12 ms·

> Unbeknownst to him at the time, Google Authenticator by default also makes the same codes available in one’s Google account online. This sounded absolutely c

• criddell 2y ago
  I use Authy and it does this too. I like that I can get the code on my phone or tablet. I also keep paper copies of the original QR codes in a safe place.
  • jeroenhd 2y ago
    The trick with Authy is to disable multi-device access unless you're in the process of adding another device, so hackers and scammers can't add their own devices to your account without your aid. If you leave the setting enabled, someone may get your TOTP secrets from Authy before you can stop them.
    • tasuki 2y ago
      No. That's not "the trick". As soon as it's in the cloud, it's over, it's gone, you've lost the game.
      • criddell 2y ago
        I've been using Authy for around ten years now, so I lost the game a decade ago and the consequences have been nothing and the benefits have been something. Not a bad loss IMHO.
        • tasuki 2y ago
          Good for you. Just wait and see...
    • mannykannot 2y ago
      If there is a trick to doing something securely, then that is already an automatic fail.
  • Natfan 2y ago
    You can just decode the QR code and use whatever secret is in there to generate the OTP codes. TOTP isn't that complicated, it's really just a second password that the system generates.
    • nilamo 2y ago
      While true, I haven't yet seen an authenticator app that let's you just dump the topt code yet...
      • kibibyte 2y ago
        1Password can show the whole URI with the seed, and I have used it in the past to tediously restore seeds to my other 2FA apps.
• acdha 2y ago
  It is at least relatively new. Years ago I had to try the Google “hard landing” account recovery process because it wasn’t happening, which is how I learned that they had that form going to an email address which had been deleted. Fortunately I had paper recovery codes in my safe.
  • te0006 2y ago
    Google rolled out that hare-brained "improvement" in an update to Google Authenticator a few months ago, with the nice extra that for some users, when you dared unselecting the new cloud backup checkbox, the secrets stored in the app were instantly corrupted in some way, so you were locked out of your Google accounts immediately as a bonus <chef's kiss>. Happened to a family member, luckily they had a working emergency access method. We will never use Google Authenticator again. Recommended alternative: 2FAS (https://play.google.com/store/apps/details?id=com.twofasapp https://play.google.com/store/apps/details?id=com.twofasapp) which allows you to import the secrets from Google Authenticator via QR codes, and has a local backup feature (e.g. to a USB drive).
    • bsder 2y ago
      As a side question: How do I, as a novice, vet a 2FA? This has all the "looks nice", but I have no reason to trust this recommendation over any other social engineering.
      • te0006 2y ago
        My first impulse after ruling out Google Authenticator was to simply switch to Microsoft's Authenticator app (which I already had to use for a work-related thing anyway), thinking "of course MS would not make the same stupid mistake". Turns out they would, and they did. So alternatives from smaller vendors were the only option. In evaluating them, I focused on popular open-source solutions that had the features I deemed important (notably, local backup), and looked into the history, provenance and reputation of their vendors. Nevertheless, some risk will always remain.
    • aftbit 2y ago
• Charon77 2y ago
  Was about to say this but yeah. Big brains at google didn't understand the number '2' in 2FA
  • mavhc 2y ago
    Most people wouldn't realise they can't recover their TOTP codes. But the hacker would still need to know your password surely
    • poincaredisk 2y ago
      ...so you agree that this is missing the '2' in 2FA?
      • buran77 2y ago
        For "something you have" to be true to its purpose it has to be something that has one and only one copy - so either only you have it, or you don't, but nothing in between. The second you have "cloud backup", or activate an additional device, or "transfer to a new device" then you turn the attack into "phishing with extra steps".
        • kibwen 2y ago
          You can support transferring to a new device without increasing the phishing risk, the transferral just needs to be done via a physical cable rather than via the cloud.
          • buran77 2y ago
            I'll grant you that it's a better option but by no means good if you want to stand on the 2FA hill and put security first (only?). That "just" does a lot of heavy lifting. The only time I'd consider transferring a secret like this is secure is within an HSM cluster. But these are exceptionally hardened devices, operating in very secure environments, managed by professionals. Your TOTP seed on the other hand is stored on any of the thousands of types of phones, most of which can be (and are) outdated and about as secure as a sieve. These devices also have no standard protocol to transfer. Allowing the extraction via cable is still allowing the extraction, the cable "helps" with the transfer. Once you have the option to extract, as I said, you add some extra steps to an attack. Many if not most attacks would maybe be thwarted but a motivated attacker (and a potential payoff in the millions is a hell of a motivator) will find ways to exfiltrate the copy of the keys from the device even without a cable. This is plain security vs. convenience. The backup to cloud exists because people lose/destroy the phones and with that their access to everything. The contactless transfer exists because there's no interoperability between phones, they used different connectors, etc. No access to the phone is a more pressing risk than phishing for most people, hence the convenience over security.
• andyjohnson0 2y ago
  Just checked and Google authenticator seems to be synced to my account, which is a huge SPOF and not what I want. It's possible that I did this without realising, but does anyone know of a way to revert authenticator to local-only? I don't see anything obvious.
  • mkbkn 2y ago
    Better option is to not use Google's TOTP app. Use something else
  • from-nibly 2y ago
    You can't revert, they keys are sent, they have them. They can't un have them. You'll need to rotate your MFA.
