12 ms·

Make Your Email Hacker Proof

186 points by superchink 15y ago

romaniv 15y ago
The article sounds like this requires you to sumbmit a cell number to Gmail. (In fact, I think merely registering an account nowadays requires a number, but I'm not sure about that.) If you think that's the only way to get 2-factor authentication working, you're wrong. If you think there is nothing wrong with your email provider demanding info like cell phone numbers, you're wrong again.
- Atrus6 15y ago
  I don't think there is anything wrong with an email provider asking me for my cell number to send me text messages, how else would they send them? In addition, a cell phone number is NOT required to create a Google account. Sure they ask (and gender is apparently required, I just made an account), but if you leave it blank, they won't complain.
  - romaniv 15y ago
    There is nothing wrong with providers giving you an option to use your number for notifications. However, if we are required to provide phone number for security features that can be implemented without using phones, there are a few things wrong with it. How can this be implemented without using a phone number? Well, the article actually contains one way - pre-shared secret codes that you print out beforehand. There are many others.
gabaix 15y ago
What happens when you travel abroad and your phone does not work? I am wondering if Gmail could implement security questions to avoid cases where the 2-step verification works against the user
- superchink 15y ago
  Firstly, the Google Authenticator application does not require a network connection. See: http://support.google.com/a/bin/answer.py?hl=en&answer=1037451 http://support.google.com/a/bin/answer.py?hl=en&answer=1... If you are planning to be without your phone, you can always disable 2-step verification temporarily: https://support.google.com/accounts/bin/answer.py?hl=en&answer=1064203&topic=1056283&ctx=topic https://support.google.com/accounts/bin/answer.py?hl=en&... Finally, if you lose your phone, you should always have your single-use backup verification codes to allow you to login.
- ninjin 15y ago
  Ironical as it may be and as the author mentioned briefly in the article, "there is an app for that". Google provides an authentication app for at least Android and iOS. I personally put my phone in "airplane mode" for the trip (still waiting for that market changing deal where you can travel easily across the globe and call/use data without being robbed by your provider) then use the authentication app. I also carry my authentication codes during the trip and they should be enough for even a longer trip, if not, I can generate new security codes during the trip using the security codes I already have with me.
  - lallysingh 15y ago
    Also iOS and blackberry: http://support.google.com/accounts/bin/answer.py?hl=en&answer=1066447&ctx=cb&src=cb&cbid=zoooghbwaatq&cbrank=0 http://support.google.com/accounts/bin/answer.py?hl=en&a...
    - icebraining 15y ago
      And since they use a standard (RFC6238), there are third-party application that works with it too. I use a J2ME app on my Symbian phone.
      - bburky 15y ago
        What J2ME app are you using? I ended up porting (really just copying one Java class) part of Google Authenticator to J2ME. It works, but isn't great. What're you using?
raldi 15y ago
What I really want is for the second factor to kick on only in suspicious situations, e.g.: * I'm logging in from a computer that I've never logged in from before * I'm searching my mail history for terms like "password" * I'm opening an email that appears to contain a password-reset link * I'm messing with my mail-forwarding options * I'm accessing messages in bulk But I do not want to have to do second factor just because it's been 31 days since the last time I've done it.
- deleted 15y ago
  [deleted]
- drivebyacct2 15y ago
  Typing a six digit number every 31 days is too much work to add a significant layer of security to a very important account?
  - loverobots 15y ago
    You should clear those cookies quite often. Just saying
  - zobzu 15y ago
    Typing 6 digits every 31 does not add a significant layer of security. 2 factor auth does. And that's different. If one of your devices is stolen, you go reset the pass. As simple as that. Plus, 31 days is a long time for the hacker, so it's not adding all that much security.
    - mseebach 15y ago
      > Plus, 31 days is a long time for the hacker, so it's not adding all that much security. No, but it might well be for the guy who fishes your old harddrive out of a bin.
  - dennisgorelik 15y ago
    It's extra work. Does this expiration after 31 days add any extra protection?
kghose 15y ago
What happens for IMAP accounts? e.g through Mail.app or Thunderbird?
- ninjin 15y ago
  You would use "Application-specific passwords", basically a one-off password used only for your IM or E-mail.
- JangoSteve 15y ago
  It's in the article, but basically you just generate app-specific passwords for each one, which you can revoke at any time.
  - eli 15y ago
    The sucky part is that nothing enforces their app-specificness. It would be neat if I could generate a password that only works from my home connection. Or only works for GChat, but not other services.
    - drivebyacct2 15y ago
      How would it? If the app were built to send some sort of an identifier with it... well, it might as well use oAuth and then it could use the two-factor sign in anyway.
      - bonzoesc 15y ago
        That would require Google to use an open protocol like OAuth, and I think their official policy is basically "NIH."'
        drivebyacct2 15y ago
        Uh what? Google uses oAuth all over the place and in fact that is the correct solution to this problem. (I assume NIH is never-in-hell or something, can't say I've seen that before) For example, https://developers.google.com/google-apps/gmail/oauth_overview https://developers.google.com/google-apps/gmail/oauth_overvi...
jbredeche 15y ago
I put a copy of the single-use backup verification codes into an alternate dropbox account I have (that isn't linked to my primary email address). Figured if I'm somewhere with enough internet access to get to gmail, I'll be able to get to dropbox.com and get the codes.
- alanbyrne 15y ago
  I've done a similar thing but put them on my colo server. Hopefully getting SSH access in an internet cafe doesn't work out to be too hard.
bo1024 15y ago
This worry seems a bit overblown to me. If your email is that important to you, you should follow these steps: 1. Use a unique, long, random, secure password. 2. Don't tell it to anyone. 3. Use an email service that stores passwords hashed with a salt and a secure hash algorithm. And you will have nothing to worry about. If you are very paranoid or traveling a lot, you can add: 4. Don't log in from insecure devices. 5. Make sure nobody's filming your fingers when you type your password. If you're actually concerned with these two, you probably have bigger issues and are already taking more precautions like 2-factor authorization or so on anyway.
- jrockway 15y ago
  Using a second factor token is much easier than always doing all of those and provides a much larger safety margin. Remember, with 2-factor auth, even someone who knows your password can't access your account. If you also make sure they don't know your password, you're doubly safe. That's why pretty much every safety system invented has some sort of backup safety protection. If you want to go "free solo" on your account because you enjoy thrills, that's fine. But if you're a normal person, why not have a safety rope?
  - bo1024 15y ago
