8 ms·
New version of Google Authenticator is a new app, old one won't update
- nl 15y agoThe speculation is that someone lost the signing key. Oh the irony...
- jameswyse 15y agoNew app is here: https://play.google.com/store/apps/details?id=com.google.android.apps.authenticator2 https://play.google.com/store/apps/details?id=com.google.and...
- andrewpi 15y agoSo the new version of Authenticator can apparently import the credentials from the old version. I don't know much about Android security, but if Google lost the signing key, would they still be able to import from the old app?
- devicenull 15y agoThe credentials are stored in plaintext on your phone. You can trivially extract them with a backup of your phone and a SQLite database editor.
- piggity 15y agoAre these credentials all that are needed to impersonate your authenticator? This seems "bad" - as I'd personally expect there to be no "magic" data migration path between different apps. There should be a confirmation step from the security manager at least.
- andrewpi 15y agoI'm familiar with the 'extract from a backup' vulnerability for any information stored on Android. However, I'm more concerned that another (non root-privileged) app can access credentials without confirmation.
- skeletonjelly 15y agoI believe you'd need a rooted device for it to access another app's files, and even then you should get a popup prompting for access.
- trotsky 15y agoWell, you can't say the chinese aren't persistent.
- dazbradbury 15y agoI have a few apps in the marketplace that I made on my old pc years ago. The keys I used to sign the apps weren't lost, unfortunately, the original Android eclipse plugin was signing my apps as part of my build process (I think they have fixed that now). I wiped the machine, and hey presto, I can't update those apps anymore. I was shocked there was no workaround, and it seems Google have been hit by this now also. At least they're sticking to their own policy I guess, I'm sure they could update the app if they really wanted to.
- r00fus 15y agoWouldn't it be impossible for them (assuming proper PKI implementation) for them to regenerate the signing key once lost? ie, you lose it, it's gone... the way it should be.
- sk5t 15y agoProper PKI doesn't exclude key escrow... but Google would have little interest in trying to support the process to keep that secure.
- deleted 15y ago[deleted]
- tedunangst 15y agoCan you explain some more? You lost the keys or you didn't? If you didn't, why can't you sign the apps?
- dazbradbury 15y agoSorry, let me elaborate. I have the keys I purposefully signed the apps with. I would export the apk from eclipse, and sign it, submit it. However, as part of the eclipse build, eclipse was signing the apk. Therefore it ended up signed by TWO keys. When I re-installed eclipse, this hidden key that I wasn't aware of was lost. I couldn't submit to the Android market without the app being signed by BOTH keys. That is what I found strange...