5 ms·

I don't understand: Why on earth does google want to sync MFA tokens? They're one-time use, aren't they? Or... feh, I can't even fathom

jeremyjh 3y ago
They mean they are syncing the private key used to generate the tokens on demand.
- magospietato 3y ago
  Well that's even worse isn't it?
- kerblang 3y ago
  Do all these 2FA apps - like say Microsoft Authenticator - have these hidden/not-so-hidden private keys? From other posts it sounds like you can view the token and write it down... MA doesn't have that, I don't think.
  - kerblang 3y ago
    Answering myself again, yeah, they all seem to have this private key hidden away somewhere. Didn't know that. https://frontegg.com/blog/authentication-apps#How-Do-Authenticator-Apps-Work https://frontegg.com/blog/authentication-apps#How-Do-Authent...?
  - e12e 3y ago
    TOTP (Time-based one-time password) need a shared secret (and two synchronized clocks) to work, so yes. FIDO2/WebAuthn relies on public key technology - so does also have a secret key - but is designed to be kept secret from the service/server one authenticates against. For use - FIDO2 is more like a multi-use id. Like a driver's license many services accept as id. If you lose it - you don't restore a backup copy from a safe - you use your passport until you get a new one issued. This makes more sense than with TOTP as the services only need your public key(id) on file. https://en.wikipedia.org/wiki/Time-based_One-time_Password https://en.wikipedia.org/wiki/Time-based_One-time_Password https://en.m.wikipedia.org/wiki/WebAuthn https://en.m.wikipedia.org/wiki/WebAuthn
    - rawgabbit 3y ago
      Which FIDO2 service do you recommend? I get tired reading all these security articles. The more I read, the more I feel they are hiding something.
      - e12e 3y ago
        > Which FIDO2 service do you recommend? Generally what comes with your phone and one or two hw tokens for backup? Looks like token2.com is a reasonable choice if you just want NFC/USBc and FIDO2 (and not storage for ssh/gpg keys). But I have little experience with hw keys.
        drhuseynov 3y ago
        ssh and pgp keys are not based on the similar functionality. the keys from Token2 support *-sk key storage https://www.token2.com/site/page/using-token2-fido2-security-keys-for-openssh https://www.token2.com/site/page/using-token2-fido2-security... But not PGP
        e12e 3y ago
        Thank you for the reminder that ssh now has FIDO2 support!
kerblang 3y ago
Answering myself, this helps a bit: https://www.zdnet.com/article/google-authenticator-will-now-sync-your-2fa-codes-to-use-on-different-devices/ https://www.zdnet.com/article/google-authenticator-will-now-... I guess we need a better way to handle "Old phone went swimming, had to buy another, now what?"
- mbesto 3y ago
  Which is funny because the 2nd factor is "something I have", which means if you don't "have it" then you can ever complete the 2nd factor. This ultimately means the 2nd factor, when you're phone goes swimming, is ultimately your printed codes.
unethical_ban 3y ago
Syncing of "MFA codes" is really syncing of the secret component of TOTP (time based one time password). And it's a good thing, and damn any 2fa solution that blocks it. I don't want to go through onerous, incompetent, poorly designed account recovery procedures if a toddler smashes my phone. So I use authy personally, while a friend backs his up locally.
- skybrian 3y ago
  A better way to fix this is to have multiple ways to log in. Printed backup codes in your safe with your personal papers and/or a Yubikey on your keychain. This works for Google and Github, at least. Passkey syncing is more convenient, though, and probably an improvement on what most people do.
- itake 3y ago
  > I don't want to go through onerous, incompetent, poorly designed account recovery procedures if a toddler smashes my phone Why don't you use the printed recovery tokens?
  - monocasa 3y ago
    Who has a printer these days?
    - CameronNemo 3y ago
      Local libraries, print shops... but yeah that may be an attack vector.
  - unethical_ban 3y ago
    Not all websites offer them. Hell, no bank I use (several large and several regional) support generic totp. Some have sms, one has Symantec VIP, proprietary and not redundant. Edit: since I'm posting too fast according to HN, even though I haven't posted in an hour, I'll say it here. Symantec is totp but You cannot back up your secrets and you cannot have backup codes.
AshamedCaptain 3y ago
For me the question is "who the fsck uses Google Authenticator to store all their tokens, both company and personal?"
- burkaman 3y ago
  Google Authenticator was I believe the first available TOTP app, and is by far the most popular. It used to be open source and have no connection to your Google account. Many people installed it years ago when they first set up MFA, and have just been adding stuff to it ever since because it's easy and it works. Even for technical users who understand how TOTP works, there is no obvious reason it appears unsafe to put all your tokens in the app (until you read this article). Look at the MFA help page for any website you use. One of the first sentences is probably something like "First you'll need to install a TOTP app on your phone, such as Google Authenticator or Authy..." It really did used to be the best option. For example, see this comment from 10 years ago when Authy first launched: > The Google Authenticator app is great. I recently got (TOTP) 2-factor auth for an IRC bot going with Google Authenticator; took about 5 minutes to code it up and set it up. It doesn't use any sort of 3rd party service, just the application running locally on my phone. TOTP/HOTP is dead simple and, with the open source Google Authenticator app, great for the end user. - https://news.ycombinator.com/item?id=6137051 https://news.ycombinator.com/item?id=6137051
  - fireflash38 3y ago
    I think technically Blizzard Authenticator (even the app) was available before Google Authenticator, but obviously for extremely limited use.
  - glandium 3y ago
    Also, since it doesn't allow to extract the private keys, you're kind of stuck with it once you've started using it.

