5 ms·

I like the idea behind it in principle, since it will simplify 2FA for the masses and may lead more people to adopt it. But, apart from that: 1. It's only on C

by sakisv 8y ago

I like the idea behind it in principle, since it will simplify 2FA for the masses and may lead more people to adopt it. But, apart from that: 1. It's only on Chrome (for now(?)) 2. It's only for Google products (for now (?)) 3. It's only on Android that Google fully controls remotely (and probably it will stay there). All these give even more power to Google at the expense of convenience and allows a single company to define "how things should be done". And I should clarify that I am not against this tech specifically. If anything, I think Google has some of the brightest minds, so technically I'm sure that the product will be great. The problem is that with great power comes something that Google (as a company) seems to be lacking lately.

peterwwillis 8y ago
The problem isn't even Google, it's just lack of actual support for services that need it. You have to have the right client, the right device, and every website has to implement it. Government websites won't support it, nor most financial services, your gym, school, job, etc. Sensitive records like your SSN will be kept in walled gardens accessible by a simple user and password, and maybe a security question. Most people will still be at significant risk of exposure because the real targets of information theft aren't logged into by end-users. But your Gmail account will be locked down.
- icebraining 8y ago
  Well, that depends where you live. Google is available for everyone, not just technologically-backward places. Here millions are currently checking their pre-filled tax returns, which they have accessed using smartcard authentication, so Gmail ain't that far ahead.
- Bluestrike2 8y ago
  Admittedly, that's not a minor benefit. If someone has access to your Gmail account, there's all sorts of information there they can use to engineer access to other services. The naive optimist in me wants to think that making security keys accessible to more users, and getting them used to them, will lead to pressure for other services to follow suit. But then I think about how long people have been criticizing banks for ridiculous password policies that are seemingly universal in the industry, and I know better. Or bad security practices at organizations in general. I'd very much like to be proven wrong.
  - godelski 8y ago
    I mean the problems I have with banks are 1) you type your username and password on different pages 2) password limits of like 20 chars. We're in a day and age where people should be using password managers (even my tech illiterate parents use them). So why are character limits set so low? I want my bank password locked down. And we're in an day and age where (1) shouldn't even be an issue. I'm not sure what other issues people face, but I've seen these patterns with multiple banks. I think banks get lip more because they are a clear case where security should be VERY high. Just like you should protect your email strongly (note google does (1)[0]). [0] https://screenshots.firefox.com/v9AjmrW7jtr1aGg3/accounts.google.com https://screenshots.firefox.com/v9AjmrW7jtr1aGg3/accounts.go... [0'] If someone is an actual security expert, I'd like to know why (1) is an acceptable practice. (My bank does it, but they pass you to the password page no matter what you type in, which seems safer than what google is doing)
    - indecisive_user 8y ago
      >If someone is an actual security expert, I'd like to know why (1) is an acceptable practice. So your issue here is that Google tells you whether it's a valid email address before you enter in a password? You could validate email addresses yourself by sending out a ton of emails to different permutations of *@gmail.com and seeing which ones come back as undeliverable. An email address on its own isn't inherently private so this doesn't seem to be a security risk to me unless I'm missing something.
      - deathanatos 8y ago
        I interpreted the parent's complaint in (1) as the login form having the username/password entries split across two screens, not as a complaint that it tells you the account doesn't exist. AIUI, splitting the entry across two screens like that breaks a lot of password managers, as they can't handle it. This hampers the adoption of password managers, which would largely help the average Joe's security. Google supports external auth in some cases¹, and to know whether they need to redirect to that auth, they first need your username / email. Then, you're either redirected or you're shown the password entry prompt. I don't know of any banks that do this, so this might not be applicable to them. (Theirs might just be bad design.) ¹GSuite, not consumer GMail, but I assume the flows are the same
- Rafert 8y ago
  Browser support is pretty good: https://caniuse.com/#feat=webauthn https://caniuse.com/#feat=webauthn - and Google submitted the caBLE transport to the WebAuthn working group. Give it some time. And don't count out governments just yet, U2F got some love: https://www.yubico.com/why-yubico/for-business/authentication-solutions/gov-uk-verify-digidentity/ https://www.yubico.com/why-yubico/for-business/authenticatio...
- creato 8y ago
  I'm not sure this is the right perspective. Is it really such a big deal if SSNs get leaked? On the other hand, insecure e-mail has been at the center of massive political upheavals. I think securing e-mail is way more important than even banking information.
  - rincebrain 8y ago
    For a random subset of people, not necessarily. For anyone who has or will have people interested in their particular accounts, not just bulk breakin of simple passwords that should be forbidden in most sites, it becomes a much worse risk profile, as you often can't turn off places letting you use that data point as one part of verification.
zavi 8y ago
This is 2FA for Google accounts so of course it's on Google products?
- jdietrich 8y ago
  Google Authenticator works with any service that uses the TOTP or HOTP standards. https://en.wikipedia.org/wiki/Google_Authenticator https://en.wikipedia.org/wiki/Google_Authenticator
  - zavi 8y ago
    This post is not about Google authenticator. It's about making a different 2FA solution for their accounts in particular.
Rafert 8y ago
Before the announcement I've seen references to a 'caBLE'/ 'cloud assisted Bluetooth Low Energy' transport on the Web Authentication mailing list and W3C spec GitHub issues, this is exactly that. The VentureBeat article[0] confirms: > “Under the covers, however, the phone and computer are communicating with the FIDO CTAP protocol over Bluetooth and the website and computer are communicating with the WebAuthn protocol and this adds the phishing-resistance. [...] But for now at least, the feature can only be used for 2FA on Google accounts. Google has submitted caBLE to FIDO and it’s under review by the working group. [0]: https://venturebeat.com/2019/04/10/you-can-now-use-your-android-phone-as-a-2fa-security-key-for-google-accounts/ https://venturebeat.com/2019/04/10/you-can-now-use-your-andr...
Ajedi32 8y ago
In principle I don't see any reason why this couldn't be made to work with any browser/site through the WebAuthn standard. In fact, it wouldn't surprise me if that's exactly what Google's doing under the hood.

