12 ms·

Downsides of Google Authenticator

188 points by LinuxBender 7y ago

ocdtrekkie 7y ago
> Is it risky "centralizing" this data? Sure, but I don't see it any more risky as using a cloud-based password manager. Using a cloud-based password manager is a huge risk though. And if you've put both your passwords and your 2FA generators in the cloud, you now have single-factor authentication.
- TallGuyShort 7y ago
  >> you now have single-factor authentication In many cases that factor is now Google's security vs. the same reused password that is your hobby + the year you graduated high school. It this is what makes it convenient enough to always use, it's probably still a step up. It's at least a better, slightly more distributed factor. And even then they're distinct systems, possibly not even within the same cloud.
- Quai 7y ago
  This. It is a real problem that a lot of people fail to understand why this is an issue.
- iudqnolq 7y ago
  It's less secure, but the single factor is a stronger single factor than a password because it can't be reused. If someone mitms my login they get my password and otp code, which they ideally can't turn into something reusable (if the website requires 2FA to change security settings) and definitely can't use if they have a lag between collection and exploitation (like a keylogger that phones home every so often). This is acceptable to me, but I would prefer websites let me use a one time code as a single factor of authentication.
Spivak 7y ago
Bitwarden is a pretty good solution for this! It's not the smoothest since the browser extensions don't know how to fill in your codes like they do your password but it's leaps and bounds above the UX for Google Authenticator. Being able to access my codes from any device with a web browser is very nice. INB4: "But this reduces your security." * Yes, but I'm already using a password manager with 64 char generated passwords on every site. * If you're able to compromise my Bitwarden password you likely have enough to remove the 2FA on all of my accounts anyway. "Why even have 2FA at that point then?" * Because some things in my life require it.
- hmhrex 7y ago
  I just paid for my second year of Bitwarden. I love it.
- specialp 7y ago
  Also if your local machine is compromised, which is much more common than people brute-forcing passwords, somebody can get your password and a 2FA code and access any account.
- Royalaid 7y ago
  Thanks for posting this. The threat modeling in this thread feels very much out of wack with my personal experience. The thing that has lead to the most compromised accounts for myself is old, short, unchanged passwords on accounts I had forgotten that probably have been leaked.
- lain 7y ago
  I've found the Bitwarden browser extension has an option to automatically copy the 6 digit code after the username+password autofill. Can't remember if it does it by default though. See: Settings / Options / Disable Automatic TOTP Copy
- e12e 7y ago
  Another shout out for bitwarden. Being open source, you can self host, and it has become a semi-standard of sorts, with alternative implementations. As a sibling mentions, when you fill inn the user/pw of an account with 2fa enabled, the 2fa pin should be copied into the clipboard by default. (so the flow is: autofill username/password; submit, paste pin;submit). Still think it's silly there's no simple way to get an encrypted backup of the 2fa-secrets from Google authenticator - it leaves the user and an attacker (with effective root on the phone) on uneven ground. For the user the app pretends that there is no shared secret with the server that could be compromised - the attacker simply access the sqlite db.
lima 7y ago
Strongly disagree with the premise of this article: - Passcode or biometric locks on an app are a gimmick and offer negligible value. - The keys not being backed up or or synchronised across devices is not a bug, but a feature. You're supposed to keep offline backup keys. Any sort of synchronization feature adds a ton of attack surface. - In particular, Authy, LastPass and 1password have a giant attack surface compared to a simple app like Google Authenticator. They also rely on centralized services and if you also keep your passwords in there, you eliminate the whole point of two factor authentication. - One important risk with authentication apps is compromised updates, and Google Authenticator has a very low risk of this since it's backed by Google's strict security processes. What you should actually do is to move to U2F/WebAuthn and pester any of your service providers that do not offer it. Yes, if you need to replace a token, you'll have to go through all accounts and change it. There's is absolutely no way to prevent this without compromising on security.
- ls612 7y ago