    I would disagree that two-factor is easier. I already do all of the above by (1) using gmail, and (2) only logging in on my own devices. I also check my email so frequently that two-factor authorization would be a significant inefficiency, so there is certainly a cost-benefit tradeoff there.
    - jrockway 15y ago
      You only have to authenticate a device every 30 days. The attack that is prevented here is someone who knows your password getting access to your account. They can't get access unless they know your password and manage to steal your OTP generator or device. That's significantly harder than knowing someone's password. (Knowing your password is probably hard, but I know many peoples' password. It's "password".)
phwd 15y ago
> Hey, This Sounds Like a Pain! Yes, because it is a pain. Try going on a vacation, you know the one where you don't use cell roaming. SMS is out, so then one must find a Wifi hotspot to use one of the smartphone time based tokens (edit: seems the token don't need a network connection, could have fooled me). And those time based tokens go out of wack if your phone didn't sync the timezone properly to match Google's setup, so every token ends up not working. Use the print out backup verification codes on a piece of paper? No, because they are single use. So you end up using up all your backup codes depending on the length of your vacation. I've used 2 step for a long while, I liked it, but I really could not get used to whipping out my phone every time I needed to check something related to Google. I've had other hiccups such as mobile provider down, phone died etc. Maybe my best option was to keep all the backup codes on hard plastic with checkmarks next to used backup codes and secure them the same way I do my banking cards, maybe, I'll just try this one day. If one is going to jump through all these spy-style codes might as well just change your password on a regular basis, forcing all previous sessions to invalidate.
- aprescott 15y ago
  When you reach a point where you have, say, half of your backup verification codes remaining and for some reason your timezone is that far out of sync that Google Authenticator no longer works (and for some reason you can't just sync your clock), then simply generated new backup verification codes and print those out. It seems like a pretty weird assumption that your clock will go out of sync and you won't be able to even manually sync. If you can get online to reach a Google login page, why can't you get within 30 seconds of the correct time for Google Authenticator to work?
- rickyc091 15y ago
  Assuming you were able to use half the backup codes, since you have internet access you can always generate a new batch. I've been using 2 pass since it came out and it's honestly not that bad for the sense of security. Some banks are already using this system.
  - beej71 15y ago
digitalsushi 15y ago
I think this is great, but it doesnt appear to be enabled for the freebie google apps for domains service.
- digitalsushi 15y ago
  I was wrong - the domain administrator can enable this feature in the settings. I apologize for the noise.
  - drewcrawford 15y ago
    Not noise at all. It took me ten minutes to find this option. Turns out it's buried under "Advanced Tools" -> Authentication
drx 15y ago
I really, really wish I could use per-site password authorization without using two factor auth.
dubfan 15y ago
"You should start thinking of security for your email as roughly equivalent to the sort of security you'd want on your bank account. It's exceedingly close to that in practice." Actually, I want (and arguably already have) better than that. In the last 4 months I have had two unauthorized debits from my bank accounts: one a result of a mail thief stealing my rent check from my mailbox, the other an error made by a bank employee. In the 15 years I've been using email I've never knowingly had any of my email accounts hacked.
- icebraining 15y ago
  Notice he said the sort of security you'd want on your bank. I assume you'd want something better than you have right now ;) Mine does offer two-factor, using either SMS or a physical token. And now that I think of it, I think it's mandatory if you want to access it online.
deleted 15y ago
[deleted]
sliverstorm 15y ago
fetchmail is very handy for this sort of problem. Regularly pull and remove your mail from your webmail account. Then you can manage it locally the same way you would all your other archives. Not foolproof, of course, but it improves matters. Also note I don't present this as a solution for John Everyman, but rather the sorts of folks who might be reading Coding Horror.
rdl 15y ago
The thing I hate about Google Authenticator is when you use a google authenticator protected gmail account for other google services. Google has a bunch of things where they don't yet support 2fa, so sometimes you enter the wrong password. It would be good if you had a dedicated-to-email google account, definitely. As it is, I use it for a gmail account I use with all my google services, and it's a real pain -- especially because the gmail password itself is a long random string, and sometimes I need to enter that on a mobile or other device. I'd really like better user credential management using something like OneID (public keys, challenge-response auth), but people have tried that in the past and haven't been terribly successful getting it adopted. It might work better on a mobile OS, so maybe next-gen Apple iOS keystore could do something like this.
- badcrcerror 15y ago
  Facebook handles apps that don't support 2factor pretty well. Your first login will be rejected but you'll be messaged the 6 digit code to login with as your "password".
DarkStarX1 15y ago
If you are dumb enough to trust a service like Gmail with your credit cards, passwords, and other codes, well.. you're dumb.
evoxed 15y ago
>provided you own a cell phone. Well, crap. My only "phone" is my Google Voice number...
- drivebyacct2 15y ago
  Two factor auth works fine without a cell phone. You can put a land line in as a backup and of course you should store the extra physical codes somewhere safe as well. Obviously though, this would be a pain to use without a portable device that can generate the appropriate time-based code.
- RexRollman 15y ago
  Could always use an iPod Touch, if you have one.
  - wiredfool 15y ago
    Or a iPad v2 or 3.
  - evoxed 15y ago
    That's actually my current setup. It still kind of defeats the purpose though; I have to be logged in to Google Voice in order to authenticate logging in to Gmail with the same account. I'll wait for them to get a little more creative before I expect it to be much safer.
velshin 15y ago
Is it really that easy to hack someones gmail account? I realize phishing and key loggers are easy ways to grab a password, but if you avoid typing your gmail password at public internet kiosks and the like, is it really that easy for someone to get at? Assuming you use a reasonably long and impossible to guess password, the captchas would prevent brute forcing. An attack targeted specifically at you will inevitably succeed but most of us are not that special. The article's advice seems far too easy to lock yourself out (losing my wallet with my magic paper codes and my phone could do it). The additional inconvenience does not seem worth it. Most of us have used physical 2 factor authentication (like RSA SecurID) for banking and work related VPN access. This works well because the provider (your office, your bank) has a vested interest in getting you back into your account if you get locked out. Google, Yahoo, MS, etc. have no such obligation.
- bigiain 15y ago