by sakisv 8y ago

peterwwillis 8y ago

The problem isn't even Google, it's just lack of actual support for services that need it. You have to have the right client, the right device, and every website has to implement it. Government websites won't support it, nor most financial services, your gym, school, job, etc. Sensitive records like your SSN will be kept in walled gardens accessible by a simple user and password, and maybe a security question. Most people will still be at significant risk of exposure because the real targets of information theft aren't logged into by end-users. But your Gmail account will be locked down.

icebraining 8y ago
Well, that depends where you live. Google is available for everyone, not just technologically-backward places. Here millions are currently checking their pre-filled tax returns, which they have accessed using smartcard authentication, so Gmail ain't that far ahead.
Bluestrike2 8y ago
Admittedly, that's not a minor benefit. If someone has access to your Gmail account, there's all sorts of information there they can use to engineer access to other services. The naive optimist in me wants to think that making security keys accessible to more users, and getting them used to them, will lead to pressure for other services to follow suit. But then I think about how long people have been criticizing banks for ridiculous password policies that are seemingly universal in the industry, and I know better. Or bad security practices at organizations in general. I'd very much like to be proven wrong.
- godelski 8y ago
  I mean the problems I have with banks are 1) you type your username and password on different pages 2) password limits of like 20 chars. We're in a day and age where people should be using password managers (even my tech illiterate parents use them). So why are character limits set so low? I want my bank password locked down. And we're in an day and age where (1) shouldn't even be an issue. I'm not sure what other issues people face, but I've seen these patterns with multiple banks. I think banks get lip more because they are a clear case where security should be VERY high. Just like you should protect your email strongly (note google does (1)[0]). [0] https://screenshots.firefox.com/v9AjmrW7jtr1aGg3/accounts.google.com https://screenshots.firefox.com/v9AjmrW7jtr1aGg3/accounts.go... [0'] If someone is an actual security expert, I'd like to know why (1) is an acceptable practice. (My bank does it, but they pass you to the password page no matter what you type in, which seems safer than what google is doing)
  - indecisive_user 8y ago
    >If someone is an actual security expert, I'd like to know why (1) is an acceptable practice. So your issue here is that Google tells you whether it's a valid email address before you enter in a password? You could validate email addresses yourself by sending out a ton of emails to different permutations of *@gmail.com and seeing which ones come back as undeliverable. An email address on its own isn't inherently private so this doesn't seem to be a security risk to me unless I'm missing something.
    - deathanatos 8y ago
      I interpreted the parent's complaint in (1) as the login form having the username/password entries split across two screens, not as a complaint that it tells you the account doesn't exist. AIUI, splitting the entry across two screens like that breaks a lot of password managers, as they can't handle it. This hampers the adoption of password managers, which would largely help the average Joe's security. Google supports external auth in some cases¹, and to know whether they need to redirect to that auth, they first need your username / email. Then, you're either redirected or you're shown the password entry prompt. I don't know of any banks that do this, so this might not be applicable to them. (Theirs might just be bad design.) ¹GSuite, not consumer GMail, but I assume the flows are the same
Rafert 8y ago
Browser support is pretty good: https://caniuse.com/#feat=webauthn https://caniuse.com/#feat=webauthn - and Google submitted the caBLE transport to the WebAuthn working group. Give it some time. And don't count out governments just yet, U2F got some love: https://www.yubico.com/why-yubico/for-business/authentication-solutions/gov-uk-verify-digidentity/ https://www.yubico.com/why-yubico/for-business/authenticatio...
creato 8y ago
I'm not sure this is the right perspective. Is it really such a big deal if SSNs get leaked? On the other hand, insecure e-mail has been at the center of massive political upheavals. I think securing e-mail is way more important than even banking information.
- rincebrain 8y ago
  For a random subset of people, not necessarily. For anyone who has or will have people interested in their particular accounts, not just bulk breakin of simple passwords that should be forbidden in most sites, it becomes a much worse risk profile, as you often can't turn off places letting you use that data point as one part of verification.

zavi 8y ago

This is 2FA for Google accounts so of course it's on Google products?

jdietrich 8y ago
Google Authenticator works with any service that uses the TOTP or HOTP standards. https://en.wikipedia.org/wiki/Google_Authenticator https://en.wikipedia.org/wiki/Google_Authenticator
- zavi 8y ago
  This post is not about Google authenticator. It's about making a different 2FA solution for their accounts in particular.

Rafert 8y ago

Before the announcement I've seen references to a 'caBLE'/ 'cloud assisted Bluetooth Low Energy' transport on the Web Authentication mailing list and W3C spec GitHub issues, this is exactly that. The VentureBeat article[0] confirms: > “Under the covers, however, the phone and computer are communicating with the FIDO CTAP protocol over Bluetooth and the website and computer are communicating with the WebAuthn protocol and this adds the phishing-resistance. [...] But for now at least, the feature can only be used for 2FA on Google accounts. Google has submitted caBLE to FIDO and it’s under review by the working group. [0]: https://venturebeat.com/2019/04/10/you-can-now-use-your-android-phone-as-a-2fa-security-key-for-google-accounts/ https://venturebeat.com/2019/04/10/you-can-now-use-your-andr...

Ajedi32 8y ago

In principle I don't see any reason why this couldn't be made to work with any browser/site through the WebAuthn standard. In fact, it wouldn't surprise me if that's exactly what Google's doing under the hood.