3 ms·

https://landing.google.com/advancedprotection/ https://landing.google.com/advancedprotection/ AFAIK this removes the ability to use a phone prompt as 2fa.

by judge2020 4y ago

madjam002 4y ago
Advanced Protection is nice but practically a non starter or very difficult in a lot of situations, e.g if you're travelling and all of your security keys get stolen and your backup security key is half way across the globe, you'll wish you had 2FA backup codes then.
- toomuchtodo 4y ago
  I have a trusted family member who maintains a copy of all of my recovery codes. In event of disaster, I call and provide a previously shared pass phrase, and recovery codes will be provided. Something to consider depending on your daily driver threat model and tail risk considerations. (frequent international travel while having strong opsec)
  - madjam002 4y ago
    But if you enable Advanced Protection then recovery/backup codes are disabled right? (Maybe I’m wrong) So the only option to have recovery codes available is to not used advanced protection and then have this “Google Prompt” forced on you, which I’d like to disable as it is another physical attack vector which is undesirable especially when travelling.
- remus 4y ago
  > Advanced Protection is nice but practically a non starter or very difficult in a lot of situations, e.g if you're travelling and all of your security keys get stolen and your backup security key is half way across the globe, you'll wish you had 2FA backup codes then. All security is a trade off. For a good chunk of people that is a rare enough occurrence that it is a good trade off for them.
  - madjam002 4y ago
    Yeah for sure, which is why I’m not fussed about not being able to use Advanced Protection because I don’t fit in with their target audience. But I do wish that people on standard accounts could just disable their forced “Google Prompt” authentication method and just use their own 2FA security keys with fallback to backup codes.
    - icf80 4y ago
      Skip password when possible You’ll be able to sign in securely with just a passkey or device prompt.
  - TheNewsIsHere 4y ago
    My only complaint about the tradeoffs made in Google's current implementation of Advanced Protection is that I can't (even if awkwardly and with difficulty) allowlist any given third party OAuth. So, if I want to, say, authenticate my Gmail account with Fastmail or ProtonMail, I can't also be using Advanced Protection. [0] With Google Workspace, admins can allowlist OAuth applications registered with Google APIs for users who use Advanced Protection. Consumer accounts have no such feature. I am not arguing the logic; I understand it. I just wish it were different. I suspect that passkeys are one stepping stone on the road to increasing account security baselines to be more like Advanced Protection, which may ultimately give me what I want one day. Wishful thinking, perhaps. [0] These are OTOH examples, which may not be accurate as of this writing.
  - TeMPOraL 4y ago
    > All security is a trade off. For a good chunk of people that is a rare enough occurrence that it is a good trade off for them. Except most people are operating under a flawed assumption that the trade-off with Google is like a trade-off with any other institution - that is, if the worst happens, you can get a human on the phone, or visit a branch office, and get the issue sorted out. This critical fallback is, unfortunately, missing for Google and many other on-line service providers.
    - joshuamorton 4y ago

https://landing.google.com/advancedprotection/ https://landing.google.com/advancedprotection/ AFAIK this removes the ability to use a phone prompt as 2fa.

madjam002 4y ago

Advanced Protection is nice but practically a non starter or very difficult in a lot of situations, e.g if you're travelling and all of your security keys get stolen and your backup security key is half way across the globe, you'll wish you had 2FA backup codes then.

toomuchtodo 4y ago
I have a trusted family member who maintains a copy of all of my recovery codes. In event of disaster, I call and provide a previously shared pass phrase, and recovery codes will be provided. Something to consider depending on your daily driver threat model and tail risk considerations. (frequent international travel while having strong opsec)
- madjam002 4y ago
  But if you enable Advanced Protection then recovery/backup codes are disabled right? (Maybe I’m wrong) So the only option to have recovery codes available is to not used advanced protection and then have this “Google Prompt” forced on you, which I’d like to disable as it is another physical attack vector which is undesirable especially when travelling.
remus 4y ago
> Advanced Protection is nice but practically a non starter or very difficult in a lot of situations, e.g if you're travelling and all of your security keys get stolen and your backup security key is half way across the globe, you'll wish you had 2FA backup codes then. All security is a trade off. For a good chunk of people that is a rare enough occurrence that it is a good trade off for them.
- madjam002 4y ago
  Yeah for sure, which is why I’m not fussed about not being able to use Advanced Protection because I don’t fit in with their target audience. But I do wish that people on standard accounts could just disable their forced “Google Prompt” authentication method and just use their own 2FA security keys with fallback to backup codes.
  - icf80 4y ago
    Skip password when possible You’ll be able to sign in securely with just a passkey or device prompt.
- TheNewsIsHere 4y ago
  My only complaint about the tradeoffs made in Google's current implementation of Advanced Protection is that I can't (even if awkwardly and with difficulty) allowlist any given third party OAuth. So, if I want to, say, authenticate my Gmail account with Fastmail or ProtonMail, I can't also be using Advanced Protection. [0] With Google Workspace, admins can allowlist OAuth applications registered with Google APIs for users who use Advanced Protection. Consumer accounts have no such feature. I am not arguing the logic; I understand it. I just wish it were different. I suspect that passkeys are one stepping stone on the road to increasing account security baselines to be more like Advanced Protection, which may ultimately give me what I want one day. Wishful thinking, perhaps. [0] These are OTOH examples, which may not be accurate as of this writing.
- TeMPOraL 4y ago
  > All security is a trade off. For a good chunk of people that is a rare enough occurrence that it is a good trade off for them. Except most people are operating under a flawed assumption that the trade-off with Google is like a trade-off with any other institution - that is, if the worst happens, you can get a human on the phone, or visit a branch office, and get the issue sorted out. This critical fallback is, unfortunately, missing for Google and many other on-line service providers.
  - joshuamorton 4y ago