert points out. We're already in the process of making that open together with these standards bodies, stay tuned!
- drexlspivey 8y agoOr you can just use https://krypt.co/ https://krypt.co/ which uses the same FIDO standard, is open source, works on both android and iOS (where it actually uses the secure enclave) and both in Chrome and Firefox
- amanzi 8y agoI've been using this for the last month or so and have no complaints. Works well.
- trulyrandom 8y agoAn important caveat with Krypton is that while it is open source, the published source is essentially useless because it is not licensed under a free license.
- int_19h 8y agoThat should be sufficient to audit the code, and verify that the binaries distributed via app stores are actually compiled from it, no? For a security app, it's pretty useful.
- r3bl 8y agoYou can see the code, but can't do anything with it? That'd be source-available, not open source. Having a source publicly available is one of the prerequisites for something to be considered open source, but it's far from being the only prerequisite.
- deleted 8y ago[deleted]
- wavefunction 8y agoThis is great other than the fact Google is involved. Now I will admit it's unlikely (effectively impossible) that this would come to Android without Google being involved but I am not interested in adding Google to more of my life. I'm looking to cut them out more and more wherever I can.
- tjbiddle 8y agoMy Pixel 2 already does this. When I sign into Google I get a notification that asks if I'm signing in, I click yes, done-zo. Is the only thing new here the UI + that it's open for all Android 7.0 phones now?
- gretch 8y agodisclosure: I work at google The thing you have now communicates that yes click over the internet. This new thing communicates through a local channel (bluetooth). Communicating over a local channel prevents phishing. Consider this attack: Attacker hosts googlee.com and you get tricked into going there. The login site looks exactly like the google site. You type in username/password just like normal. In that moment they take your phished credentials and pass it to the actual google server, like a man in the middle. Now you receive a prompt on your phone asking Yes/No. You click yes, okaying the attacker's login. Now that same attack with the local channel communication - they can't take your signal and pass it on through to google
- plttn 8y agoAs there's very little documentation on this right now: couple of related questions (feel free to ignore them I don't want to guilt you into it) 1. It doesn't seem to be using the Titan M flow on my Pixel 3 currently 2. After reinstalling GMS on my phone to try and get the Titan M working, it stayed registered as a key, but the prompt never shows up on my device. I guess this is more of a "flag for internal review" vs a "please provide me with answers".
- scottlocklin 8y agoYour yubikey isn't owned by an evil megacorp. Use a damn yubikey; they're practically free and don't monetize their users.
- acct1771 8y agoAs someone who can't currently afford the two Yubikeys needed to finish securing their internal startup services...please think for just a second before you say things.
- scottlocklin 8y agoI'd have sent you one if you weren't such a dick. Even though your statement is not remotely believable.
- acct1771 8y agoI was slightly a dick because I didn't want anyone to offer - believe all of these statements or don't.
- scottlocklin 8y agoIf you can't afford $20 for a yubikey, but have time to post snarky self-defeating comments on HN, you might consider why you don't have the $20.
- kd5bjo 8y agoHere in Iceland, there's a security key embedded in your SIM card that everybody uses as their 2FA solution. It's triggered via a GSM message to your phone, identifies what the authorization is for, and lets you enter the key's PIN code to accept. The whole thing (except the UI) is isolated from the phone's OS so that even if your phone gets lost or compromised nobody else can auth as you.
- acct1771 8y agoThis is why that's not great: https://www.schneier.com/blog/archives/2015/02/nsagchq_hacks_s.html https://www.schneier.com/blog/archives/2015/02/nsagchq_hacks...