  A _startlingly_ large number of people are (still) re-using passwords across multiple sites. The Gawker/Sony(/PerlMonks for me) compromises revealed a _lot_ of email addresses and passwords, some significant portion of which almost certainly allowed attackers access not only to the specific website that was attacked, but also to the email service of the exposed user. I'm pretty sure none of Jeff's advice helps you against a government-agency level attack agains you specifically, but following it _will_ protect your email even if some other random website you once registered for exposes the login details you used there. I _hope_ that's not a problem for any HN readers (any more), but what about your partner/children/parents/coworkers? I'd bet good money that _someone_ you know and care about is reusing their email account password on random website signup forms.
  - alanbyrne 15y ago
    My name is Alan Byrne, I work in IT and I'm a password re-user :( On that note, does anyone know of a secure keysafe app that will sync across my various PCs, iPad and Android phone? This is what is stopping me from going the single use password route.
    - 15y ago
munin 15y ago
so now it is only a matter of time until the keylogging software that everyone is so terrified of is modified to also take the session cookie from your browser that authenticates you to gmail. you know, the thing that makes it okay for you to click "remember this computer for 30 days" ...
- gibybo 15y ago
  The session cookies are often tied to IP address.
  - munin 15y ago
    are they? have you ever logged in at home, suspended, and then gone to work? or the coffee shop?
    - abraham 15y ago
      Google might compare browser/OS entropy as well as IPs. https://www.eff.org/deeplinks/2010/01/primer-information-theory-and-privacy https://www.eff.org/deeplinks/2010/01/primer-information-the...
- Drbble 15y ago
  Like FireSheep already did?
loverobots 15y ago
(You can check the "remember me for 30 days on this device" checkbox so you don't have to do this every time.) No thanks. Google remembers a lot more than "this device," more like everything I do within that device thanks Search cookies, Adsense, Analytics on millions of sites and who knows what else
- karterk 15y ago
  I always have my gmail logged-in in a separate browser and I don't use that for any other browsing.
  - ricardobeat 15y ago
    Could just open an incognito/private window.
    - abraham 15y ago
      You can also use profiles in Chrome: https://support.google.com/chrome/bin/answer.py?hl=en&answer=2364824 https://support.google.com/chrome/bin/answer.py?hl=en&an...
  - boxein 15y ago
    I use this method also
- Drbble 15y ago
  You don't need to be authenticated for Google to know who you are.
mikepmalai 15y ago
For now I have a really long email password, but I'm considering moving my sensitive data/email out of my general email account and into a new email address that requires 2 factor authentication. The thing I really want is a "lockbox" folder in my general email that: 1. Requires 2 factor authentication to access the folder but not my general inbox 2. I can move messages I consider sensitive from my general inbox to the lockbox folder 3. Will automatically sends emails from my banks, etc. into the folder with an email showing just the subject line in my general inbox
- dlib 15y ago
  Wow, this would be an excellent feature. Although I've got 2 factor authentication set up for my whole account and it doesn't really bother me, I would like to see something like this. An extra measure to protect certain emails would be really helpful.
- icebraining 15y ago
  Poor man's lockbox: create a second account, enable two-factor only on that account, set up filters to redirect those emails to that account and delete them from your main account.
zobzu 15y ago
"print the recovery codes and keep them with you at all times" Wrong. Terribly wrong. Do not do that. You'll have your phone with you AND the codes. So, imagine that day, you get your stuff stolen from your person. Laptop, phone, codes, gone. Bad. That day you were on a boat and you fall in the water. Phone, codes, gone. Bad. Instead store the codes in your own safe, a secret location, or a safe deposit box.
- modeless 15y ago
  No, it's exactly right. Having the codes with you is not a security risk because they're useless without your password. You can keep a second copy of the codes at home if you're worried about losing them.
- MitziMoto 15y ago
  If you can access your email account with only the backup code and no password, Google is doing it wrong.
zobzu 15y ago
There's a very "simple" way to steal stuff via email. Find the relevant service. Spoof DNS. Get emails. Alternative. MITM the SMTP (thanks anonymous SSL, no certificate errors!). And that's scary, since 2 factor auth, nor anything, can really save you from that.
mrcharles 15y ago
I've been using 2-step verification and app specific passwords for a long time now, and it's just trivial once you get used to it. Highly recommended.
trout 15y ago
I've made a few changes to securing mine with 2 factor. 1. Altered the digits in my wallet so only I know how to recover the real numbers. 2. Created a junk email with a secure password with a security-through-obscurity email with the numbers (again modified) The use case - losing both your cellphone and wallet. There's basically not an easy way to get back to your data. I have to remember a few things: --Normal password to email --Modification I used to numbers in wallet --Modification for numbers in junk email --Junk email username --Junk email password It's definitely a burden. But it's worth the security of my email. At this point it reduces the burden of regularly changing my email password or adding complexity to the password.
- abraham 15y ago
  The good thing about the recovery numbers is they are still no good without your password. So someone would have to both get your password and steal your wallet to gain access.
jellicle 15y ago
While you're thinking about the security of your email in the cloud, remember this: ANY of your email older than six months can be legally obtained by any U.S. law enforcement agency without any warrant or judicial oversight of any sort, even if you enable Google's new 46-factor authentication and use passwords that take minutes to type in. http://www.wired.com/threatlevel/2011/10/ecpa-turns-twenty-five/ http://www.wired.com/threatlevel/2011/10/ecpa-turns-twenty-f... Do you have any passwords in your email older than six months? Any account numbers? Anything... incriminating or embarrassing?
- andyouthink 15y ago
  And you think that Google actually deletes email when you tell it to? More likely they just mark it as deleted and retain it, in which case every email you ever received regardless of whether you think it has been deleted may be available. If you want better privacy, install and manage your own mail server and encrypt everything.
  - jrockway 15y ago
    Do you really think your shared host drops blocks when you delete them from your virtual disk, and do you really think that requests to mlock memory with crypto keys are really honored? Maybe if you have a dedicated box, but not if you are using a virutal host. (Have you ever physically seen "your own" mail server? If not, why do you trust it?) Also consider what happens to unencrypted email you send or receive: any upstream servers can be subpoenaed, as can the person on the other end. Encrypted mail only works when it's encrypted end-to-end and your adversary cannot seize the sending or receiving computer. I imagine that people who encrypt their received email end up in court because their sender was not so careful. Do you trust every person that will ever mail you to keep your secrets safe? Why? Ultimately, if the government is your enemy, you need to take a lot more precautions than "don't use Gmail".
