4 ms·

Isn't Google already doing this? http://googleblog.blogspot.com/2011/02/advanced-sign-in-security-for-your.html http://googleblog.blogspot.com/2011/02/advanced-

Isn't Google already doing this? http://googleblog.blogspot.com/2011/02/advanced-sign-in-security-for-your.html http://googleblog.blogspot.com/2011/02/advanced-sign-in-secu...

joebadmo 15y ago
Yes, and it's a bit of a hassle, but does provide some peace of mind. I remember that when my wife was in school in the Netherlands, her bank there gave her a fob that created a second factor for sign in, too.
ChuckMcM 15y ago
No, if they were then you wouldn't have to type extra numbers into your browser. That seems kind of like a 'nit', I know, but if we learned anything from Steve Jobs it is that there is a difference between providing an answer and providing a solution. The elements that will be present in a solution include; 1) You won't have to type anything else, a program will have an API which can definitively tell it you are making this request or you are not. 2) The 'key' won't be anything else, it won't be an app on your phone or a plug-in to your browser. 3) It will work with any service you care to use it with and if it has not been implemented there will be no legal/enumberance/techincal barriers to doing so. 4) It will not degrade your privacy options. Google's two factor authentication fails on a number of these, not the least of which that it requires that you own a 'smart phone' which is something my father in law will never do before he dies. So no, Google doesn't do this yet.
- RockyMcNuts 15y ago
  just a nit, but you only need a mobile phone for Google two factor authentication, not a smart phone - can get code by SMS or voice message - http://www.google.com/support/a/bin/answer.py?answer=175197 http://www.google.com/support/a/bin/answer.py?answer=175197 less of a nit - if your browser automatically confirms your identity, whatever token it's based on, the privacy implications may not be completely warm and fuzzy
- joebadmo 15y ago
  Are you serious? As I said elsewhere in this thread, some countries in Europe require you to use a fob that generates another key for your second authorization factor. But you still have to type in extra numbers. How would you get around that? How does the service know that you're in possession of the key unless you give it some kind of input about the key that's unique to the key and to the current time? Personally, I much prefer having it on my smartphone, and this seems like a good approach considering smartphone adoption rate. But Google's 2-factor will sms your dumb phone, too.
  - ChuckMcM 15y ago
    Of course I'm serious. How does the service know that you're in possession of the key unless you give it some kind of input about the key that's unique to the key and to the current time? Lets say you've got a 'fob' which is plugged into a USB port. Application sends the fob a challenge, fob responds. Application validates the response and proceeds. Perhaps the key uses 2.4mhz wireless, perhaps it uses bluetooh (a protocoled 2.4mhz wireless solution :-). The benefit is that these things can only occur when you're key is present. No key, no transaction. We don't worry about Nigerians stealing our cars, but we should consider what they might do with our self-driving cars if we don't have some durable way to say we're in the car right now. I appreciate that you prefer having something like this on your smart phone, but such a solution fails for the larger internet population. And while SMS works for 'dumb' phones you cannot have it validate on every send, every post, every tweet, every page view. You may not share my urgency on this as a threat but I invite you to start to watch more closely. In the Atlantic article a Google representative said "Thousands per day" this is big business for folks. I was talking with a senior executive at Wells Fargo who mentioned hundreds of millions of dollars 'lost' every year. This is a growing problem, its getting more expensive, and like some digital herpes my expectation is that it is going to pop out suddenly in boils of financial putritude dripping pain, financial suffering, and expense for everyone involved. With luck we'll fix it before then but most folks who are getting burned are more interested in covering it up rather than addressing it sadly. I think it would be wonderful to have a possible solution prototyped and demonstrable for people in pain. Your passwords will be compromised, and if you do anything financial online you will have money vanish and you will experience arguing with a bank as to why they should give it back to you and take the loss. This isn't a 1 in 10, or 3 out of 5 type statistic, I'm pretty confident that every single person who has an online account which can tranfer funds (whether its an iTunes account or a checking account) will experience this. 100%.
- deleted 15y ago
  [deleted]
- pyre 15y ago
  > there will be no legal/enumberance/techincal barriers to doing so > it won't be [...] a plug-in to your browser These seem at odds, because you won't have support in older browsers.
  - ChuckMcM 15y ago
    Separate them in time. If the protocol is well documented and there are free source code implementations available then that removes the barriers to implementing it in new systems, and plug-ins or some other form would be needed for older systems but the plug-in itself could be implemented by a third party rather than have to come from the key manufacturer because of the open spec.
- maximusprime 15y ago
  You can use Google 2 factor with a land line, or cellphone. They call it, and tell you the auth code. 1) Try to login 2) Google calls your phone and says the auth code 3) Type it in I think that works pretty well...