  Here’s the thing. I consider myself fairly responsible but I’ll bet I’m far more likely to lose my phone than it is that my Authy and Dashlane credentials are both compromised, which are my pw manager and Authenticator app. You have to choose your risks and for a lot of people an authy like feature is much safer overall than GA.
  - ocdtrekkie 7y ago
    All my 2FA codes are backed up. On paper. I have a physically-secured cache of the QR codes which can be pretty quickly imported into a new app.
    - tlb 7y ago
      Do you trust the security of your printer when you print codes? They are historically one of the biggest attack surfaces.
      - julianlam 7y ago
burnte 7y ago
Authy. Fantastic replacement app. makes backing everything up a snap. I can log into Authy on one device by allowing on another, etc.
netsharc 7y ago
My Google Authenticator data survived me migrating to a different phone because my flow is: 1. Backup old phone using Titanium Backup. 2. Get new Android phone. 3. Root it. 4. Copy TB backup files from old phone to new. 5. Restore apps and data on new phone using Titanium Backup. Obviously it's not a procedure a normal user is expected to do...
- cryptozeus 7y ago
  In Iphone I just do backup and restore in itunes. Everything is migrated. I dont see why you need to do all these.
  - tinus_hn 7y ago
    Keys that specify they can’t be backed up are not migrated, they are not included in the backup.
spyridonas 7y ago
I use Microsoft Authenticator and it has cloud backups. Maybe it's unsafe, they promise it's super safe. https://docs.microsoft.com/el-gr/azure/active-directory/user-help/user-help-auth-app-backup-recovery https://docs.microsoft.com/el-gr/azure/active-directory/user...
- partiallypro 7y ago
  I think you can turn off cloud back-ups if you want. That's what I use as well. Also -some- cloud backups don't work on it, if the tenant doesn't allow it. My Azure tenant does not, so you have to reset everything up if you get a new phone. It was a painful experience, since me and the main tenant holder both got new phones at the same time. Had to contact Microsoft directly.
ValentineC 7y ago
I stopped using Google Authenticator in 2013 when my tokens disappeared after a software update [1]. They were restored in the next update, but I didn't like not having access to the raw TOTP data. I switched to Authy after the incident, and now use 1Password after I discovered their TOTP feature. [1] https://news.ycombinator.com/item?id=6325760 https://news.ycombinator.com/item?id=6325760
- the_svd_doctor 7y ago
  Isn’t that putting all eggs in the same basket?
  - plttn 7y ago
    Yes and no. Yes, it puts 1Password as the only point of failure iff 1Password security is compromised. This would require knowing my Master Password, my Secret Key, and 2FA with either my OTP from Google Authenticator or a Yubikey to open the vault on a new device, or knowing my master password on a device that I already have 1Password set up on. On the flip side however, for anyone who _doesn't_ know I use 1Password (oops), any credential stuffing attack or password leak is not likely to get anywhere, as they're not going to be attacking my 1Password vault.
  - ValentineC 7y ago
    It's a compromise for me: the killer feature is not having to depend on my phone to log into websites. I suppose it might be even more secure if I kept tokens in a separate vault.
- notlukesky 7y ago
  You might be interested then in the autofilling options of SAASPASS Authenticator and Password Manager (with browser extension and iOS 12 autofill turned on).
sschueller 7y ago
Use an alternative like andOTP or Authenticator Plus which allow you to backup your keys.
- prophesi 7y ago
  +1 to andOTP. It's on F-Droid and still gets semi-regular updates. It's a bit obnoxious that it requires a password, but that just means an autofill from my password manager for free at-rest encrypted storage.
  - pyt 7y ago
    I believe if you use the Android Keystore, you can use it without a password and just authenticate with a fingerprint when it starts up.
  - txcwpalpha 7y ago
    Are you not using 2FA for your password manager?
terlisimo 7y ago
I've settled on Aegis. It is open source and allows you to export secrets to an encrypted file which you can copy around. A bit more tedious than Authy and similar cloud sync solutions but lower attack surface and less tedious to back up than Google Authenticator. Available on F-droid. Beware of Aegis knock-offs on Google Play Store that use similar name.
gravitas 7y ago
For those who have not seen the previous HN threads this past year on 2FA, Aegis has emerged on Android which a number of folks (myself included) have migrated to using: https://github.com/beemdevelopment/Aegis https://github.com/beemdevelopment/Aegis (links to G-Play/F-Droid in readme) A backup (encrypted or plain) of your seeds can be exported/imported.
- xtracto 7y ago