jeremyjh 3y ago

They mean they are syncing the private key used to generate the tokens on demand.

magospietato 3y ago
Well that's even worse isn't it?
kerblang 3y ago
Do all these 2FA apps - like say Microsoft Authenticator - have these hidden/not-so-hidden private keys? From other posts it sounds like you can view the token and write it down... MA doesn't have that, I don't think.
- kerblang 3y ago
  Answering myself again, yeah, they all seem to have this private key hidden away somewhere. Didn't know that. https://frontegg.com/blog/authentication-apps#How-Do-Authenticator-Apps-Work https://frontegg.com/blog/authentication-apps#How-Do-Authent...?
- e12e 3y ago
  TOTP (Time-based one-time password) need a shared secret (and two synchronized clocks) to work, so yes. FIDO2/WebAuthn relies on public key technology - so does also have a secret key - but is designed to be kept secret from the service/server one authenticates against. For use - FIDO2 is more like a multi-use id. Like a driver's license many services accept as id. If you lose it - you don't restore a backup copy from a safe - you use your passport until you get a new one issued. This makes more sense than with TOTP as the services only need your public key(id) on file. https://en.wikipedia.org/wiki/Time-based_One-time_Password https://en.wikipedia.org/wiki/Time-based_One-time_Password https://en.m.wikipedia.org/wiki/WebAuthn https://en.m.wikipedia.org/wiki/WebAuthn
  - rawgabbit 3y ago
    Which FIDO2 service do you recommend? I get tired reading all these security articles. The more I read, the more I feel they are hiding something.
    - e12e 3y ago
      > Which FIDO2 service do you recommend? Generally what comes with your phone and one or two hw tokens for backup? Looks like token2.com is a reasonable choice if you just want NFC/USBc and FIDO2 (and not storage for ssh/gpg keys). But I have little experience with hw keys.
      - drhuseynov 3y ago
        ssh and pgp keys are not based on the similar functionality. the keys from Token2 support *-sk key storage https://www.token2.com/site/page/using-token2-fido2-security-keys-for-openssh https://www.token2.com/site/page/using-token2-fido2-security... But not PGP
        e12e 3y ago
        Thank you for the reminder that ssh now has FIDO2 support!

kerblang 3y ago

Answering myself, this helps a bit: https://www.zdnet.com/article/google-authenticator-will-now-sync-your-2fa-codes-to-use-on-different-devices/ https://www.zdnet.com/article/google-authenticator-will-now-... I guess we need a better way to handle "Old phone went swimming, had to buy another, now what?"

mbesto 3y ago
Which is funny because the 2nd factor is "something I have", which means if you don't "have it" then you can ever complete the 2nd factor. This ultimately means the 2nd factor, when you're phone goes swimming, is ultimately your printed codes.

unethical_ban 3y ago

Syncing of "MFA codes" is really syncing of the secret component of TOTP (time based one time password). And it's a good thing, and damn any 2fa solution that blocks it. I don't want to go through onerous, incompetent, poorly designed account recovery procedures if a toddler smashes my phone. So I use authy personally, while a friend backs his up locally.

skybrian 3y ago
A better way to fix this is to have multiple ways to log in. Printed backup codes in your safe with your personal papers and/or a Yubikey on your keychain. This works for Google and Github, at least. Passkey syncing is more convenient, though, and probably an improvement on what most people do.
itake 3y ago
> I don't want to go through onerous, incompetent, poorly designed account recovery procedures if a toddler smashes my phone Why don't you use the printed recovery tokens?
- monocasa 3y ago
  Who has a printer these days?
  - CameronNemo 3y ago
    Local libraries, print shops... but yeah that may be an attack vector.
- unethical_ban 3y ago
  Not all websites offer them. Hell, no bank I use (several large and several regional) support generic totp. Some have sms, one has Symantec VIP, proprietary and not redundant. Edit: since I'm posting too fast according to HN, even though I haven't posted in an hour, I'll say it here. Symantec is totp but You cannot back up your secrets and you cannot have backup codes.

AshamedCaptain 3y ago

For me the question is "who the fsck uses Google Authenticator to store all their tokens, both company and personal?"

burkaman 3y ago
Google Authenticator was I believe the first available TOTP app, and is by far the most popular. It used to be open source and have no connection to your Google account. Many people installed it years ago when they first set up MFA, and have just been adding stuff to it ever since because it's easy and it works. Even for technical users who understand how TOTP works, there is no obvious reason it appears unsafe to put all your tokens in the app (until you read this article). Look at the MFA help page for any website you use. One of the first sentences is probably something like "First you'll need to install a TOTP app on your phone, such as Google Authenticator or Authy..." It really did used to be the best option. For example, see this comment from 10 years ago when Authy first launched: > The Google Authenticator app is great. I recently got (TOTP) 2-factor auth for an IRC bot going with Google Authenticator; took about 5 minutes to code it up and set it up. It doesn't use any sort of 3rd party service, just the application running locally on my phone. TOTP/HOTP is dead simple and, with the open source Google Authenticator app, great for the end user. - https://news.ycombinator.com/item?id=6137051 https://news.ycombinator.com/item?id=6137051
- fireflash38 3y ago
  I think technically Blizzard Authenticator (even the app) was available before Google Authenticator, but obviously for extremely limited use.
- glandium 3y ago
  Also, since it doesn't allow to extract the private keys, you're kind of stuck with it once you've started using it.