    - a3_nm 15y ago
      Yow! The ONLY secure server for TOTAL EMAIL SAFETY is an obsolete LAPTOP running in your mother's LIVING ROOM! (Not kidding, I really do that.)
pbz 15y ago
I have two-way enabled, but when logging in via Google Talk (windows app) it seems to bypass it. If I go straight to gmail.com and login I'm asked for the second auth, but clicking via Google Talk (already signed in) it logges me in to GMail directly. Anybody know if this is normal / expected?
- eigenvector 15y ago
  It's because Google Talk is permanently authorized via it's application-specific password.
andyouthink 15y ago
Great article on 2-factor auth. I didn't understand how easy it was, so I'm switching to it now. However, if you use a mail client and generate app-specific passwords that last forever, can't the hackers just hack via IMAP login instead which won't be 2-factor? It seems like it would be better to use private keys on the client with 2 factor auth for authentication recovery. That way as long as you have the right private key locally that your mail client uses, you are set- otherwise you have to both provide a password and an SMS delivered code in order to use a different private key on the client.
gaelian 15y ago
Not that anyone should need further convincing, but just in case here's another data point drawn from my own experience: http://blog.binarybalance.com.au/2012/03/11/a-wakeup-call-from-online-security-will-you-accept-the-charges http://blog.binarybalance.com.au/2012/03/11/a-wakeup-call-fr...
my8bird 15y ago
While I like 2 step authentication I wish Google would get rid of SMS password reset. With this enabled all a person needs is your phone to gain access to your account. Given that police can grab you phone whenever you are stopped this means they can "hack" your account at the same time. Another example could be a cleaning person at a hotel finding your phone. Just two examples off the top of my head. Basically, SMS password reset makes your phone the golden key. http://support.google.com/accounts/bin/answer.py?hl=en&answer=152124 http://support.google.com/accounts/bin/answer.py?hl=en&a...
- smiler 15y ago
  As long as you have a pin lock on your phone, the cleaning person nor the police will be able to do anything with your phone.
  - jamesgeck0 15y ago
    What about if the phone can be rooted?
  - sp332 15y ago
    It's not that hard for law enforcement to get your PIN. e.g. http://blog.agilebits.com/2012/03/30/the-abcs-of-xry-not-so-simple-passcodes/ http://blog.agilebits.com/2012/03/30/the-abcs-of-xry-not-so-...
brazzy 15y ago
That cell phone you use for receiving the verification codes? It better not be a smartphone you also use to access GMail, or your 2-factor just became 1-factor, at least to any malware on that phone...
- jrockway 15y ago
  Your phone should never know your password; you log into Gmail from your phone using an application-specific password. If your phone is infected with malware and you don't trust it anymore, you deauthorize it and your account is safe. 2 factor authentication is an amazingly simple solution to a large number of complex problems.
  - pyre 15y ago
    > If your phone is infected with malware > and > you don't trust it anymore Those don't necessarily go hand-in-hand.
tbod 15y ago
I'm surprised that nobody has yet commented on the second website mentioned on the application specific password section... nice touch to a great article!
jcfrei 15y ago
dropbox really needs this too. although my information on that account is not nearly as sensitive as on gmail, i'm sure it will amount to a similar sensitivity in the future.
- dlib 15y ago
  Indeed, anytime I login a a mental note pops up saying how insecure this is considering the files stored on Dropbox. Yesterday I received a phonecall from a friend whose Gmail and Facebook were hacked, after I had advised her to use 2-factor authentication and she ignored it. So glad that I do use it but now Dropbox remains the weakest link.
pepijndevos 15y ago
I access my email from _one_ app over SMPT, using a unique password. For me, this 2-factor auth would just mean having a different and slightly longer password for SMPT.
- andreasvc 15y ago
  SMTP is only for sending mail to and between mail servers. Did you mean something else? And no, 2-factor is not the same as a long password, because it is less likely that both factors will get compromised at the same time. However long your password is, a single software flaw could expose it.
robin_reala 15y ago
I’ve enabled and stayed with 2-factor auth on my Google account, but it broke my Google Talk login on Adium and I’ve never found anyone to talk to about it (bug report on Adium went unnoticed and Google got rid of bug reporting for Google Talk). Hopefully a burst of attention will throw up some other people with the same problem.
- grk 15y ago
  Did you use an application specific password for Adium login? When you enable 2 factor auth, you need to generate those password for every app you use.
  - robin_reala 15y ago
    Yep, done that. This approach works with my 3 copies of Reeder (work, home, phone) and Calender on my phone, but for some reason Adium refuses to log in. Bug report (along with network trace) is: http://trac.adium.im/ticket/15310 http://trac.adium.im/ticket/15310 I’m guessing it’s because my Google account doesn’t have a Gmail account associated with it, but Google Talk still works fine from the widget on iGoogle. Edit: opened a superuser.com question: http://superuser.com/questions/413859/google-talk-and-2-factor-authentication http://superuser.com/questions/413859/google-talk-and-2-fact...
    - jarito 15y ago
      I think you are right about the gmail issue. I use adium on an iMac and Macbook for work and Digsby on my Windows box at home and the application specific passwords work fine for me.
      - robin_reala 15y ago
        Google Talk will be tested by Google employees, and how many of them don’t have a Gmail account? :) I still feel that this should work though.
- rajivm 15y ago
molsongolden 15y ago
It's interesting that the "hacker" send out a mugged in Madrid email. A friend in Nepal had his Yahoo account hacked last week with the same email sent out. I wonder how they targeted people or gained access since his wife was using Gmail and is (most likely?) in a western country and my friend is from Nepal. It doesn't seem like they would be using any of the same websites.
- uxp 15y ago
  Just like a lot of lead generation/spam email campaigns I've seen, I'd assume a lot of phishing and scam email "campaigns" are strictly copy and pasted from a single source (ie, a forum post somewhere), with very few scammers actually putting any effort into changing it to be somewhat unique in favor of trying to get the message to as many people as quick as possible.
Wiesenwegler 15y ago
Would using this not solve the problem without the hassle http://security.stackexchange.com/questions/13226/how-can-privatesky-not-see-your-data/13289#13289 http://security.stackexchange.com/questions/13226/how-can-pr... ? Seems robust enough ito safety and easy enough to use incl 2-Factor...
bckelly 15y ago
Shameless plug for http://duosecurity.com http://duosecurity.com We offer a two-factor cloud service to protect any kind of service that may be remotely accessed: web, ssh, rdp, vpn, ... Biggest difference from Google Authenticator is the smart phone user experience: one tap to approve a login instead of transcribing a six digit OTP.

