4 ms·

Google has done something similar; they make it hard to use my preferred 2FA app ("Authenticator" for iPhone). In order to add it I had to pick a different thin

Google has done something similar; they make it hard to use my preferred 2FA app ("Authenticator" for iPhone). In order to add it I had to pick a different thing, then add 2FA, then remove the other thing. And even with that, it still tries to get me to authenticate with one of their apps on one of my iThings, de-emphasizing the option to just put in my code. Dunno why these companies are like this, is there a good-faith explanation? Maybe they have a lot of support problems with authenticator apps?

nikanj 3y ago
Getting your app on more phones means more access to data. Not sure if that explanation is good-faith, but that’s the explanation. Same reason all sorts of websites try to force their apps on you
- Maxburn 3y ago
  I can't help but think this is the excuse, anything for another foot in the door to further their adoption.
scq 3y ago
The most likely reason is that TOTP is not phishing resistant.
tallanvor 3y ago
Because 3rd party 2FA apps are inherently untrustworthy. To Google, even Microsoft Authenticator is a security risk because to use it you have to give it the TOTP seed for your account. So Google (and Microsoft) would rather you use their solutions that let them push the prompt to you and ensure that it's a known device responding. It's still not a perfect solution, but it still is a more secure option.
- vinay_ys 3y ago
  Google doesn't trust its own authenticator app as well for high-security situations.
- saagarjha 3y ago
  It's very possible that I have put email on a device that I didn't put my 2FA codes on. It's not always more secure!
- factormeta 3y ago
  hmm, Authenticator is open source (https://github.com/mattrubin/Authenticator https://github.com/mattrubin/Authenticator). 2FA is also available in open source key manager program such as KeePass. When it comes to 2FA, I would rather trust open source apps vs the ones made by Google/MS.
  - jerf 3y ago
    This is a terminology problem the industry is having right now, but I think you're conflating the general concept of 2FA with the specific concept of TOTP-based 2FA. It's not about the open sourceness per se, it's about the fact that a TOTP secret can be shared far and wide, but a push-based 2FA prompt is targeted to a specific device. While this no more than anything else "guarantees" security, it closes down a lot of vectors, especially around TOTP tokens being stolen unknowningly. I'm likely to notice if my device is missing, and while in theory Google's systems can be compromised to redirect the request or duplicate the request or accept false approvals, a lot more of that is under their control, design, and monitoring than a TOTP token out in the wild. I've never really liked TOTP. Its security characteristics aren't really that far off of a password and I've never been convinced it constitutes a true "second factor" as a result. I notice my password manager even has a slot to store them in now, which kind of further proves my point; if my system for storing "things I know" (as opposed to "things I have" and "things I am") can store both my password and my TOTP token, it rather seems as if I've got two "things I know" and not two separate factors. So I'm not even terribly convinced TOTP should be considered a "second factor" anyhow. The attempt to use it to turn devices into a "thing I have" relies too much on the user which rather defeats the purpose. So I kind of hope to see TOTP to slowly but surely not be even considered 2FA at all, which should help resolve this terminology confusion... eventually, sometime in the next decade or so.
    - dolni 3y ago
      TOTP is a significant improvement over passwords, even if you store them in a vault alongside your passwords. Is it as good as a separate dongle or push notification? No, it isn't in terms of device verification. But it is more convenient. Unlike a password, TOTP secrets never have a reason to leave your vault once you have stored them. One thing I dislike about push notifications is the possibility for fatigue attacks. Even if you only get one from an attacker, a fat-finger could provide access to your account. Oops! If you are using a vault properly, even leaking the master password is not enough for an attacker to break in. They also need a copy of the vault. Or they'd need to have compromised a device on which you actively use the password safe (but that's tough to defend against). To me, TOTP seems like a good middle ground. It isn't vendor locked. Unlike biometrics, TOTP secrets can be changed. TOTP gives users the power to choose how secrets are stored and how one-time-passwords are presented.
celeritascelery 3y ago
In order to use OTP with google I had to setup a security key. and then every time I login it will ask for the key, I have to cancel the request in the browser, it will say something went wrong and then let me select the option to use my OTP.
pram 3y ago
They have this app called “Smart Lock” that supposedly can generate login codes, but these literally never work for me. What a joke.