  This is amazing! Thank you very much, I will set it up along Google Auth in my phone and add it to my home "backup phone". One thing that had bothered of Google Auth for a long time is the fear of losing my phone and having to go hunting down all the authentication information. And never considered Authy because using an "online service" for these kind of things just seems wrong to me.
jabroni_salad 7y ago
Since we're apparently all sharing our 2fa methods I've really been liking the yubico authenticator. All the secrets are on the yubikey itself so if something dumb happens to my phone or computer I don't have to worry about them. Plus, the same device does my FIDO2 / u2f / whatever it is this month for the services that support it.
- edm0nd 7y ago
  U2F + Googles Advanced Protection Program = secure AF https://landing.google.com/advancedprotection/ https://landing.google.com/advancedprotection/
- johnisgood 7y ago
  Yes, and OpenSSH just added FIDO/U2F support! https://www.openssh.com/txt/release-8.2 https://www.openssh.com/txt/release-8.2 https://www.phoronix.com/scan.php?page=news_item&px=OpenSSH-8.2-Released https://www.phoronix.com/scan.php?page=news_item&px=OpenSSH-...
danShumway 7y ago
Last time I checked, by default, Authy codes were susceptible to SIM-swap attacks.[0] This is a bad article. You should perhaps consider switching off of Authenticator to an Open Source manager like AndOTP; I think that's something reasonable to propose. But I don't understand the argument that I should be very concerned a lack of biometric locks, but not concerned about invalidating the "something you have" part of 2FA. I don't think it's horrible if someone uses an app like Authy. It's better than nothing. But this article didn't need to exist -- if you use Authenticator, just keep using it, it's fine. [0]: https://nitter.42l.fr/DanielShumway/status/1092081967007498242#m https://nitter.42l.fr/DanielShumway/status/10920819670074982...
- latchkey 7y ago
  Authy only has SIM issues if you give it your phone number. Don't do that.
  - danShumway 7y ago
    The linked article is recommending Authy over Authenticator because backing up codes on multiple devices is too hard. If you're going to disable remote backup on Authy, then there's almost no advantage to switching away from Authenticator in the first place. Authy also doesn't allow local export of tokens, so there's no advantage there. I guess with Authenticator you lose the ability to lock your local tokens with a 4-digit pin, but who cares? 4-digit pins are not secure. I just checked on an old installation of Authy, and as far as I can tell there is no way to remove a phone number from the app itself, only change it. Maybe when you're installing you can skip that step. You can turn off remote backup entirely, but see above. If you use Authy, fine. It's still better than nothing. Really, getting people to use 2FA at all is the important battle, and the fight over which 2FA app is best is probably a waste of time. But Zdnet should not have written an article recommending people switch away from Authenticator to Authy when Authy's primary selling point is actually an attack vector that its own support website recommends disabling[0]. More to the point, the setting makes me trust Authy less in other security areas, because it's an attack vector that they easily could have plugged years ago -- and it makes me think they haven't actually thought that much about security. It's just bad UX to ask users for an encryption password when a single setting will non-transparently bypass that password requirement for some tokens. [0]: https://support.authy.com/hc/en-us/articles/360012427914-Is-the-Authy-App-Susceptible-to-a-SIM-Swap- https://support.authy.com/hc/en-us/articles/360012427914-Is-...
RileyJames 7y ago
Just last night I was setting up “2FA” for my girls gmail account. It has so clearly become surveillance it’s disgusting. The only options are google consumer apps (or the physical key). The opportunity to link a mobile device to a desktop for advertising purposes was too great. I have little trust that google authenticator app is any different. But as far I can see you can’t use any of these alternatives from the article.
lisper 7y ago
I stopped using Authy because it has auto-update that you cannot disable. One day it auto-updated itself to a version that would not run on my OS. Also, it's an electron app, so it is absurdly heavyweight for the tiny bit of functionality it provides. I ended up writing my own TOTP app. It's about 50 lines of common lisp code.
- latchkey 7y ago
  Authy Desktop Memory / Real / Shared 71.3 MB 116.8 MB 96.3 MB
  - lisper 7y ago
    > du -sh Authy\ Desktop.app/ 142M Authy Desktop.app/ > du -sh Clozure\ CL.app/ 35M Clozure CL.app/
    - latchkey 7y ago
      disk space is cheap, ram is expensive.
      - lisper 7y ago