186 points by superchink 15y ago

The article sounds like this requires you to sumbmit a cell number to Gmail. (In fact, I think merely registering an account nowadays requires a number, but I'm not sure about that.) If you think that's the only way to get 2-factor authentication working, you're wrong. If you think there is nothing wrong with your email provider demanding info like cell phone numbers, you're wrong again.

Atrus6 15y ago
I don't think there is anything wrong with an email provider asking me for my cell number to send me text messages, how else would they send them? In addition, a cell phone number is NOT required to create a Google account. Sure they ask (and gender is apparently required, I just made an account), but if you leave it blank, they won't complain.
- romaniv 15y ago
  There is nothing wrong with providers giving you an option to use your number for notifications. However, if we are required to provide phone number for security features that can be implemented without using phones, there are a few things wrong with it. How can this be implemented without using a phone number? Well, the article actually contains one way - pre-shared secret codes that you print out beforehand. There are many others.

gabaix 15y ago

What happens when you travel abroad and your phone does not work? I am wondering if Gmail could implement security questions to avoid cases where the 2-step verification works against the user

superchink 15y ago
Firstly, the Google Authenticator application does not require a network connection. See: http://support.google.com/a/bin/answer.py?hl=en&answer=1037451 http://support.google.com/a/bin/answer.py?hl=en&answer=1... If you are planning to be without your phone, you can always disable 2-step verification temporarily: https://support.google.com/accounts/bin/answer.py?hl=en&answer=1064203&topic=1056283&ctx=topic https://support.google.com/accounts/bin/answer.py?hl=en&... Finally, if you lose your phone, you should always have your single-use backup verification codes to allow you to login.
ninjin 15y ago
Ironical as it may be and as the author mentioned briefly in the article, "there is an app for that". Google provides an authentication app for at least Android and iOS. I personally put my phone in "airplane mode" for the trip (still waiting for that market changing deal where you can travel easily across the globe and call/use data without being robbed by your provider) then use the authentication app. I also carry my authentication codes during the trip and they should be enough for even a longer trip, if not, I can generate new security codes during the trip using the security codes I already have with me.
- lallysingh 15y ago
  Also iOS and blackberry: http://support.google.com/accounts/bin/answer.py?hl=en&answer=1066447&ctx=cb&src=cb&cbid=zoooghbwaatq&cbrank=0 http://support.google.com/accounts/bin/answer.py?hl=en&a...
  - icebraining 15y ago
    And since they use a standard (RFC6238), there are third-party application that works with it too. I use a J2ME app on my Symbian phone.
    - bburky 15y ago
      What J2ME app are you using? I ended up porting (really just copying one Java class) part of Google Authenticator to J2ME. It works, but isn't great. What're you using?

raldi 15y ago

What I really want is for the second factor to kick on only in suspicious situations, e.g.: * I'm logging in from a computer that I've never logged in from before * I'm searching my mail history for terms like "password" * I'm opening an email that appears to contain a password-reset link * I'm messing with my mail-forwarding options * I'm accessing messages in bulk But I do not want to have to do second factor just because it's been 31 days since the last time I've done it.

deleted 15y ago
[deleted]
drivebyacct2 15y ago
Typing a six digit number every 31 days is too much work to add a significant layer of security to a very important account?
- loverobots 15y ago
  You should clear those cookies quite often. Just saying
- zobzu 15y ago
  Typing 6 digits every 31 does not add a significant layer of security. 2 factor auth does. And that's different. If one of your devices is stolen, you go reset the pass. As simple as that. Plus, 31 days is a long time for the hacker, so it's not adding all that much security.
  - mseebach 15y ago
    > Plus, 31 days is a long time for the hacker, so it's not adding all that much security. No, but it might well be for the guy who fishes your old harddrive out of a bin.
- dennisgorelik 15y ago
  It's extra work. Does this expiration after 31 days add any extra protection?

kghose 15y ago

What happens for IMAP accounts? e.g through Mail.app or Thunderbird?

ninjin 15y ago
You would use "Application-specific passwords", basically a one-off password used only for your IM or E-mail.
JangoSteve 15y ago
It's in the article, but basically you just generate app-specific passwords for each one, which you can revoke at any time.
- eli 15y ago
  The sucky part is that nothing enforces their app-specificness. It would be neat if I could generate a password that only works from my home connection. Or only works for GChat, but not other services.
  - drivebyacct2 15y ago
    How would it? If the app were built to send some sort of an identifier with it... well, it might as well use oAuth and then it could use the two-factor sign in anyway.
    - bonzoesc 15y ago
      That would require Google to use an open protocol like OAuth, and I think their official policy is basically "NIH."'
      - drivebyacct2 15y ago
        Uh what? Google uses oAuth all over the place and in fact that is the correct solution to this problem. (I assume NIH is never-in-hell or something, can't say I've seen that before) For example, https://developers.google.com/google-apps/gmail/oauth_overview https://developers.google.com/google-apps/gmail/oauth_overvi...

jbredeche 15y ago

I put a copy of the single-use backup verification codes into an alternate dropbox account I have (that isn't linked to my primary email address). Figured if I'm somewhere with enough internet access to get to gmail, I'll be able to get to dropbox.com and get the codes.

alanbyrne 15y ago
I've done a similar thing but put them on my colo server. Hopefully getting SSH access in an internet cafe doesn't work out to be too hard.

bo1024 15y ago

This worry seems a bit overblown to me. If your email is that important to you, you should follow these steps: 1. Use a unique, long, random, secure password. 2. Don't tell it to anyone. 3. Use an email service that stores passwords hashed with a salt and a secure hash algorithm. And you will have nothing to worry about. If you are very paranoid or traveling a lot, you can add: 4. Don't log in from insecure devices. 5. Make sure nobody's filming your fingers when you type your password. If you're actually concerned with these two, you probably have bigger issues and are already taking more precautions like 2-factor authorization or so on anyway.