Isn't Google already doing this? http://googleblog.blogspot.com/2011/02/advanced-sign-in-security-for-your.html http://googleblog.blogspot.com/2011/02/advanced-sign-in-secu...

joebadmo 15y ago

Yes, and it's a bit of a hassle, but does provide some peace of mind. I remember that when my wife was in school in the Netherlands, her bank there gave her a fob that created a second factor for sign in, too.

ChuckMcM 15y ago

No, if they were then you wouldn't have to type extra numbers into your browser. That seems kind of like a 'nit', I know, but if we learned anything from Steve Jobs it is that there is a difference between providing an answer and providing a solution. The elements that will be present in a solution include; 1) You won't have to type anything else, a program will have an API which can definitively tell it you are making this request or you are not. 2) The 'key' won't be anything else, it won't be an app on your phone or a plug-in to your browser. 3) It will work with any service you care to use it with and if it has not been implemented there will be no legal/enumberance/techincal barriers to doing so. 4) It will not degrade your privacy options. Google's two factor authentication fails on a number of these, not the least of which that it requires that you own a 'smart phone' which is something my father in law will never do before he dies. So no, Google doesn't do this yet.

RockyMcNuts 15y ago
just a nit, but you only need a mobile phone for Google two factor authentication, not a smart phone - can get code by SMS or voice message - http://www.google.com/support/a/bin/answer.py?answer=175197 http://www.google.com/support/a/bin/answer.py?answer=175197 less of a nit - if your browser automatically confirms your identity, whatever token it's based on, the privacy implications may not be completely warm and fuzzy
joebadmo 15y ago
Are you serious? As I said elsewhere in this thread, some countries in Europe require you to use a fob that generates another key for your second authorization factor. But you still have to type in extra numbers. How would you get around that? How does the service know that you're in possession of the key unless you give it some kind of input about the key that's unique to the key and to the current time? Personally, I much prefer having it on my smartphone, and this seems like a good approach considering smartphone adoption rate. But Google's 2-factor will sms your dumb phone, too.
- ChuckMcM 15y ago
  Of course I'm serious. How does the service know that you're in possession of the key unless you give it some kind of input about the key that's unique to the key and to the current time? Lets say you've got a 'fob' which is plugged into a USB port. Application sends the fob a challenge, fob responds. Application validates the response and proceeds. Perhaps the key uses 2.4mhz wireless, perhaps it uses bluetooh (a protocoled 2.4mhz wireless solution :-). The benefit is that these things can only occur when you're key is present. No key, no transaction. We don't worry about Nigerians stealing our cars, but we should consider what they might do with our self-driving cars if we don't have some durable way to say we're in the car right now. I appreciate that you prefer having something like this on your smart phone, but such a solution fails for the larger internet population. And while SMS works for 'dumb' phones you cannot have it validate on every send, every post, every tweet, every page view. You may not share my urgency on this as a threat but I invite you to start to watch more closely. In the Atlantic article a Google representative said "Thousands per day" this is big business for folks. I was talking with a senior executive at Wells Fargo who mentioned hundreds of millions of dollars 'lost' every year. This is a growing problem, its getting more expensive, and like some digital herpes my expectation is that it is going to pop out suddenly in boils of financial putritude dripping pain, financial suffering, and expense for everyone involved. With luck we'll fix it before then but most folks who are getting burned are more interested in covering it up rather than addressing it sadly. I think it would be wonderful to have a possible solution prototyped and demonstrable for people in pain. Your passwords will be compromised, and if you do anything financial online you will have money vanish and you will experience arguing with a bank as to why they should give it back to you and take the loss. This isn't a 1 in 10, or 3 out of 5 type statistic, I'm pretty confident that every single person who has an online account which can tranfer funds (whether its an iTunes account or a checking account) will experience this. 100%.
deleted 15y ago
[deleted]
pyre 15y ago
> there will be no legal/enumberance/techincal barriers to doing so > it won't be [...] a plug-in to your browser These seem at odds, because you won't have support in older browsers.
- ChuckMcM 15y ago
  Separate them in time. If the protocol is well documented and there are free source code implementations available then that removes the barriers to implementing it in new systems, and plug-ins or some other form would be needed for older systems but the plug-in itself could be implemented by a third party rather than have to come from the key manufacturer because of the open spec.
maximusprime 15y ago
You can use Google 2 factor with a land line, or cellphone. They call it, and tell you the auth code. 1) Try to login 2) Google calls your phone and says the auth code 3) Type it in I think that works pretty well...