7 ms·

Google is better than all other alternatives in that regard. They have a feature called Advanced Protection where you add your 2FA U2F keys and if you lose them

Google is better than all other alternatives in that regard. They have a feature called Advanced Protection where you add your 2FA U2F keys and if you lose them your account is gone. No social engineering possible. https://landing.google.com/advancedprotection/ https://landing.google.com/advancedprotection/

pinum 5y ago
“If you lose your key and are still signed in on one of your devices, visit account.google.com to add or replace a key. Otherwise, submit a request to recover your account. Google may take a few days to verify that it’s you and restore your access.” I trust that it would be (potentially much) harder than normal, but it still seems to be possible.
- cinntaile 5y ago
  I was under the impression you were screwed in that case, thanks for pointing out that I was wrong. It's lot less secure than I thought.
  - withinboredom 5y ago
    IIRC, Google will stop the "several day process" if you log in at any time.
  - someguydave 5y ago
    Still sounds like a significant barrier to most phishing attacks.
    - cinntaile 5y ago
      A little bit. It's mostly a time delay, since the alternatives to verify your identity seem to be a different emailaddress or a phone number and then you're back to square one imo. The phone number is still susceptible to social engineering and the alternative mail likely is too. Ideally I want something where keys gone = account gone. Now a dedicated scammer could still succeed and it sure doesn't provide any real safety for political groups which Google kind of claims it does by using testimonies from politically vulnerable people to "advertise" the Advanced Protection Program. This is a tricky situation though since your adversaries could get your keys and your password and then they control your account without any chance of getting it back, so it's definitely a double edged sword.
      - Marsymars 5y ago
        > It's mostly a time delay, since the alternatives to verify your identity seem to be a different emailaddress or a phone number and then you're back to square one imo. The phone number is still susceptible to social engineering and the alternative mail likely is too. Ideally I want something where keys gone = account gone. I can think of options less extreme than keys gone = account gone that are still very secure. e.g. To enable "Extra Advanced Protection" you have to visit Google HQ in your region, where your DNA is sampled. If you ever need to recover your account, you have to visit Google HQ again for another DNA sample, after which you're provided with account access, in person.
        darkwater 5y ago
        > DNA sample and who's gonna pay for that? Seems pricey and doesn't scale exactly well.
        cinntaile 5y ago
        Definitely also a good, but still very extreme option. This might actually be more secure, depending on the threats you have to take into account. It would be possible to retrieve the account after a (physical) hack.
        someguydave 5y ago
        Just showing up in person by itself (with a stored photograph and maybe audio recording) is a pretty high barrier.
      - someguydave 5y ago
        I presume in this scenario you would have multiple keys and multiple backup accounts, so fallback to a likewise secured account is reasonable.
josephcsible 5y ago
> if you lose them your account is gone IMO, this is way too extreme for almost everybody. There needs to be some sort of happy medium so that a person who's lost everything they own (e.g., house fire) can get their account back somehow still. Two ideas I had: 1. When you set up your account, provide your legal name, date of birth, and a photo. If you need to reset 2FA, go somewhere in person with a government-issued photo ID (which we already have procedures to replace) that all of the details of match. 2. When you set up your account, provide 5 trusted contacts. If you need to reset 2FA, get 3 of them to agree.
- lotsofpulp 5y ago
  >If you need to reset 2FA, go somewhere in person with a government-issued photo ID (which we already have procedures to replace) that all of the details of match. Very few people are going to want to pay for this labor if the perception of risk of using a free account is as low as it is now.
  - josephcsible 5y ago
    What about giving people a choice like this to pay for the labor? Either pay $1 per month for your account, and then this service is free for you whenever you need it, or have a free account, but then this service costs you $1000 if you ever need it.
    - lotsofpulp 5y ago
      That would be nice, but I imagine there's a perception problem with that. Simply offering the option would bring the risk to the forefront of people's minds, and once you start exchanging money, lots of other thoughts and liabilities begin to enter. If it is kept free, then the conversation ends there.
- jaywalk 5y ago
  If you choose to opt-in to Advanced Protection, you can keep a backup hardware token somewhere outside of your house.
deleted 5y ago
[deleted]
hn_throwaway_99 5y ago
Oddly enough, Google's Advanced Protection is the gold standard in my opinion, yet Firebase Auth, an Auth-as-a-Service product from Google, only supports SMS as a second factor, which is baffling to me.