jrockway 15y ago
Using a second factor token is much easier than always doing all of those and provides a much larger safety margin. Remember, with 2-factor auth, even someone who knows your password can't access your account. If you also make sure they don't know your password, you're doubly safe. That's why pretty much every safety system invented has some sort of backup safety protection. If you want to go "free solo" on your account because you enjoy thrills, that's fine. But if you're a normal person, why not have a safety rope?
- bo1024 15y ago
  I would disagree that two-factor is easier. I already do all of the above by (1) using gmail, and (2) only logging in on my own devices. I also check my email so frequently that two-factor authorization would be a significant inefficiency, so there is certainly a cost-benefit tradeoff there.
  - jrockway 15y ago
    You only have to authenticate a device every 30 days. The attack that is prevented here is someone who knows your password getting access to your account. They can't get access unless they know your password and manage to steal your OTP generator or device. That's significantly harder than knowing someone's password. (Knowing your password is probably hard, but I know many peoples' password. It's "password".)

phwd 15y ago

> Hey, This Sounds Like a Pain! Yes, because it is a pain. Try going on a vacation, you know the one where you don't use cell roaming. SMS is out, so then one must find a Wifi hotspot to use one of the smartphone time based tokens (edit: seems the token don't need a network connection, could have fooled me). And those time based tokens go out of wack if your phone didn't sync the timezone properly to match Google's setup, so every token ends up not working. Use the print out backup verification codes on a piece of paper? No, because they are single use. So you end up using up all your backup codes depending on the length of your vacation. I've used 2 step for a long while, I liked it, but I really could not get used to whipping out my phone every time I needed to check something related to Google. I've had other hiccups such as mobile provider down, phone died etc. Maybe my best option was to keep all the backup codes on hard plastic with checkmarks next to used backup codes and secure them the same way I do my banking cards, maybe, I'll just try this one day. If one is going to jump through all these spy-style codes might as well just change your password on a regular basis, forcing all previous sessions to invalidate.

aprescott 15y ago
When you reach a point where you have, say, half of your backup verification codes remaining and for some reason your timezone is that far out of sync that Google Authenticator no longer works (and for some reason you can't just sync your clock), then simply generated new backup verification codes and print those out. It seems like a pretty weird assumption that your clock will go out of sync and you won't be able to even manually sync. If you can get online to reach a Google login page, why can't you get within 30 seconds of the correct time for Google Authenticator to work?
rickyc091 15y ago
Assuming you were able to use half the backup codes, since you have internet access you can always generate a new batch. I've been using 2 pass since it came out and it's honestly not that bad for the sense of security. Some banks are already using this system.
- beej71 15y ago

digitalsushi 15y ago

I think this is great, but it doesnt appear to be enabled for the freebie google apps for domains service.

digitalsushi 15y ago
I was wrong - the domain administrator can enable this feature in the settings. I apologize for the noise.
- drewcrawford 15y ago
  Not noise at all. It took me ten minutes to find this option. Turns out it's buried under "Advanced Tools" -> Authentication

drx 15y ago

I really, really wish I could use per-site password authorization without using two factor auth.

dubfan 15y ago

"You should start thinking of security for your email as roughly equivalent to the sort of security you'd want on your bank account. It's exceedingly close to that in practice." Actually, I want (and arguably already have) better than that. In the last 4 months I have had two unauthorized debits from my bank accounts: one a result of a mail thief stealing my rent check from my mailbox, the other an error made by a bank employee. In the 15 years I've been using email I've never knowingly had any of my email accounts hacked.

icebraining 15y ago
Notice he said the sort of security you'd want on your bank. I assume you'd want something better than you have right now ;) Mine does offer two-factor, using either SMS or a physical token. And now that I think of it, I think it's mandatory if you want to access it online.

deleted 15y ago

[deleted]

sliverstorm 15y ago

fetchmail is very handy for this sort of problem. Regularly pull and remove your mail from your webmail account. Then you can manage it locally the same way you would all your other archives. Not foolproof, of course, but it improves matters. Also note I don't present this as a solution for John Everyman, but rather the sorts of folks who might be reading Coding Horror.

rdl 15y ago

The thing I hate about Google Authenticator is when you use a google authenticator protected gmail account for other google services. Google has a bunch of things where they don't yet support 2fa, so sometimes you enter the wrong password. It would be good if you had a dedicated-to-email google account, definitely. As it is, I use it for a gmail account I use with all my google services, and it's a real pain -- especially because the gmail password itself is a long random string, and sometimes I need to enter that on a mobile or other device. I'd really like better user credential management using something like OneID (public keys, challenge-response auth), but people have tried that in the past and haven't been terribly successful getting it adopted. It might work better on a mobile OS, so maybe next-gen Apple iOS keystore could do something like this.

badcrcerror 15y ago
Facebook handles apps that don't support 2factor pretty well. Your first login will be rejected but you'll be messaged the 6 digit code to login with as your "password".

DarkStarX1 15y ago

If you are dumb enough to trust a service like Gmail with your credit cards, passwords, and other codes, well.. you're dumb.

evoxed 15y ago

>provided you own a cell phone. Well, crap. My only "phone" is my Google Voice number...

drivebyacct2 15y ago
Two factor auth works fine without a cell phone. You can put a land line in as a backup and of course you should store the extra physical codes somewhere safe as well. Obviously though, this would be a pain to use without a portable device that can generate the appropriate time-based code.
RexRollman 15y ago
Could always use an iPod Touch, if you have one.
- wiredfool 15y ago
  Or a iPad v2 or 3.
- evoxed 15y ago
  That's actually my current setup. It still kind of defeats the purpose though; I have to be logged in to Google Voice in order to authenticate logging in to Gmail with the same account. I'll wait for them to get a little more creative before I expect it to be much safer.

velshin 15y ago

Is it really that easy to hack someones gmail account? I realize phishing and key loggers are easy ways to grab a password, but if you avoid typing your gmail password at public internet kiosks and the like, is it really that easy for someone to get at? Assuming you use a reasonably long and impossible to guess password, the captchas would prevent brute forcing. An attack targeted specifically at you will inevitably succeed but most of us are not that special. The article's advice seems far too easy to lock yourself out (losing my wallet with my magic paper codes and my phone could do it). The additional inconvenience does not seem worth it. Most of us have used physical 2 factor authentication (like RSA SecurID) for banking and work related VPN access. This works well because the provider (your office, your bank) has a vested interest in getting you back into your account if you get locked out. Google, Yahoo, MS, etc. have no such obligation.