        > ps ax -o %mem,comm | grep dx86cl64 0.4 /Users/ron/devel/ccl/v1.11/Clozure CL64.app/Contents/MacOS/dx86cl64 > ps ax -o %mem,comm | grep Authy 0.7 /Applications/Authy Desktop.app/Contents/MacOS/Authy Desktop 0.2 /Applications/Authy Desktop.app/Contents/Frameworks/Authy Desktop Helper.app/Contents/MacOS/Authy Desktop Helper 1.1 /Applications/Authy Desktop.app/Contents/Frameworks/Authy Desktop Helper.app/Contents/MacOS/Authy Desktop Helper No matter how you slice it, Authy is just an outrageous resource hog.
  - eikenberry 7y ago
    Yes, exactly like he said. Absurdly heavyweight for the functionality it provides. The oathtool command line utility uses 1660KB generating a TOTP.
- 7y ago
txcwpalpha 7y ago
This thread is a perfect example of why security is hard. Even if you give users the tools to improve their security (2FA apps), and even if you enforce they they use those apps, users will always find a way to create a loophole that completely negates the security enhancement you implemented. If you’re putting all of your OTP codes in your password manager, that completely negates the entire point of two factor authentication. And sure, maybe you think “well I’m not a high value target anyway, I don’t need to really secure my devices”, how many of you have work-related accounts signed into your devices? Even if you’re just a lowly engineer, I can guarantee you absolutely are a target of sophisticated hacker groups (ironically you may even be more of a target because these groups know that you don’t consider yourself a target and therefor are more lax with your security).
- v01dlight 7y ago
  It's bad practice sure, but to say that it "completely negates the entire point of two factor authentication" is ignoring the main attack password managers are good at defending against: credential stuffing. Example: If LinkedIn leaks my password, attackers can't use it to gain access to my Gmail because (thanks to the help of a password manager) I use different passwords for all sites. They also can't use it to gain access to LinkedIn because I have 2FA turned on. Even if my OTPs are saved in my password manager, they would need my master password for that. And if they have someone's master password, they're probably screwed whether or not they have OTPs in their vault because they likely have credit card numbers, addresses, social security numbers, etc in there too.
braindead_in 7y ago
I use a Chrome extension instead. Works like charm.
ncmncm 7y ago
I like Somu hardware key now. It is so small--fits inside USB slot--I keep it in an extender whem it's not in use. And, not subject to attacks that work with passcode systems.
dang 7y ago
Related current thread: https://news.ycombinator.com/item?id=22432828 https://news.ycombinator.com/item?id=22432828
ygmelnikova 7y ago
I have this strangely wonderful urge to buy Authy. Weird.
anonsivalley652 7y ago
Since FreeOTP (iOS and Android) is open-source and free, it seems trivial to add an export/import feature that can store/load from an password-protected (argon2), encrypted (AES) file. https://freeotp.github.io https://freeotp.github.io https://github.com/freeotp/freeotp-ios https://github.com/freeotp/freeotp-ios https://github.com/freeotp/freeotp-android https://github.com/freeotp/freeotp-android This isn't suitable because it doesn't allow saving it as a file: https://github.com/freeotp/freeotp-ios/pull/129 https://github.com/freeotp/freeotp-ios/pull/129
yellowapple 7y ago
"Still using Google Authenticator? Let me recommend a replacement with a significantly larger attack surface." I don't know what the current situation is for iOS, but on Android I've been using andOTP and it addresses pretty much all of the author's pain points (except for automated syncing between devices and the need to install it per-device, but you really should keep the number of TOTP-generating devices to a minimum; more devices = more opportunities for someone to steal that second factor of authentication).
kuzimoto 7y ago
Surprised is hasn't been mentioned, but KeePass has the ability to generate the TOTP codes as well. Database is stored encrypted and on your device. Use SyncThing and sync your database across multiple devices securely. Lots of cross-platform apps to use.
parasense 7y ago
I'm not sure the author on zdnet understand the security implications for "Device surfing". That is conceptually convenient, but really a terrible idea! A new token should be generated for each separate device, but not all token providers support multiple floating tokens. It's always a battle of convinience versus security, and I get it... people think that because some services have lowered security to allow device surfing, yet without knowing the implications, that it's then just some kind of abstract non-issue taken care of by magical security things not understood. In other words it takes a big leap of faith, that was improper.