pinum 5y ago

“If you lose your key and are still signed in on one of your devices, visit account.google.com to add or replace a key. Otherwise, submit a request to recover your account. Google may take a few days to verify that it’s you and restore your access.” I trust that it would be (potentially much) harder than normal, but it still seems to be possible.

cinntaile 5y ago
I was under the impression you were screwed in that case, thanks for pointing out that I was wrong. It's lot less secure than I thought.
- withinboredom 5y ago
  IIRC, Google will stop the "several day process" if you log in at any time.
- someguydave 5y ago
  Still sounds like a significant barrier to most phishing attacks.
  - cinntaile 5y ago
    A little bit. It's mostly a time delay, since the alternatives to verify your identity seem to be a different emailaddress or a phone number and then you're back to square one imo. The phone number is still susceptible to social engineering and the alternative mail likely is too. Ideally I want something where keys gone = account gone. Now a dedicated scammer could still succeed and it sure doesn't provide any real safety for political groups which Google kind of claims it does by using testimonies from politically vulnerable people to "advertise" the Advanced Protection Program. This is a tricky situation though since your adversaries could get your keys and your password and then they control your account without any chance of getting it back, so it's definitely a double edged sword.
    - Marsymars 5y ago
      > It's mostly a time delay, since the alternatives to verify your identity seem to be a different emailaddress or a phone number and then you're back to square one imo. The phone number is still susceptible to social engineering and the alternative mail likely is too. Ideally I want something where keys gone = account gone. I can think of options less extreme than keys gone = account gone that are still very secure. e.g. To enable "Extra Advanced Protection" you have to visit Google HQ in your region, where your DNA is sampled. If you ever need to recover your account, you have to visit Google HQ again for another DNA sample, after which you're provided with account access, in person.
      - darkwater 5y ago
        > DNA sample and who's gonna pay for that? Seems pricey and doesn't scale exactly well.
      - cinntaile 5y ago
        Definitely also a good, but still very extreme option. This might actually be more secure, depending on the threats you have to take into account. It would be possible to retrieve the account after a (physical) hack.
      - someguydave 5y ago
        Just showing up in person by itself (with a stored photograph and maybe audio recording) is a pretty high barrier.
    - someguydave 5y ago
      I presume in this scenario you would have multiple keys and multiple backup accounts, so fallback to a likewise secured account is reasonable.

josephcsible 5y ago

> if you lose them your account is gone IMO, this is way too extreme for almost everybody. There needs to be some sort of happy medium so that a person who's lost everything they own (e.g., house fire) can get their account back somehow still. Two ideas I had: 1. When you set up your account, provide your legal name, date of birth, and a photo. If you need to reset 2FA, go somewhere in person with a government-issued photo ID (which we already have procedures to replace) that all of the details of match. 2. When you set up your account, provide 5 trusted contacts. If you need to reset 2FA, get 3 of them to agree.

lotsofpulp 5y ago
>If you need to reset 2FA, go somewhere in person with a government-issued photo ID (which we already have procedures to replace) that all of the details of match. Very few people are going to want to pay for this labor if the perception of risk of using a free account is as low as it is now.
- josephcsible 5y ago
  What about giving people a choice like this to pay for the labor? Either pay $1 per month for your account, and then this service is free for you whenever you need it, or have a free account, but then this service costs you $1000 if you ever need it.
  - lotsofpulp 5y ago
    That would be nice, but I imagine there's a perception problem with that. Simply offering the option would bring the risk to the forefront of people's minds, and once you start exchanging money, lots of other thoughts and liabilities begin to enter. If it is kept free, then the conversation ends there.
jaywalk 5y ago
If you choose to opt-in to Advanced Protection, you can keep a backup hardware token somewhere outside of your house.

deleted 5y ago

[deleted]

hn_throwaway_99 5y ago

Oddly enough, Google's Advanced Protection is the gold standard in my opinion, yet Firebase Auth, an Auth-as-a-Service product from Google, only supports SMS as a second factor, which is baffling to me.