bigiain 15y ago
A _startlingly_ large number of people are (still) re-using passwords across multiple sites. The Gawker/Sony(/PerlMonks for me) compromises revealed a _lot_ of email addresses and passwords, some significant portion of which almost certainly allowed attackers access not only to the specific website that was attacked, but also to the email service of the exposed user. I'm pretty sure none of Jeff's advice helps you against a government-agency level attack agains you specifically, but following it _will_ protect your email even if some other random website you once registered for exposes the login details you used there. I _hope_ that's not a problem for any HN readers (any more), but what about your partner/children/parents/coworkers? I'd bet good money that _someone_ you know and care about is reusing their email account password on random website signup forms.
- alanbyrne 15y ago
  My name is Alan Byrne, I work in IT and I'm a password re-user :( On that note, does anyone know of a secure keysafe app that will sync across my various PCs, iPad and Android phone? This is what is stopping me from going the single use password route.
  - 15y ago

munin 15y ago

so now it is only a matter of time until the keylogging software that everyone is so terrified of is modified to also take the session cookie from your browser that authenticates you to gmail. you know, the thing that makes it okay for you to click "remember this computer for 30 days" ...

gibybo 15y ago
The session cookies are often tied to IP address.
- munin 15y ago
  are they? have you ever logged in at home, suspended, and then gone to work? or the coffee shop?
  - abraham 15y ago
    Google might compare browser/OS entropy as well as IPs. https://www.eff.org/deeplinks/2010/01/primer-information-theory-and-privacy https://www.eff.org/deeplinks/2010/01/primer-information-the...
Drbble 15y ago
Like FireSheep already did?

loverobots 15y ago

(You can check the "remember me for 30 days on this device" checkbox so you don't have to do this every time.) No thanks. Google remembers a lot more than "this device," more like everything I do within that device thanks Search cookies, Adsense, Analytics on millions of sites and who knows what else

karterk 15y ago
I always have my gmail logged-in in a separate browser and I don't use that for any other browsing.
- ricardobeat 15y ago
  Could just open an incognito/private window.
  - abraham 15y ago
    You can also use profiles in Chrome: https://support.google.com/chrome/bin/answer.py?hl=en&answer=2364824 https://support.google.com/chrome/bin/answer.py?hl=en&an...
- boxein 15y ago
  I use this method also
Drbble 15y ago
You don't need to be authenticated for Google to know who you are.

mikepmalai 15y ago

For now I have a really long email password, but I'm considering moving my sensitive data/email out of my general email account and into a new email address that requires 2 factor authentication. The thing I really want is a "lockbox" folder in my general email that: 1. Requires 2 factor authentication to access the folder but not my general inbox 2. I can move messages I consider sensitive from my general inbox to the lockbox folder 3. Will automatically sends emails from my banks, etc. into the folder with an email showing just the subject line in my general inbox

dlib 15y ago
Wow, this would be an excellent feature. Although I've got 2 factor authentication set up for my whole account and it doesn't really bother me, I would like to see something like this. An extra measure to protect certain emails would be really helpful.
icebraining 15y ago
Poor man's lockbox: create a second account, enable two-factor only on that account, set up filters to redirect those emails to that account and delete them from your main account.

zobzu 15y ago

"print the recovery codes and keep them with you at all times" Wrong. Terribly wrong. Do not do that. You'll have your phone with you AND the codes. So, imagine that day, you get your stuff stolen from your person. Laptop, phone, codes, gone. Bad. That day you were on a boat and you fall in the water. Phone, codes, gone. Bad. Instead store the codes in your own safe, a secret location, or a safe deposit box.

modeless 15y ago
No, it's exactly right. Having the codes with you is not a security risk because they're useless without your password. You can keep a second copy of the codes at home if you're worried about losing them.
MitziMoto 15y ago
If you can access your email account with only the backup code and no password, Google is doing it wrong.

zobzu 15y ago

There's a very "simple" way to steal stuff via email. Find the relevant service. Spoof DNS. Get emails. Alternative. MITM the SMTP (thanks anonymous SSL, no certificate errors!). And that's scary, since 2 factor auth, nor anything, can really save you from that.

mrcharles 15y ago

I've been using 2-step verification and app specific passwords for a long time now, and it's just trivial once you get used to it. Highly recommended.

trout 15y ago

I've made a few changes to securing mine with 2 factor. 1. Altered the digits in my wallet so only I know how to recover the real numbers. 2. Created a junk email with a secure password with a security-through-obscurity email with the numbers (again modified) The use case - losing both your cellphone and wallet. There's basically not an easy way to get back to your data. I have to remember a few things: --Normal password to email --Modification I used to numbers in wallet --Modification for numbers in junk email --Junk email username --Junk email password It's definitely a burden. But it's worth the security of my email. At this point it reduces the burden of regularly changing my email password or adding complexity to the password.

abraham 15y ago
The good thing about the recovery numbers is they are still no good without your password. So someone would have to both get your password and steal your wallet to gain access.

jellicle 15y ago

While you're thinking about the security of your email in the cloud, remember this: ANY of your email older than six months can be legally obtained by any U.S. law enforcement agency without any warrant or judicial oversight of any sort, even if you enable Google's new 46-factor authentication and use passwords that take minutes to type in. http://www.wired.com/threatlevel/2011/10/ecpa-turns-twenty-five/ http://www.wired.com/threatlevel/2011/10/ecpa-turns-twenty-f... Do you have any passwords in your email older than six months? Any account numbers? Anything... incriminating or embarrassing?

andyouthink 15y ago
And you think that Google actually deletes email when you tell it to? More likely they just mark it as deleted and retain it, in which case every email you ever received regardless of whether you think it has been deleted may be available. If you want better privacy, install and manage your own mail server and encrypt everything.
- jrockway 15y ago
  Do you really think your shared host drops blocks when you delete them from your virtual disk, and do you really think that requests to mlock memory with crypto keys are really honored? Maybe if you have a dedicated box, but not if you are using a virutal host. (Have you ever physically seen "your own" mail server? If not, why do you trust it?) Also consider what happens to unencrypted email you send or receive: any upstream servers can be subpoenaed, as can the person on the other end. Encrypted mail only works when it's encrypted end-to-end and your adversary cannot seize the sending or receiving computer. I imagine that people who encrypt their received email end up in court because their sender was not so careful. Do you trust every person that will ever mail you to keep your secrets safe? Why? Ultimately, if the government is your enemy, you need to take a lot more precautions than "don't use Gmail".
  - a3_nm 15y ago
    Yow! The ONLY secure server for TOTAL EMAIL SAFETY is an obsolete LAPTOP running in your mother's LIVING ROOM! (Not kidding, I really do that.)

