5 ms·

I’m not crazy about these “consult your phone to log in” things. There’s just so many more moving parts. Sometimes the push notification doesn’t make it through

by teeray 6y ago

I’m not crazy about these “consult your phone to log in” things. There’s just so many more moving parts. Sometimes the push notification doesn’t make it through. Other times the acknowledgment from the phone doesn’t make it back. Occasionally my phone is doing updates when I urgently need to log in. I’d love for the “something you have” to be “my laptop.” It has a TPM; we can do this securely. Something like the MBP’s Touch Bar where there is a separate integrated physical device with a screen that can make security prompts is ideal.

StavrosK 6y ago
Your laptop (probably) already supports FIDO2 with your TPM, now it's a matter of Google (and others) implementing it.
- sam_lowry_ 6y ago
  They have it already in WebAuthn in a completely siloed way. That is, they only implement hardware token support and if you want software tokens, they will make your life painful.
  - md_ 6y ago
    Desktop (i.e. non-portable) WebAuthn authenticators are good for things like transactional authorization (e.g. confirm a payment on PayPal), but not especially useful for authentication: if you already have your WebAuthn secrets on your browser (or OS), you probably also have your authn cookies, too! I'm glossing over a few things (e.g. WebAuthn credentials can be stored in secure hardware, so can be more secure than cookies), but in general, WebAuthn secrets stored in a desktop TPM, while valuable in certain applications, aren't alone a very meaningful step toward getting rid of passwords—since passwords are primarily used for authenticating on new (never-before-used) endpoints. A slightly degenerate case is one where you use passwords to sign into your (say) MacBook, but Apple syncs the WebAuthn credentials via iCloud so you don't need a password on any other services. Which, like, if you're gonna do this—why not just use Apple's password manager and sync passwords? :)
mjparrott 6y ago
I would never want my laptop to be my authentication device for my personal life. I am away from home when I need to log in to things. Even if I'm at home, I am not sitting at my desk when I need to log in.
- remram 6y ago
  Hopefully we can set two devices as trusted?
63 6y ago
I had a particularly hard time recently due to this when my phone broke and I couldn't replace it for a week or so. It all got figured out in the end, but not being able to access my Google account and all that entails was more of a problem than I expected.
- justin_oaks 6y ago
  That's why I have the set of printable backup codes in my wallet. One time I forgot my phone, but I had my wallet and was able to log in to my Google account.
- fletchowns 6y ago
  I keep Authy installed on my tablet for exactly this reason, in case I lose my phone I still have a backup device for 2FA. Won't help for the SMS 2FA for the sites I'm forced to use that on, but at least Authy lets me get to the important ones.
askvictor 6y ago
A well-designed MFA system has multiple fall backs available. Google's has options to fall back to sending an SMS (not the highest level of security, but security is always a trade-off), so if you're phone's broken you can move the SIM to another one. Or a phone call to a pre-registered landline that will read out a code to you. As well as the paper/printable emergency codes. That said, there's always going to be compromises and annoyances - I've been using MFA for 10+ years, and occasionally something glitches out, but other things (e.g. basic password systems) also sometimes glitch out, and having an account compromised is much, much worse than a minute or two of mild annoyance.
- tjoff 6y ago
  Not everyone has a SIM to begin with. Or it is lost with the phone. Anything that has a single or dual point of failure is dead on arrival. Too bad you will realize only after you are locked out of all your digital life.
  - bawolff 6y ago
    Authentication always has a single point of failure: you. If other people could log in as you it would defeat the point
    - tjoff 6y ago
      That is at least within my control, I can live with that.
  - remus 6y ago
    For what it's worth, google's MFA setup is the best of any I've used. You can (and should) setup a variety of second factors on your google account so that if one of them fails for some reason you've got other options. Between backup codes, TOTP, pixel phone verification and multiple FIDO keys there's plenty of options. This compares very favourably to, say, AWS where you can only have a single second factor and the recommended(!) way of protecting against loss of a second factor is to have multiple accounts with different second factors registered to each of them.
will4274 6y ago
Some of these authenticator apps store their state in your phones TPM (or "secure enclave") already. All you're really saying is you want them to ship the authenticator apps to desktop platforms as well as mobile..
jonathanstrange 6y ago
The worst way is how my bank is currently doing it, they require SMS authentification but do not allow two phones at the same time, and to switch it on you have to sign something and wait for a letter by snail mail. Now I'm stuck with a decade old phone just to confirm my online transactions, and if it breaks I'm out of luck. The alternative would be to not have working online banking for one or two weeks, which I cannot afford at the moment (thanks to Covid).