188 points by LinuxBender 7y ago

> Is it risky "centralizing" this data? Sure, but I don't see it any more risky as using a cloud-based password manager. Using a cloud-based password manager is a huge risk though. And if you've put both your passwords and your 2FA generators in the cloud, you now have single-factor authentication.

TallGuyShort 7y ago
>> you now have single-factor authentication In many cases that factor is now Google's security vs. the same reused password that is your hobby + the year you graduated high school. It this is what makes it convenient enough to always use, it's probably still a step up. It's at least a better, slightly more distributed factor. And even then they're distinct systems, possibly not even within the same cloud.
Quai 7y ago
This. It is a real problem that a lot of people fail to understand why this is an issue.
iudqnolq 7y ago
It's less secure, but the single factor is a stronger single factor than a password because it can't be reused. If someone mitms my login they get my password and otp code, which they ideally can't turn into something reusable (if the website requires 2FA to change security settings) and definitely can't use if they have a lag between collection and exploitation (like a keylogger that phones home every so often). This is acceptable to me, but I would prefer websites let me use a one time code as a single factor of authentication.

Spivak 7y ago

Bitwarden is a pretty good solution for this! It's not the smoothest since the browser extensions don't know how to fill in your codes like they do your password but it's leaps and bounds above the UX for Google Authenticator. Being able to access my codes from any device with a web browser is very nice. INB4: "But this reduces your security." * Yes, but I'm already using a password manager with 64 char generated passwords on every site. * If you're able to compromise my Bitwarden password you likely have enough to remove the 2FA on all of my accounts anyway. "Why even have 2FA at that point then?" * Because some things in my life require it.

hmhrex 7y ago
I just paid for my second year of Bitwarden. I love it.
specialp 7y ago
Also if your local machine is compromised, which is much more common than people brute-forcing passwords, somebody can get your password and a 2FA code and access any account.
Royalaid 7y ago
Thanks for posting this. The threat modeling in this thread feels very much out of wack with my personal experience. The thing that has lead to the most compromised accounts for myself is old, short, unchanged passwords on accounts I had forgotten that probably have been leaked.
lain 7y ago
I've found the Bitwarden browser extension has an option to automatically copy the 6 digit code after the username+password autofill. Can't remember if it does it by default though. See: Settings / Options / Disable Automatic TOTP Copy
e12e 7y ago
Another shout out for bitwarden. Being open source, you can self host, and it has become a semi-standard of sorts, with alternative implementations. As a sibling mentions, when you fill inn the user/pw of an account with 2fa enabled, the 2fa pin should be copied into the clipboard by default. (so the flow is: autofill username/password; submit, paste pin;submit). Still think it's silly there's no simple way to get an encrypted backup of the 2fa-secrets from Google authenticator - it leaves the user and an attacker (with effective root on the phone) on uneven ground. For the user the app pretends that there is no shared secret with the server that could be compromised - the attacker simply access the sqlite db.

lima 7y ago

Strongly disagree with the premise of this article: - Passcode or biometric locks on an app are a gimmick and offer negligible value. - The keys not being backed up or or synchronised across devices is not a bug, but a feature. You're supposed to keep offline backup keys. Any sort of synchronization feature adds a ton of attack surface. - In particular, Authy, LastPass and 1password have a giant attack surface compared to a simple app like Google Authenticator. They also rely on centralized services and if you also keep your passwords in there, you eliminate the whole point of two factor authentication. - One important risk with authentication apps is compromised updates, and Google Authenticator has a very low risk of this since it's backed by Google's strict security processes. What you should actually do is to move to U2F/WebAuthn and pester any of your service providers that do not offer it. Yes, if you need to replace a token, you'll have to go through all accounts and change it. There's is absolutely no way to prevent this without compromising on security.

ls612 7y ago
Here’s the thing. I consider myself fairly responsible but I’ll bet I’m far more likely to lose my phone than it is that my Authy and Dashlane credentials are both compromised, which are my pw manager and Authenticator app. You have to choose your risks and for a lot of people an authy like feature is much safer overall than GA.
- ocdtrekkie 7y ago
  All my 2FA codes are backed up. On paper. I have a physically-secured cache of the QR codes which can be pretty quickly imported into a new app.
  - tlb 7y ago
    Do you trust the security of your printer when you print codes? They are historically one of the biggest attack surfaces.
    - julianlam 7y ago

burnte 7y ago

Authy. Fantastic replacement app. makes backing everything up a snap. I can log into Authy on one device by allowing on another, etc.

