6 ms·

It's a tradeoff. They could let (or require) a password be entered to encrypt/decrypt it on each device, but then people would be ticked off when they forget th

by patmcc 3y ago

It's a tradeoff. They could let (or require) a password be entered to encrypt/decrypt it on each device, but then people would be ticked off when they forget their password and can't recover their 2FA stuff. They should have handled it the same way they do Sync in chrome, and I expect they will eventually. But, as always, unless a service advertises that it's full E2EE and you can verify that, assume it's not. One part of this that's funny to me: >>>Also, 2FA QR codes typically contain other information such as account name and the name of the service (e.g. Twitter, Amazon, etc). Since Google can see all this data, it knows which online services you use, and could potentially use this information for personalized ads. I guarantee you, Google knows which online services you use in about 800 other ways, it doesn't need to scrape it from your 2FA accounts.

jxy 3y ago
The problem is now they know your TOTP secrets, they are only one password away from pretending to be you. And actually, they serve you emails, so password is moot for most of the sites today.
- koolba 3y ago
  They always knew your TOTP secrets. The algorithm requires both parties to know the plaintext secret as it’s an input to the HMAC. It’s not a public key operation and they can’t store it as a hashed representation. It’s possible to have 2FA methods that are verify only (usually using public keys and signing), but TOTP is not one of them.
  - MereInterest 3y ago
    The website you log into with TOTP has always known the TOTP secret. Now, Google also knows your TOTP secret.
    - koolba 3y ago
      Ah! I misunderstood this being applied to non-Google accounts. Yes that’s scary.
trickstra 3y ago
I don't think Google will use those secrets to look into your other accounts, but they can be politely requested by some governments to divulge the secrets, and not tell you about it. Then those governments would have no problems looking into your other accounts. And I'm not talking only about the US government, other governments can have dubious standards for requesting user data, such as failure to parrot the "facts" approved by their ministry of truth (China, Russia, and everyone in their sphere). Not to mention Google can be hacked.
- TaylorAlexander 3y ago
  I appreciate this. A lot of people think your tech is between you and the provider, but they forget about the governments that have power over those providers.
- buran77 3y ago
  > I don't think Google will use those secrets to look into your other accounts, but they can be politely requested by some governments to divulge the secrets, and not tell you about it A lot of companies and institutions use GA for 2FA for their secure systems too. Google doesn't even need to willingly share, as soon as the possibility of extracting the data is there they paint a target on it. External attacks are now extremely low hanging fruit with that unencrypted traffic. And internal attacks like getting an employee with access to that unencrypted data to provide it (knowingly or unknowingly) are relatively low effort and don't require the overhead of any legal proceedings or complex exploits. And if this goes through official/legal channels, Google doesn't have one single shred of protection between that data and what authorities can (shockingly legally) ask for. Having the data is a liability for Google. Transferring it insecurely is also a liability for the user.
- webmobdev 3y ago
  Exactly - one of the major reason American BigTech is so invasive today in collecting our personal data is because the US government has shown them how valuable it is for them. Project PRISM has evolved and is huge success ...
makeitdouble 3y ago
> Google knows TBF knowing which online service you bothered to activate 2FA on is an information a lot more interesting than which mailing list you forgot to unsubscribe for instance. Now I don't think they'd use if for ads, I'd assume it would probably be more long term, like knowing which service to buy next, or where the trends are going.
ddalex 3y ago
The whole writeup seems like missing the forest for the trees - Google as root access on the Android device where this app runs, so they can certainly see everything if they want ....
- mschuster91 3y ago
  Google pushing malicious updates would leave forensic traces, not to mention it'd be difficult to establish a legal framework allowing a government to force Google to do so. In contrast, subpoena'ing data from the cloud is routine for police in countries all over the world.
  - PradeetPatel 3y ago
    This may sound like a naive question, but what stops countries with flexible ethical standards from abusing this power? For example, in the past I've worked with an AI company with presence in China, where the data of their Chinese clientele must be stored on a separate data centre operated by a local enterprise. Despite the provider being ISO compliant and holds internationally recognised certs, is there realistically a chance that those data could be accessed without the permission or consent of the users?
    - v4dok 3y ago
      Depends on your threat model. Practically, the cloud admin would be able to dump that data in clear during processing even if that data is encrypted at rest and in transit.
  - ddalex 3y ago
    So your threat model is a sovereign state able to subpoena cloud data. Under this model, if Google gets a court order to root-break a specific phone (push malicious update), they will be forced to, and that's all the legal framework necessary, so end-to-end encryption doesn't protect you in this case either.
    - 3y ago
ajvs 3y ago
> Google know www.reddit.com/r/degoogle
- deleted 3y ago
  [deleted]
tinus_hn 3y ago
So because things are hard, you just reduce 2fa to 2 of the same factors. And make it worthless. It’s typically not a disaster if you lose the 2fa keys and if it is, you should carefully save the recovery codes. But the keys get lost all the time so just about every service has a recovery procedure. So there is no need to store the secrets in such a way they can be recovered without the password.
hammyhavoc 3y ago
Is decrypting via a password literally not how Authy, BitWarden et al handle it?

