3 ms·

Google Play devs will need to enable 2-Step Auth and meet identity requirements

20 points by sidcool 5y ago

Gravyness 5y ago
Password were easy to guess so they now must contain two special character, spaces, commas and at least one key that is not in your keyboard. In the end it doesn't even matter because passwords are useless. Why is security becoming this mess?
- kadoban 5y ago
  Does not look like there's extra password requirements. Did I miss it? They're enforcing 2fa, which everyone should be moving towards. This is a good step. The identity reqs I have no thoughts on at the moment.
donmcronald 5y ago
I’m stunned there wasn’t an identity verification requirement before. I always just assumed there was. What a clown show. Also, isn’t 2FA based on SMS or TOTP almost as easy to phish as a password? If someone is already typing their password into a phishing site, that site can just ask for 2FA codes too, right? I’d say make WebAuthn the baseline, but I do that for myself with a YubiKey and it sucks. Mine’s older (v4) and only does U2F, but it doesn’t work over RDP and I have to use my PC for everything. I think a better system would be a hybrid of Microsoft’s push (click approve) system and WebAuthn. Ex: I visit a site and it pushes a WebAuthn challenge to my phone’s authenticator and I approve by NFC using my hardware key. That way you get a signature for a specific domain (ex: microsoft.com) and you only need compatibility for the system on one device; your phone.
- kadoban 5y ago
  Some SMS and TOTP are vulnerable to phishing, yes (combination with a good password manager reduces/eliminates this). That's not the only attack though, and it's still better than nothing.
- atatatat 5y ago
  You speak of Webauthn like it isn't wildly new/still being adopted.
grawprog 5y ago
>Meanwhile, Google is introducing “Developer identification requirements” to “help us better understand your needs.” In addition to providing your email address and phone number, the following information will also be required: >Your account type — whether it’s personal or belongs to an organization >A contact name >Your physical address >Verification of your email address and phone number It seems an odd juxtaposition, you get a lot of people on HN who claim to advocate for privacy, yet don't bat an eye at and even cheer on needing to provide google with your physical address just publish an app on the play store in the name of security.

20 points by sidcool 5y ago

Password were easy to guess so they now must contain two special character, spaces, commas and at least one key that is not in your keyboard. In the end it doesn't even matter because passwords are useless. Why is security becoming this mess?

kadoban 5y ago
Does not look like there's extra password requirements. Did I miss it? They're enforcing 2fa, which everyone should be moving towards. This is a good step. The identity reqs I have no thoughts on at the moment.

donmcronald 5y ago

I’m stunned there wasn’t an identity verification requirement before. I always just assumed there was. What a clown show. Also, isn’t 2FA based on SMS or TOTP almost as easy to phish as a password? If someone is already typing their password into a phishing site, that site can just ask for 2FA codes too, right? I’d say make WebAuthn the baseline, but I do that for myself with a YubiKey and it sucks. Mine’s older (v4) and only does U2F, but it doesn’t work over RDP and I have to use my PC for everything. I think a better system would be a hybrid of Microsoft’s push (click approve) system and WebAuthn. Ex: I visit a site and it pushes a WebAuthn challenge to my phone’s authenticator and I approve by NFC using my hardware key. That way you get a signature for a specific domain (ex: microsoft.com) and you only need compatibility for the system on one device; your phone.

kadoban 5y ago
Some SMS and TOTP are vulnerable to phishing, yes (combination with a good password manager reduces/eliminates this). That's not the only attack though, and it's still better than nothing.
atatatat 5y ago
You speak of Webauthn like it isn't wildly new/still being adopted.

grawprog 5y ago

>Meanwhile, Google is introducing “Developer identification requirements” to “help us better understand your needs.” In addition to providing your email address and phone number, the following information will also be required: >Your account type — whether it’s personal or belongs to an organization >A contact name >Your physical address >Verification of your email address and phone number It seems an odd juxtaposition, you get a lot of people on HN who claim to advocate for privacy, yet don't bat an eye at and even cheer on needing to provide google with your physical address just publish an app on the play store in the name of security.