netsharc 7y ago

My Google Authenticator data survived me migrating to a different phone because my flow is: 1. Backup old phone using Titanium Backup. 2. Get new Android phone. 3. Root it. 4. Copy TB backup files from old phone to new. 5. Restore apps and data on new phone using Titanium Backup. Obviously it's not a procedure a normal user is expected to do...

cryptozeus 7y ago
In Iphone I just do backup and restore in itunes. Everything is migrated. I dont see why you need to do all these.
- tinus_hn 7y ago
  Keys that specify they can’t be backed up are not migrated, they are not included in the backup.

spyridonas 7y ago

I use Microsoft Authenticator and it has cloud backups. Maybe it's unsafe, they promise it's super safe. https://docs.microsoft.com/el-gr/azure/active-directory/user-help/user-help-auth-app-backup-recovery https://docs.microsoft.com/el-gr/azure/active-directory/user...

partiallypro 7y ago
I think you can turn off cloud back-ups if you want. That's what I use as well. Also -some- cloud backups don't work on it, if the tenant doesn't allow it. My Azure tenant does not, so you have to reset everything up if you get a new phone. It was a painful experience, since me and the main tenant holder both got new phones at the same time. Had to contact Microsoft directly.

ValentineC 7y ago

I stopped using Google Authenticator in 2013 when my tokens disappeared after a software update [1]. They were restored in the next update, but I didn't like not having access to the raw TOTP data. I switched to Authy after the incident, and now use 1Password after I discovered their TOTP feature. [1] https://news.ycombinator.com/item?id=6325760 https://news.ycombinator.com/item?id=6325760

the_svd_doctor 7y ago
Isn’t that putting all eggs in the same basket?
- plttn 7y ago
  Yes and no. Yes, it puts 1Password as the only point of failure iff 1Password security is compromised. This would require knowing my Master Password, my Secret Key, and 2FA with either my OTP from Google Authenticator or a Yubikey to open the vault on a new device, or knowing my master password on a device that I already have 1Password set up on. On the flip side however, for anyone who _doesn't_ know I use 1Password (oops), any credential stuffing attack or password leak is not likely to get anywhere, as they're not going to be attacking my 1Password vault.
- ValentineC 7y ago
  It's a compromise for me: the killer feature is not having to depend on my phone to log into websites. I suppose it might be even more secure if I kept tokens in a separate vault.
notlukesky 7y ago
You might be interested then in the autofilling options of SAASPASS Authenticator and Password Manager (with browser extension and iOS 12 autofill turned on).

sschueller 7y ago

Use an alternative like andOTP or Authenticator Plus which allow you to backup your keys.

prophesi 7y ago
+1 to andOTP. It's on F-Droid and still gets semi-regular updates. It's a bit obnoxious that it requires a password, but that just means an autofill from my password manager for free at-rest encrypted storage.
- pyt 7y ago
  I believe if you use the Android Keystore, you can use it without a password and just authenticate with a fingerprint when it starts up.
- txcwpalpha 7y ago
  Are you not using 2FA for your password manager?

terlisimo 7y ago

I've settled on Aegis. It is open source and allows you to export secrets to an encrypted file which you can copy around. A bit more tedious than Authy and similar cloud sync solutions but lower attack surface and less tedious to back up than Google Authenticator. Available on F-droid. Beware of Aegis knock-offs on Google Play Store that use similar name.

gravitas 7y ago

For those who have not seen the previous HN threads this past year on 2FA, Aegis has emerged on Android which a number of folks (myself included) have migrated to using: https://github.com/beemdevelopment/Aegis https://github.com/beemdevelopment/Aegis (links to G-Play/F-Droid in readme) A backup (encrypted or plain) of your seeds can be exported/imported.

xtracto 7y ago
This is amazing! Thank you very much, I will set it up along Google Auth in my phone and add it to my home "backup phone". One thing that had bothered of Google Auth for a long time is the fear of losing my phone and having to go hunting down all the authentication information. And never considered Authy because using an "online service" for these kind of things just seems wrong to me.