    • andyjohnson0 2y ago
      > You can't revert, they keys are sent, they have them. They can't un have them. You'll need to rotate your MFA. Not true. See https://news.ycombinator.com/item?id=42471459 https://news.ycombinator.com/item?id=42471459
      • shkkmo 2y ago
        You've missed the point entirely. The point is not that you can't recover the codes. The point is that if you are concerned about uploading codes due to the security implications (which most people on here are) then you need to do more than just disabling uploading, you also have to go rotate all the secrets that were uploaded.
        • andyjohnson0 2y ago
          I understood the point, thanks. But I'm concerned about the scenario in the article, where someone did a device recovery and got access to the cloud synced auth codes. I don't particularly like that my codes were apparently synced to Google's cloud without my being aware, or the ux that prevented me from noticing. But I'm pretty confident that, having disabled the cloud sync, Google no longer has my codes (And in fact I verified this by installing the authenticator on a tablet before turning off sync on my phone. The codes vanished from the tablet.) In principle, yes I should rotate all the secrets. Because google may have borked their data retention, or is just outright lying and keeping my secrets. In practice, though, for my personal account, I'm content that nothing has been compromised.
• Tester4675 2y ago
  What's crazy to me is that Google would allow access to a foreign device from a single click. It would be easy for a person to accidentally click it, or for a kid playing on their parents advice to click it when it popped up. I really can't understand why they wouldn't send a code that would have to be entered instead; it would be far less prone to those kinds of problems.
  • vel0city 2y ago
    "foreign device" based on IP geolocation is pretty tricky and annoying. My home in Texas had an IP address which a lot of databases had as supposedly being in Montreal. It was like that for years. Gotta love so many sites trying to default to French.
    • UltraSane 2y ago
      As a network admin I have found that whitelisting only US address space for my companies IPs drastically reduces how many attacks we get.
      • vel0city 2y ago
        As a person who had to deal with clients, I have found whitelisting to only "US address space" lead to lots of clients being unable to access the services until they were whitelisted. As a person who had to deal with other associates, I also found whitelisting only US address space led to a number of people being unable to connect from their homes. As a person who had this happen to them, I had quite a lot of frustrations with services insisting they couldn't provide me service because Texas is in Canada apparently.
        • UltraSane 2y ago
          of course before implementing this I log all IPs and verify that we don't have any legitimate traffic coming from non-US IPs. and whitelisting a few IPs isn't a big deal. Of course a medium sized manufacturing company in the Midwest isn't going to have much need for people connecting to use outside the US. I'm actually working to get rid of any public IPs that isn't a VPN access point.
• UltraSane 2y ago
  Google only added this feature recently. I am really conflicted about this feature. Without it you need to either save every TOTP code when you first set up the account or manually disable 2FA on every account and then enable it again so you can enroll it on a new phone. I used it when migrating to my most recent cell phone but then disabled it. Of course you have to trust that Google actually deletes the codes from your account.
  • TimTheTinker 2y ago
    Generating and storing your passwords, OTPs, and passkeys in a fully E2EE system like 1Password is effectively a root of trust, although you also have to trust (a) the password manager company, (b) whatever third-party systems and devices they use to build and deliver their software, (c) the quality of their cryptosystem, and (d) whatever device you use to decrypt/access secrets in your vault.
    • UltraSane 2y ago
      I trust 1Password. They are very open about how they encrypt data and how the key is derived. I like how they store your encrypted data locally in a SQLite DB. My only real concern is with storing passkeys because they cannot be stored locally yet and you are granting 1Password control over your access to any site you need a passkey stored with them. They are working on a passkey exporting process. I would feel better if I could have the same Passkey stored by 1Password and Azure and Google.
      • tempestn 2y ago
        What is the advantage of passkeys compared to managing unique passwords with 1pw? Is there any tangible benefit to switching, besides that Google et al will stop hounding you to do so?
        • UltraSane 2y ago
          Passkeys are asymmetric keys so a hacked site cannot leak the hash or even the plaintext of a passkey. And the private key is never exported to insecure hardware. Funny how so many Linux gurus have been shitting on using passwords for SSH for decades in favor of using SSH keys and now that there is an actually effort to use what are essentially SSH keys tied to a specific domain they are rejecting it.
• __turbobrew__ 2y ago
  There is a big gap in the greater security landscape here. I personally use hardware authenticators for this reason, but I have to manually enrol each security key for each account. Really what I would like is a root of trust which maybe is a cipher text which I can store in several physical locations, and then my security keys are derived from that root of trust. Then when I set up 2fa with a service it is using the root of trust and seeing that my security keys are is derived from that root of trust. This allows me to register the root of trust only once and then I can use any key derived from it.
  • AgentME 2y ago
    Some cryptocurrency hardware wallets such as Trezor's are usable exactly how you want: they support fido2/webauthn and derive their keys from the recovery seed phrase. You can write down the recovery seed phrase, initialize other hardware wallets with the same recovery seed later on, and they will present to a computer as the same fido2/webauthn token.
    • emmelaich 2y ago
      If it's hardware it can break or be lost or stolen.
      • AgentME 2y ago
        As I said, you can write down the recovery seed and initialize other security keys from it, so you're able to deal with a hardware wallet breaking, unlike most fido2/webauthn security keys. Hardware wallets also require a pin to be entered, so they're more secure against being lost or stolen too than security keys that don't need a pin.
• Symbiote 2y ago
  I'm shocked how often one of my ~50 colleagues asks me to reset their 2FA. It's every 6-8 weeks or so. Their personal accounts will be affected in the same way (lost phone, new phone etc).