3 ms·
there's no online component... your phone takes the current time (divided by some value), the secret key, and performs a cryptographic function on it, then the
by blibble 15y ago
there's no online component... your phone takes the current time (divided by some value), the secret key, and performs a cryptographic function on it, then the system you're logging into does the same thing and compares the results.
with secureid the secret key is fixed in the hardware (and RSA keep a copy of the key), whereas with Google authenticator you can generate and input the key yourself, so that Google never sees it.
- eli 15y agoI think one of us is confused. RSA's seed is the same as Authenticator's secret key, no? There's no online component in the RSA system either.
- eik3_de 15y ago> there's no online component I can confirm that. The app doesn't require any permissions. I rebooted my phone while in flight mode and the Google login via Authenticator code works as expected.
- dsl 15y ago> you can generate and input the key yourself, so that Google never sees it. Google still needs to know the secret. All authenticators are based on a shared secret model, so the same possible attack vector that bit RSA.
- devicenull 15y agoRight, but a compromise of your token for Google's services would not mean your token for your job was compromised as well. You could even generate a new key for each machine you connect to, if you were paranoid enough.