jabroni_salad 7y ago

Since we're apparently all sharing our 2fa methods I've really been liking the yubico authenticator. All the secrets are on the yubikey itself so if something dumb happens to my phone or computer I don't have to worry about them. Plus, the same device does my FIDO2 / u2f / whatever it is this month for the services that support it.

edm0nd 7y ago
U2F + Googles Advanced Protection Program = secure AF https://landing.google.com/advancedprotection/ https://landing.google.com/advancedprotection/
johnisgood 7y ago
Yes, and OpenSSH just added FIDO/U2F support! https://www.openssh.com/txt/release-8.2 https://www.openssh.com/txt/release-8.2 https://www.phoronix.com/scan.php?page=news_item&px=OpenSSH-8.2-Released https://www.phoronix.com/scan.php?page=news_item&px=OpenSSH-...

danShumway 7y ago

Last time I checked, by default, Authy codes were susceptible to SIM-swap attacks.[0] This is a bad article. You should perhaps consider switching off of Authenticator to an Open Source manager like AndOTP; I think that's something reasonable to propose. But I don't understand the argument that I should be very concerned a lack of biometric locks, but not concerned about invalidating the "something you have" part of 2FA. I don't think it's horrible if someone uses an app like Authy. It's better than nothing. But this article didn't need to exist -- if you use Authenticator, just keep using it, it's fine. [0]: https://nitter.42l.fr/DanielShumway/status/1092081967007498242#m https://nitter.42l.fr/DanielShumway/status/10920819670074982...

latchkey 7y ago
Authy only has SIM issues if you give it your phone number. Don't do that.
- danShumway 7y ago
  The linked article is recommending Authy over Authenticator because backing up codes on multiple devices is too hard. If you're going to disable remote backup on Authy, then there's almost no advantage to switching away from Authenticator in the first place. Authy also doesn't allow local export of tokens, so there's no advantage there. I guess with Authenticator you lose the ability to lock your local tokens with a 4-digit pin, but who cares? 4-digit pins are not secure. I just checked on an old installation of Authy, and as far as I can tell there is no way to remove a phone number from the app itself, only change it. Maybe when you're installing you can skip that step. You can turn off remote backup entirely, but see above. If you use Authy, fine. It's still better than nothing. Really, getting people to use 2FA at all is the important battle, and the fight over which 2FA app is best is probably a waste of time. But Zdnet should not have written an article recommending people switch away from Authenticator to Authy when Authy's primary selling point is actually an attack vector that its own support website recommends disabling[0]. More to the point, the setting makes me trust Authy less in other security areas, because it's an attack vector that they easily could have plugged years ago -- and it makes me think they haven't actually thought that much about security. It's just bad UX to ask users for an encryption password when a single setting will non-transparently bypass that password requirement for some tokens. [0]: https://support.authy.com/hc/en-us/articles/360012427914-Is-the-Authy-App-Susceptible-to-a-SIM-Swap- https://support.authy.com/hc/en-us/articles/360012427914-Is-...

RileyJames 7y ago

Just last night I was setting up “2FA” for my girls gmail account. It has so clearly become surveillance it’s disgusting. The only options are google consumer apps (or the physical key). The opportunity to link a mobile device to a desktop for advertising purposes was too great. I have little trust that google authenticator app is any different. But as far I can see you can’t use any of these alternatives from the article.

lisper 7y ago

I stopped using Authy because it has auto-update that you cannot disable. One day it auto-updated itself to a version that would not run on my OS. Also, it's an electron app, so it is absurdly heavyweight for the tiny bit of functionality it provides. I ended up writing my own TOTP app. It's about 50 lines of common lisp code.

