4 ms·

The problem isn't even Google, it's just lack of actual support for services that need it. You have to have the right client, the right device, and every websit

The problem isn't even Google, it's just lack of actual support for services that need it. You have to have the right client, the right device, and every website has to implement it. Government websites won't support it, nor most financial services, your gym, school, job, etc. Sensitive records like your SSN will be kept in walled gardens accessible by a simple user and password, and maybe a security question. Most people will still be at significant risk of exposure because the real targets of information theft aren't logged into by end-users. But your Gmail account will be locked down.

icebraining 8y ago
Well, that depends where you live. Google is available for everyone, not just technologically-backward places. Here millions are currently checking their pre-filled tax returns, which they have accessed using smartcard authentication, so Gmail ain't that far ahead.
Bluestrike2 8y ago
Admittedly, that's not a minor benefit. If someone has access to your Gmail account, there's all sorts of information there they can use to engineer access to other services. The naive optimist in me wants to think that making security keys accessible to more users, and getting them used to them, will lead to pressure for other services to follow suit. But then I think about how long people have been criticizing banks for ridiculous password policies that are seemingly universal in the industry, and I know better. Or bad security practices at organizations in general. I'd very much like to be proven wrong.
- godelski 8y ago
  I mean the problems I have with banks are 1) you type your username and password on different pages 2) password limits of like 20 chars. We're in a day and age where people should be using password managers (even my tech illiterate parents use them). So why are character limits set so low? I want my bank password locked down. And we're in an day and age where (1) shouldn't even be an issue. I'm not sure what other issues people face, but I've seen these patterns with multiple banks. I think banks get lip more because they are a clear case where security should be VERY high. Just like you should protect your email strongly (note google does (1)[0]). [0] https://screenshots.firefox.com/v9AjmrW7jtr1aGg3/accounts.google.com https://screenshots.firefox.com/v9AjmrW7jtr1aGg3/accounts.go... [0'] If someone is an actual security expert, I'd like to know why (1) is an acceptable practice. (My bank does it, but they pass you to the password page no matter what you type in, which seems safer than what google is doing)
  - indecisive_user 8y ago
    >If someone is an actual security expert, I'd like to know why (1) is an acceptable practice. So your issue here is that Google tells you whether it's a valid email address before you enter in a password? You could validate email addresses yourself by sending out a ton of emails to different permutations of *@gmail.com and seeing which ones come back as undeliverable. An email address on its own isn't inherently private so this doesn't seem to be a security risk to me unless I'm missing something.
    - deathanatos 8y ago
      I interpreted the parent's complaint in (1) as the login form having the username/password entries split across two screens, not as a complaint that it tells you the account doesn't exist. AIUI, splitting the entry across two screens like that breaks a lot of password managers, as they can't handle it. This hampers the adoption of password managers, which would largely help the average Joe's security. Google supports external auth in some cases¹, and to know whether they need to redirect to that auth, they first need your username / email. Then, you're either redirected or you're shown the password entry prompt. I don't know of any banks that do this, so this might not be applicable to them. (Theirs might just be bad design.) ¹GSuite, not consumer GMail, but I assume the flows are the same
      - godelski 8y ago
        You both addressed different parts to my complaint, so thank you both. I'm definitely dumb enough to not realize that email login might be a special case because you can check username validity another way (sending emails). And I didn't know that GSuite had external auth. These split pages don't actually break lastpass, at least for me. One field is still called username and another is called password, so they fill properly.
Rafert 8y ago
Browser support is pretty good: https://caniuse.com/#feat=webauthn https://caniuse.com/#feat=webauthn - and Google submitted the caBLE transport to the WebAuthn working group. Give it some time. And don't count out governments just yet, U2F got some love: https://www.yubico.com/why-yubico/for-business/authentication-solutions/gov-uk-verify-digidentity/ https://www.yubico.com/why-yubico/for-business/authenticatio...
creato 8y ago
I'm not sure this is the right perspective. Is it really such a big deal if SSNs get leaked? On the other hand, insecure e-mail has been at the center of massive political upheavals. I think securing e-mail is way more important than even banking information.
- rincebrain 8y ago
  For a random subset of people, not necessarily. For anyone who has or will have people interested in their particular accounts, not just bulk breakin of simple passwords that should be forbidden in most sites, it becomes a much worse risk profile, as you often can't turn off places letting you use that data point as one part of verification.

icebraining 8y ago

Well, that depends where you live. Google is available for everyone, not just technologically-backward places. Here millions are currently checking their pre-filled tax returns, which they have accessed using smartcard authentication, so Gmail ain't that far ahead.