nikanj 3y ago

Getting your app on more phones means more access to data. Not sure if that explanation is good-faith, but that’s the explanation. Same reason all sorts of websites try to force their apps on you

Maxburn 3y ago
I can't help but think this is the excuse, anything for another foot in the door to further their adoption.

scq 3y ago

The most likely reason is that TOTP is not phishing resistant.

tallanvor 3y ago

Because 3rd party 2FA apps are inherently untrustworthy. To Google, even Microsoft Authenticator is a security risk because to use it you have to give it the TOTP seed for your account. So Google (and Microsoft) would rather you use their solutions that let them push the prompt to you and ensure that it's a known device responding. It's still not a perfect solution, but it still is a more secure option.

vinay_ys 3y ago
Google doesn't trust its own authenticator app as well for high-security situations.
saagarjha 3y ago
It's very possible that I have put email on a device that I didn't put my 2FA codes on. It's not always more secure!
factormeta 3y ago
hmm, Authenticator is open source (https://github.com/mattrubin/Authenticator https://github.com/mattrubin/Authenticator). 2FA is also available in open source key manager program such as KeePass. When it comes to 2FA, I would rather trust open source apps vs the ones made by Google/MS.
- jerf 3y ago
  This is a terminology problem the industry is having right now, but I think you're conflating the general concept of 2FA with the specific concept of TOTP-based 2FA. It's not about the open sourceness per se, it's about the fact that a TOTP secret can be shared far and wide, but a push-based 2FA prompt is targeted to a specific device. While this no more than anything else "guarantees" security, it closes down a lot of vectors, especially around TOTP tokens being stolen unknowningly. I'm likely to notice if my device is missing, and while in theory Google's systems can be compromised to redirect the request or duplicate the request or accept false approvals, a lot more of that is under their control, design, and monitoring than a TOTP token out in the wild. I've never really liked TOTP. Its security characteristics aren't really that far off of a password and I've never been convinced it constitutes a true "second factor" as a result. I notice my password manager even has a slot to store them in now, which kind of further proves my point; if my system for storing "things I know" (as opposed to "things I have" and "things I am") can store both my password and my TOTP token, it rather seems as if I've got two "things I know" and not two separate factors. So I'm not even terribly convinced TOTP should be considered a "second factor" anyhow. The attempt to use it to turn devices into a "thing I have" relies too much on the user which rather defeats the purpose. So I kind of hope to see TOTP to slowly but surely not be even considered 2FA at all, which should help resolve this terminology confusion... eventually, sometime in the next decade or so.
  - dolni 3y ago
    TOTP is a significant improvement over passwords, even if you store them in a vault alongside your passwords. Is it as good as a separate dongle or push notification? No, it isn't in terms of device verification. But it is more convenient. Unlike a password, TOTP secrets never have a reason to leave your vault once you have stored them. One thing I dislike about push notifications is the possibility for fatigue attacks. Even if you only get one from an attacker, a fat-finger could provide access to your account. Oops! If you are using a vault properly, even leaking the master password is not enough for an attacker to break in. They also need a copy of the vault. Or they'd need to have compromised a device on which you actively use the password safe (but that's tough to defend against). To me, TOTP seems like a good middle ground. It isn't vendor locked. Unlike biometrics, TOTP secrets can be changed. TOTP gives users the power to choose how secrets are stored and how one-time-passwords are presented.

celeritascelery 3y ago

In order to use OTP with google I had to setup a security key. and then every time I login it will ask for the key, I have to cancel the request in the browser, it will say something went wrong and then let me select the option to use my OTP.

pram 3y ago

They have this app called “Smart Lock” that supposedly can generate login codes, but these literally never work for me. What a joke.