4 ms·

No, if someone gets the password you've set aside for your IMAP client, they get access to all services. This is factually wrong: "all they can do is read your

by mapgrep 15y ago

No, if someone gets the password you've set aside for your IMAP client, they get access to all services. This is factually wrong: "all they can do is read your mail." As someone with Google two-factor auth and an iPhone, I can tell you it's not that sophisticated. You can label the access key "IMAP key," but that's just the human readable label. There is no functionality tying a key to particular Google services; any key unlocks them all. There should be such functionality, which was one of the points made in this (admittedly flawed) article. For the record, you are right when you say they don't "own" you account, since they can't change the password. But they do have broad access.

FaceKicker 15y ago
This is true, though I think the grandparent's point was more that it is still a strictly better security situation than before, in that they can't change the password and remove your access to the account, but you can instantly remove their access (by password revocation). I'm not sure if he/she actually meant that all you could do was read the victim's mail, but yeah, he's wrong if so.
- mapgrep 15y ago
  Ya, I think that's a good point; we can all agree that two factor auth is a significant win for users and it's good Google has done it. I just think people should be clear on what the keys can and cannot protect you against. You mentioned revocation -- one thing that will motivate people to do timely revokes is being aware of the potential harm of leaving these keys active after they are compromised. From what I recall of Google's setup process, they don't prominently tell people to be sure to revoke their keys in certain situations, e.g. you lose your iPhone, you lose your iPad, you lose your laptop, etc. It's easy to get the impression while activating 2-factor auth that these keys are more limited than they are and that you don't have to worry too much about them.
wickedchicken 15y ago
> No, if someone gets the password you've set aside for your IMAP client, they get access to all services. OK, I guess it would be an improvement to record the first-used service and lock it down only to that. Still, with the old model grabbing the password still gave you access to all services; this is definitely not a degradation of security from before.
drivebyacct2 15y ago
No... These passwords will not work as login on Google's website. I just generated a one-time-use password. You can not use it to login on Google.com properties. """ Please use your account password instead of an application-specific password. """ And obviously it will then prompt for your OTOP. Again, this is absolutely no worse than someone getting your Google Account password anyway... and even if they do, they can only use it for select things that are allowed to be used via one-time-use passwords - it's just that we happen to be discussing email and IMAP is a rather large exception. Presumably this isn't the case for other Google services. (Uh, guys, did you have a different experience or something?)
- mapgrep 15y ago
  I didn't say the passwords would actually log you in, just that they can be used across all services, they cannot be for example limited to mail as the person I was responding to stated. So you could use an app specific password across Google's various APIs and app accessible content - Talk/Gchat/Jabber, Blogger, YouTube, Picasa, Reader, and so forth, there's a fuller list in the docs for two-factor auth. (I have personally made app specific passwords for IMAP, Jabber and Reader, and I used to use a third party client to post to Blogger - the passwords are interchangable.) (I'm not the one who downvoted you, by the way, so I can only guess at why.)

by mapgrep 15y ago

FaceKicker 15y ago

This is true, though I think the grandparent's point was more that it is still a strictly better security situation than before, in that they can't change the password and remove your access to the account, but you can instantly remove their access (by password revocation). I'm not sure if he/she actually meant that all you could do was read the victim's mail, but yeah, he's wrong if so.

mapgrep 15y ago
Ya, I think that's a good point; we can all agree that two factor auth is a significant win for users and it's good Google has done it. I just think people should be clear on what the keys can and cannot protect you against. You mentioned revocation -- one thing that will motivate people to do timely revokes is being aware of the potential harm of leaving these keys active after they are compromised. From what I recall of Google's setup process, they don't prominently tell people to be sure to revoke their keys in certain situations, e.g. you lose your iPhone, you lose your iPad, you lose your laptop, etc. It's easy to get the impression while activating 2-factor auth that these keys are more limited than they are and that you don't have to worry too much about them.

wickedchicken 15y ago

> No, if someone gets the password you've set aside for your IMAP client, they get access to all services. OK, I guess it would be an improvement to record the first-used service and lock it down only to that. Still, with the old model grabbing the password still gave you access to all services; this is definitely not a degradation of security from before.

drivebyacct2 15y ago

No... These passwords will not work as login on Google's website. I just generated a one-time-use password. You can not use it to login on Google.com properties. """ Please use your account password instead of an application-specific password. """ And obviously it will then prompt for your OTOP. Again, this is absolutely no worse than someone getting your Google Account password anyway... and even if they do, they can only use it for select things that are allowed to be used via one-time-use passwords - it's just that we happen to be discussing email and IMAP is a rather large exception. Presumably this isn't the case for other Google services. (Uh, guys, did you have a different experience or something?)

mapgrep 15y ago
I didn't say the passwords would actually log you in, just that they can be used across all services, they cannot be for example limited to mail as the person I was responding to stated. So you could use an app specific password across Google's various APIs and app accessible content - Talk/Gchat/Jabber, Blogger, YouTube, Picasa, Reader, and so forth, there's a fuller list in the docs for two-factor auth. (I have personally made app specific passwords for IMAP, Jabber and Reader, and I used to use a third party client to post to Blogger - the passwords are interchangable.) (I'm not the one who downvoted you, by the way, so I can only guess at why.)