Bluestrike2 8y ago

Admittedly, that's not a minor benefit. If someone has access to your Gmail account, there's all sorts of information there they can use to engineer access to other services. The naive optimist in me wants to think that making security keys accessible to more users, and getting them used to them, will lead to pressure for other services to follow suit. But then I think about how long people have been criticizing banks for ridiculous password policies that are seemingly universal in the industry, and I know better. Or bad security practices at organizations in general. I'd very much like to be proven wrong.

godelski 8y ago
I mean the problems I have with banks are 1) you type your username and password on different pages 2) password limits of like 20 chars. We're in a day and age where people should be using password managers (even my tech illiterate parents use them). So why are character limits set so low? I want my bank password locked down. And we're in an day and age where (1) shouldn't even be an issue. I'm not sure what other issues people face, but I've seen these patterns with multiple banks. I think banks get lip more because they are a clear case where security should be VERY high. Just like you should protect your email strongly (note google does (1)[0]). [0] https://screenshots.firefox.com/v9AjmrW7jtr1aGg3/accounts.google.com https://screenshots.firefox.com/v9AjmrW7jtr1aGg3/accounts.go... [0'] If someone is an actual security expert, I'd like to know why (1) is an acceptable practice. (My bank does it, but they pass you to the password page no matter what you type in, which seems safer than what google is doing)
- indecisive_user 8y ago
  >If someone is an actual security expert, I'd like to know why (1) is an acceptable practice. So your issue here is that Google tells you whether it's a valid email address before you enter in a password? You could validate email addresses yourself by sending out a ton of emails to different permutations of *@gmail.com and seeing which ones come back as undeliverable. An email address on its own isn't inherently private so this doesn't seem to be a security risk to me unless I'm missing something.
  - deathanatos 8y ago
    I interpreted the parent's complaint in (1) as the login form having the username/password entries split across two screens, not as a complaint that it tells you the account doesn't exist. AIUI, splitting the entry across two screens like that breaks a lot of password managers, as they can't handle it. This hampers the adoption of password managers, which would largely help the average Joe's security. Google supports external auth in some cases¹, and to know whether they need to redirect to that auth, they first need your username / email. Then, you're either redirected or you're shown the password entry prompt. I don't know of any banks that do this, so this might not be applicable to them. (Theirs might just be bad design.) ¹GSuite, not consumer GMail, but I assume the flows are the same
    - godelski 8y ago
      You both addressed different parts to my complaint, so thank you both. I'm definitely dumb enough to not realize that email login might be a special case because you can check username validity another way (sending emails). And I didn't know that GSuite had external auth. These split pages don't actually break lastpass, at least for me. One field is still called username and another is called password, so they fill properly.

Rafert 8y ago

Browser support is pretty good: https://caniuse.com/#feat=webauthn https://caniuse.com/#feat=webauthn - and Google submitted the caBLE transport to the WebAuthn working group. Give it some time. And don't count out governments just yet, U2F got some love: https://www.yubico.com/why-yubico/for-business/authentication-solutions/gov-uk-verify-digidentity/ https://www.yubico.com/why-yubico/for-business/authenticatio...

creato 8y ago

I'm not sure this is the right perspective. Is it really such a big deal if SSNs get leaked? On the other hand, insecure e-mail has been at the center of massive political upheavals. I think securing e-mail is way more important than even banking information.

rincebrain 8y ago
For a random subset of people, not necessarily. For anyone who has or will have people interested in their particular accounts, not just bulk breakin of simple passwords that should be forbidden in most sites, it becomes a much worse risk profile, as you often can't turn off places letting you use that data point as one part of verification.