pbz 15y ago

I have two-way enabled, but when logging in via Google Talk (windows app) it seems to bypass it. If I go straight to gmail.com and login I'm asked for the second auth, but clicking via Google Talk (already signed in) it logges me in to GMail directly. Anybody know if this is normal / expected?

eigenvector 15y ago
It's because Google Talk is permanently authorized via it's application-specific password.

andyouthink 15y ago

Great article on 2-factor auth. I didn't understand how easy it was, so I'm switching to it now. However, if you use a mail client and generate app-specific passwords that last forever, can't the hackers just hack via IMAP login instead which won't be 2-factor? It seems like it would be better to use private keys on the client with 2 factor auth for authentication recovery. That way as long as you have the right private key locally that your mail client uses, you are set- otherwise you have to both provide a password and an SMS delivered code in order to use a different private key on the client.

gaelian 15y ago

Not that anyone should need further convincing, but just in case here's another data point drawn from my own experience: http://blog.binarybalance.com.au/2012/03/11/a-wakeup-call-from-online-security-will-you-accept-the-charges http://blog.binarybalance.com.au/2012/03/11/a-wakeup-call-fr...

my8bird 15y ago

While I like 2 step authentication I wish Google would get rid of SMS password reset. With this enabled all a person needs is your phone to gain access to your account. Given that police can grab you phone whenever you are stopped this means they can "hack" your account at the same time. Another example could be a cleaning person at a hotel finding your phone. Just two examples off the top of my head. Basically, SMS password reset makes your phone the golden key. http://support.google.com/accounts/bin/answer.py?hl=en&answer=152124 http://support.google.com/accounts/bin/answer.py?hl=en&a...

smiler 15y ago
As long as you have a pin lock on your phone, the cleaning person nor the police will be able to do anything with your phone.
- jamesgeck0 15y ago
  What about if the phone can be rooted?
- sp332 15y ago
  It's not that hard for law enforcement to get your PIN. e.g. http://blog.agilebits.com/2012/03/30/the-abcs-of-xry-not-so-simple-passcodes/ http://blog.agilebits.com/2012/03/30/the-abcs-of-xry-not-so-...

brazzy 15y ago

That cell phone you use for receiving the verification codes? It better not be a smartphone you also use to access GMail, or your 2-factor just became 1-factor, at least to any malware on that phone...

jrockway 15y ago
Your phone should never know your password; you log into Gmail from your phone using an application-specific password. If your phone is infected with malware and you don't trust it anymore, you deauthorize it and your account is safe. 2 factor authentication is an amazingly simple solution to a large number of complex problems.
- pyre 15y ago
  > If your phone is infected with malware > and > you don't trust it anymore Those don't necessarily go hand-in-hand.

tbod 15y ago

I'm surprised that nobody has yet commented on the second website mentioned on the application specific password section... nice touch to a great article!

jcfrei 15y ago

dropbox really needs this too. although my information on that account is not nearly as sensitive as on gmail, i'm sure it will amount to a similar sensitivity in the future.

dlib 15y ago
Indeed, anytime I login a a mental note pops up saying how insecure this is considering the files stored on Dropbox. Yesterday I received a phonecall from a friend whose Gmail and Facebook were hacked, after I had advised her to use 2-factor authentication and she ignored it. So glad that I do use it but now Dropbox remains the weakest link.

pepijndevos 15y ago

I access my email from _one_ app over SMPT, using a unique password. For me, this 2-factor auth would just mean having a different and slightly longer password for SMPT.

andreasvc 15y ago
SMTP is only for sending mail to and between mail servers. Did you mean something else? And no, 2-factor is not the same as a long password, because it is less likely that both factors will get compromised at the same time. However long your password is, a single software flaw could expose it.

robin_reala 15y ago

I’ve enabled and stayed with 2-factor auth on my Google account, but it broke my Google Talk login on Adium and I’ve never found anyone to talk to about it (bug report on Adium went unnoticed and Google got rid of bug reporting for Google Talk). Hopefully a burst of attention will throw up some other people with the same problem.

grk 15y ago
Did you use an application specific password for Adium login? When you enable 2 factor auth, you need to generate those password for every app you use.
- robin_reala 15y ago
  Yep, done that. This approach works with my 3 copies of Reeder (work, home, phone) and Calender on my phone, but for some reason Adium refuses to log in. Bug report (along with network trace) is: http://trac.adium.im/ticket/15310 http://trac.adium.im/ticket/15310 I’m guessing it’s because my Google account doesn’t have a Gmail account associated with it, but Google Talk still works fine from the widget on iGoogle. Edit: opened a superuser.com question: http://superuser.com/questions/413859/google-talk-and-2-factor-authentication http://superuser.com/questions/413859/google-talk-and-2-fact...
  - jarito 15y ago
    I think you are right about the gmail issue. I use adium on an iMac and Macbook for work and Digsby on my Windows box at home and the application specific passwords work fine for me.
    - robin_reala 15y ago
      Google Talk will be tested by Google employees, and how many of them don’t have a Gmail account? :) I still feel that this should work though.
rajivm 15y ago

molsongolden 15y ago

It's interesting that the "hacker" send out a mugged in Madrid email. A friend in Nepal had his Yahoo account hacked last week with the same email sent out. I wonder how they targeted people or gained access since his wife was using Gmail and is (most likely?) in a western country and my friend is from Nepal. It doesn't seem like they would be using any of the same websites.

uxp 15y ago
Just like a lot of lead generation/spam email campaigns I've seen, I'd assume a lot of phishing and scam email "campaigns" are strictly copy and pasted from a single source (ie, a forum post somewhere), with very few scammers actually putting any effort into changing it to be somewhat unique in favor of trying to get the message to as many people as quick as possible.

Wiesenwegler 15y ago

Would using this not solve the problem without the hassle http://security.stackexchange.com/questions/13226/how-can-privatesky-not-see-your-data/13289#13289 http://security.stackexchange.com/questions/13226/how-can-pr... ? Seems robust enough ito safety and easy enough to use incl 2-Factor...

bckelly 15y ago

Shameless plug for http://duosecurity.com http://duosecurity.com We offer a two-factor cloud service to protect any kind of service that may be remotely accessed: web, ssh, rdp, vpn, ... Biggest difference from Google Authenticator is the smart phone user experience: one tap to approve a login instead of transcribing a six digit OTP.