by teeray 6y ago

StavrosK 6y ago

Your laptop (probably) already supports FIDO2 with your TPM, now it's a matter of Google (and others) implementing it.

sam_lowry_ 6y ago
They have it already in WebAuthn in a completely siloed way. That is, they only implement hardware token support and if you want software tokens, they will make your life painful.
- md_ 6y ago
  Desktop (i.e. non-portable) WebAuthn authenticators are good for things like transactional authorization (e.g. confirm a payment on PayPal), but not especially useful for authentication: if you already have your WebAuthn secrets on your browser (or OS), you probably also have your authn cookies, too! I'm glossing over a few things (e.g. WebAuthn credentials can be stored in secure hardware, so can be more secure than cookies), but in general, WebAuthn secrets stored in a desktop TPM, while valuable in certain applications, aren't alone a very meaningful step toward getting rid of passwords—since passwords are primarily used for authenticating on new (never-before-used) endpoints. A slightly degenerate case is one where you use passwords to sign into your (say) MacBook, but Apple syncs the WebAuthn credentials via iCloud so you don't need a password on any other services. Which, like, if you're gonna do this—why not just use Apple's password manager and sync passwords? :)

mjparrott 6y ago

I would never want my laptop to be my authentication device for my personal life. I am away from home when I need to log in to things. Even if I'm at home, I am not sitting at my desk when I need to log in.

remram 6y ago
Hopefully we can set two devices as trusted?

63 6y ago

I had a particularly hard time recently due to this when my phone broke and I couldn't replace it for a week or so. It all got figured out in the end, but not being able to access my Google account and all that entails was more of a problem than I expected.

justin_oaks 6y ago
That's why I have the set of printable backup codes in my wallet. One time I forgot my phone, but I had my wallet and was able to log in to my Google account.
fletchowns 6y ago
I keep Authy installed on my tablet for exactly this reason, in case I lose my phone I still have a backup device for 2FA. Won't help for the SMS 2FA for the sites I'm forced to use that on, but at least Authy lets me get to the important ones.

askvictor 6y ago

A well-designed MFA system has multiple fall backs available. Google's has options to fall back to sending an SMS (not the highest level of security, but security is always a trade-off), so if you're phone's broken you can move the SIM to another one. Or a phone call to a pre-registered landline that will read out a code to you. As well as the paper/printable emergency codes. That said, there's always going to be compromises and annoyances - I've been using MFA for 10+ years, and occasionally something glitches out, but other things (e.g. basic password systems) also sometimes glitch out, and having an account compromised is much, much worse than a minute or two of mild annoyance.

tjoff 6y ago
Not everyone has a SIM to begin with. Or it is lost with the phone. Anything that has a single or dual point of failure is dead on arrival. Too bad you will realize only after you are locked out of all your digital life.
- bawolff 6y ago
  Authentication always has a single point of failure: you. If other people could log in as you it would defeat the point
  - tjoff 6y ago
    That is at least within my control, I can live with that.
- remus 6y ago
  For what it's worth, google's MFA setup is the best of any I've used. You can (and should) setup a variety of second factors on your google account so that if one of them fails for some reason you've got other options. Between backup codes, TOTP, pixel phone verification and multiple FIDO keys there's plenty of options. This compares very favourably to, say, AWS where you can only have a single second factor and the recommended(!) way of protecting against loss of a second factor is to have multiple accounts with different second factors registered to each of them.

will4274 6y ago

Some of these authenticator apps store their state in your phones TPM (or "secure enclave") already. All you're really saying is you want them to ship the authenticator apps to desktop platforms as well as mobile..

jonathanstrange 6y ago

The worst way is how my bank is currently doing it, they require SMS authentification but do not allow two phones at the same time, and to switch it on you have to sign something and wait for a letter by snail mail. Now I'm stuck with a decade old phone just to confirm my online transactions, and if it breaks I'm out of luck. The alternative would be to not have working online banking for one or two weeks, which I cannot afford at the moment (thanks to Covid).