3 ms·
For particularly security-conscious users Google offers this: https://landing.google.com/advancedprotection/ https://landing.google.com/advancedprotection/
by modeless 6y ago
For particularly security-conscious users Google offers this: https://landing.google.com/advancedprotection/ https://landing.google.com/advancedprotection/
- Wowfunhappy 6y agoI think this still has a grace period for trusted devices? Some of the FAQs at the bottom make it sound like you don't need to use the physical key every time you log in. Which, again, is probably reasonable for 99% of cases, but might be undesirable if you're doing investigative journalism on powerful state actors or some such.
- xfitm3 6y agoFrom the FAQ: > What happens if I lose all of my security keys? > If you still have access to a computer that is signed into your account, you can visit account.google.com and register replacement keys in place of the lost keys.
- staticassertion 6y agoI believe APP Suffers from the exact same issue, though APP is something I recently enabled anyway. I don't know of a way, even with full gsuite enterprise policy access, to prevent an attack where the attacker has an active session and your password. Some things you could do, but would not be full mitigations and likely just annoy an attacker in many cases (though that's often enough): * via GSuite, enforce 2FA * Enforce 2FA via hardware tokens/ APP * Context Aware Access that validates that the login is coming from a specific verified device that is provisioned via your GSuite / conforms to policy, that way the attacker can't just steal the session/password and log in from another device? Maybe? Really, the attack described requires like 3 different things to go wrong. I agree that there should be changes made to the system to improve this, but it's a rough model to protect a user when the attacker is sitting on the box they're logged into.