4 ms·
Oh I'm seething. Screw google, so god damn much. They've been accidentally enabling it for nearly a month if not more. And the UX has been infinitely confusing
by k8svet 3y ago
Oh I'm seething. Screw google, so god damn much.
They've been accidentally enabling it for nearly a month if not more. And the UX has been infinitely confusing. I've been using 2fa for a decade (not an exaggeration, an understatement). I've been using u2f since the first month it was available and FUCK Google for this blog post.
A month ago I logged in and tried to check on my security tokens. Their UI was silently upconverting them. Without telling me. And the flow made it look like it was just deleting them. Hours later I realize it had re-enrolled them AND IT LOST THE DESCRIPTION I GAVE TO THEM. To be clear, it trashedt the decription I gave them during (what I didn't know at the time) was re-enrolling them as passkeys, because i sure as hell wansnt in the passkeys area. So not only did I inadvertently change them, they're now indistinguishable and unidentifiable to me. So if I want to ensure my primary and backup tokens are enrolled properly , I have to do it all over again, with all of them in my possession
Seriously, I have defended google against all sort of claims with respect to their 2FA and they can absolutely get up their own after what they pulled, and now this blog post.
Do some god damn basic (user) testing FFS. I would literally pay $1000usd right this second to scream at the people who green-lit and implemented this. And another $1000usd to ensure to people here that I know DAMN WELL what I'm talking about here. It's not like I don't have video evidence of exactly what I'm stating here on an unlisted YT video tweeted at Google Security.
Edit2: to be VERY clear, I have a video I reviewed, just now, that shows me trying to enroll an existing Security Token with a description, it disappearing, it then appearing as a Passkey with no description.
- sillysaurusx 3y agoYour comment would be more impactful if it explained clearly what the problem is. What does it mean to upconvert a security token? In fact, what’s a security token? (I ask mainly so that I can watch out for whatever bit you. On the face of it, the blog post seems pretty anodyne. The screenshot shows that it’s optional, not forced, since there’s a "not now" button.) EDIT: oh, they auto converted your security keys to passkeys? With no option to roll back? Yeah, that’s not great. https://support.google.com/accounts/answer/6103523?hl=en&co=GENIE.Platform%3DAndroid https://support.google.com/accounts/answer/6103523?hl=en&co=...
- k8svet 3y agoI'm sorry, I'm not laughing at you, I'm laughing at the premise of Google acknowledging this, let alone fixing it properly enough to have a "rollback". As far as I call tell, my physical yubikeys that went though this process have continued working with the same ultimate user experience, thank God. Minus the 45 minutes where I thought I was locking myself out due to them disappearing from the ending landing page that listed my enrolled Security Tokens, due to the buggy upgrade UX flow or the fact that I have no way of confirming which of my primary/secondary tokens are now actually enrolled because it trashed my descriptions during this upgrade. I am actually infinitely sorry at the times I openly questioned user error when people expressed Kafka-esque nightmares wrt to google auth. I'm actually quite annoyed at myself for ever doubting them.
- rzzzt 3y ago"Not forced" would mean the dialog has a "Nope", "Not" or "Nuh uh" button instead of "Not now" and permanently goes away when clicked, never to return.