3 ms·
> It’s still required to complete authentication. As I understand, if an attacker gains root access to your phone (or if an attacker is Google) then they can b
by codedokode 4y ago
> It’s still required to complete authentication.
As I understand, if an attacker gains root access to your phone (or if an attacker is Google) then they can bypass any biometric locks, export private keys protected with a PIN and bruteforce the PIN. Phones allow exporting keys to sync them between devices via Google cloud. So Google or their friends from government can bruteforce PINs for backups stored in their cloud.
Please correct me if I am wrong, but this looks like a single factor.
- mynameisvlad 4y agoSo they have something you own, they broke into your phone, and they have something you know, they brute forced your PIN. How is that not still 2FA? If someone breaks into your computer and you happen to have written down all your 2FA setup codes in a text file, you’re still using 2FA even though they now have access to your codes. I don’t fully know the mechanics of the Secure Enclave or Android equivalent but I would be surprised if it allowed exporting private keys without some form of authentication, separate from unlocking your phone. You have to reauthenticate each time you use your passkey, likely on purpose.