latchkey 7y ago
Authy Desktop Memory / Real / Shared 71.3 MB 116.8 MB 96.3 MB
- lisper 7y ago
  > du -sh Authy\ Desktop.app/ 142M Authy Desktop.app/ > du -sh Clozure\ CL.app/ 35M Clozure CL.app/
  - latchkey 7y ago
    disk space is cheap, ram is expensive.
    - lisper 7y ago
      > ps ax -o %mem,comm | grep dx86cl64 0.4 /Users/ron/devel/ccl/v1.11/Clozure CL64.app/Contents/MacOS/dx86cl64 > ps ax -o %mem,comm | grep Authy 0.7 /Applications/Authy Desktop.app/Contents/MacOS/Authy Desktop 0.2 /Applications/Authy Desktop.app/Contents/Frameworks/Authy Desktop Helper.app/Contents/MacOS/Authy Desktop Helper 1.1 /Applications/Authy Desktop.app/Contents/Frameworks/Authy Desktop Helper.app/Contents/MacOS/Authy Desktop Helper No matter how you slice it, Authy is just an outrageous resource hog.
- eikenberry 7y ago
  Yes, exactly like he said. Absurdly heavyweight for the functionality it provides. The oathtool command line utility uses 1660KB generating a TOTP.
7y ago

txcwpalpha 7y ago

This thread is a perfect example of why security is hard. Even if you give users the tools to improve their security (2FA apps), and even if you enforce they they use those apps, users will always find a way to create a loophole that completely negates the security enhancement you implemented. If you’re putting all of your OTP codes in your password manager, that completely negates the entire point of two factor authentication. And sure, maybe you think “well I’m not a high value target anyway, I don’t need to really secure my devices”, how many of you have work-related accounts signed into your devices? Even if you’re just a lowly engineer, I can guarantee you absolutely are a target of sophisticated hacker groups (ironically you may even be more of a target because these groups know that you don’t consider yourself a target and therefor are more lax with your security).

v01dlight 7y ago
It's bad practice sure, but to say that it "completely negates the entire point of two factor authentication" is ignoring the main attack password managers are good at defending against: credential stuffing. Example: If LinkedIn leaks my password, attackers can't use it to gain access to my Gmail because (thanks to the help of a password manager) I use different passwords for all sites. They also can't use it to gain access to LinkedIn because I have 2FA turned on. Even if my OTPs are saved in my password manager, they would need my master password for that. And if they have someone's master password, they're probably screwed whether or not they have OTPs in their vault because they likely have credit card numbers, addresses, social security numbers, etc in there too.

braindead_in 7y ago

I use a Chrome extension instead. Works like charm.

ncmncm 7y ago

I like Somu hardware key now. It is so small--fits inside USB slot--I keep it in an extender whem it's not in use. And, not subject to attacks that work with passcode systems.

dang 7y ago

Related current thread: https://news.ycombinator.com/item?id=22432828 https://news.ycombinator.com/item?id=22432828

ygmelnikova 7y ago

I have this strangely wonderful urge to buy Authy. Weird.

anonsivalley652 7y ago

Since FreeOTP (iOS and Android) is open-source and free, it seems trivial to add an export/import feature that can store/load from an password-protected (argon2), encrypted (AES) file. https://freeotp.github.io https://freeotp.github.io https://github.com/freeotp/freeotp-ios https://github.com/freeotp/freeotp-ios https://github.com/freeotp/freeotp-android https://github.com/freeotp/freeotp-android This isn't suitable because it doesn't allow saving it as a file: https://github.com/freeotp/freeotp-ios/pull/129 https://github.com/freeotp/freeotp-ios/pull/129

yellowapple 7y ago

"Still using Google Authenticator? Let me recommend a replacement with a significantly larger attack surface." I don't know what the current situation is for iOS, but on Android I've been using andOTP and it addresses pretty much all of the author's pain points (except for automated syncing between devices and the need to install it per-device, but you really should keep the number of TOTP-generating devices to a minimum; more devices = more opportunities for someone to steal that second factor of authentication).

kuzimoto 7y ago

Surprised is hasn't been mentioned, but KeePass has the ability to generate the TOTP codes as well. Database is stored encrypted and on your device. Use SyncThing and sync your database across multiple devices securely. Lots of cross-platform apps to use.

parasense 7y ago

I'm not sure the author on zdnet understand the security implications for "Device surfing". That is conceptually convenient, but really a terrible idea! A new token should be generated for each separate device, but not all token providers support multiple floating tokens. It's always a battle of convinience versus security, and I get it... people think that because some services have lowered security to allow device surfing, yet without knowing the implications, that it's then just some kind of abstract non-issue taken care of by magical security things not understood. In other words it takes a big leap of faith, that was improper.