by patmcc 3y ago

jxy 3y ago

The problem is now they know your TOTP secrets, they are only one password away from pretending to be you. And actually, they serve you emails, so password is moot for most of the sites today.

koolba 3y ago
They always knew your TOTP secrets. The algorithm requires both parties to know the plaintext secret as it’s an input to the HMAC. It’s not a public key operation and they can’t store it as a hashed representation. It’s possible to have 2FA methods that are verify only (usually using public keys and signing), but TOTP is not one of them.
- MereInterest 3y ago
  The website you log into with TOTP has always known the TOTP secret. Now, Google also knows your TOTP secret.
  - koolba 3y ago
    Ah! I misunderstood this being applied to non-Google accounts. Yes that’s scary.

trickstra 3y ago

I don't think Google will use those secrets to look into your other accounts, but they can be politely requested by some governments to divulge the secrets, and not tell you about it. Then those governments would have no problems looking into your other accounts. And I'm not talking only about the US government, other governments can have dubious standards for requesting user data, such as failure to parrot the "facts" approved by their ministry of truth (China, Russia, and everyone in their sphere). Not to mention Google can be hacked.

TaylorAlexander 3y ago
I appreciate this. A lot of people think your tech is between you and the provider, but they forget about the governments that have power over those providers.
buran77 3y ago
> I don't think Google will use those secrets to look into your other accounts, but they can be politely requested by some governments to divulge the secrets, and not tell you about it A lot of companies and institutions use GA for 2FA for their secure systems too. Google doesn't even need to willingly share, as soon as the possibility of extracting the data is there they paint a target on it. External attacks are now extremely low hanging fruit with that unencrypted traffic. And internal attacks like getting an employee with access to that unencrypted data to provide it (knowingly or unknowingly) are relatively low effort and don't require the overhead of any legal proceedings or complex exploits. And if this goes through official/legal channels, Google doesn't have one single shred of protection between that data and what authorities can (shockingly legally) ask for. Having the data is a liability for Google. Transferring it insecurely is also a liability for the user.
webmobdev 3y ago
Exactly - one of the major reason American BigTech is so invasive today in collecting our personal data is because the US government has shown them how valuable it is for them. Project PRISM has evolved and is huge success ...

makeitdouble 3y ago

> Google knows TBF knowing which online service you bothered to activate 2FA on is an information a lot more interesting than which mailing list you forgot to unsubscribe for instance. Now I don't think they'd use if for ads, I'd assume it would probably be more long term, like knowing which service to buy next, or where the trends are going.

ddalex 3y ago

The whole writeup seems like missing the forest for the trees - Google as root access on the Android device where this app runs, so they can certainly see everything if they want ....

mschuster91 3y ago
Google pushing malicious updates would leave forensic traces, not to mention it'd be difficult to establish a legal framework allowing a government to force Google to do so. In contrast, subpoena'ing data from the cloud is routine for police in countries all over the world.
- PradeetPatel 3y ago
  This may sound like a naive question, but what stops countries with flexible ethical standards from abusing this power? For example, in the past I've worked with an AI company with presence in China, where the data of their Chinese clientele must be stored on a separate data centre operated by a local enterprise. Despite the provider being ISO compliant and holds internationally recognised certs, is there realistically a chance that those data could be accessed without the permission or consent of the users?
  - v4dok 3y ago
    Depends on your threat model. Practically, the cloud admin would be able to dump that data in clear during processing even if that data is encrypted at rest and in transit.
- ddalex 3y ago
  So your threat model is a sovereign state able to subpoena cloud data. Under this model, if Google gets a court order to root-break a specific phone (push malicious update), they will be forced to, and that's all the legal framework necessary, so end-to-end encryption doesn't protect you in this case either.
  - 3y ago

ajvs 3y ago

> Google know www.reddit.com/r/degoogle

deleted 3y ago
[deleted]

tinus_hn 3y ago

So because things are hard, you just reduce 2fa to 2 of the same factors. And make it worthless. It’s typically not a disaster if you lose the 2fa keys and if it is, you should carefully save the recovery codes. But the keys get lost all the time so just about every service has a recovery procedure. So there is no need to store the secrets in such a way they can be recovered without the password.

hammyhavoc 3y ago

Is decrypting via a password literally not how Authy, BitWarden et al handle it?