11 ms·

Please turn on two-factor authentication

224 points by cleverjake 14y ago

kral 14y ago
Done.
coffeecheque 14y ago
I really hope other services start offering it as a feature. Namecheap, I'm looking at you. DNS web apps are a huge possible attack vector. Also, RE the Google one time use passwords for POP/IMAP. They are all lower case, alpha/numeric, and 8 chars long. How secure are they against brute force? Why wouldn't Google offer 16 char options, or even longer? Is 8 good enough?
- scraplab 14y ago
  I make it 4 blocks of 4 random alphanumerics each, which is a pretty big search space.
- nodata 14y ago
  > Is 8 good enough? Depends on how good their intrusion detection is.
- zapman449 14y ago
  the application specific passwords are 16 characters long. Four blocks of four lowercase characters. I too would rather them be longer, and involve at least some numbers if not specials... but they're not THAT short.
  - coffeecheque 14y ago
    Really? I was sure it was only 8 when I went through the process 2 weeks ago. 2 lots of 4. Time to go and generate some new passwords!
    - pooriaazimi 14y ago
      Hmmm... I generated a batch about 2 months ago and another batch last week. In both cases, they were of the form llll llll llll llll (l: [a-z])
      - coffeecheque 14y ago
        Happy to stand corrected. My apologies all round. Thanks everyone!
    - zwily 14y ago
      They've been 16 chars for at least several months.
- slig 14y ago
  > Namecheap, I'm looking at you. DNS web apps are a huge possible attack vector. The least they could do if offer IP whitelisting like Linode does.
  - alfiejohn_ 14y ago
    Doesn't help if they target your provider: http://slashdot.org/story/12/03/02/0059202/linode-exploit-caused-theft-of-thousands-of-bitcoins
- drcongo 14y ago
  I'm getting 16 character app specific passwords having just turned it on on one of my Google Accounts (all lowercase alpha though).
Lagged2Death 14y ago
Am I the only person in the world who doesn't have a cell phone? It annoys me that the two-factor auth setups at sites (like Google) assume I have one and don't even have an option for "I don't have a cell phone, please stop nagging me about this."
- nodata 14y ago
  Yes you are, and I suspect you know this. Even in most third world countries cell-phones are common.
  - acqq 14y ago
    Still, if I plan to use Google Authenticator, I don't want to give Google my phone number at all. When they insist to get the phone number from me, I don't like it.
    - nodata 14y ago
      Are you talking about Google Authenticator the Android app, or the SMS service?
    - pooriaazimi 14y ago
      I don't think you need to get them a phone number. I use Google Authenticator app on my iPhone, and didn't give them anything. It just scanned a barcode on a webpage IIRC.
      - zumda 14y ago
        The bar code was actually just a code to initialize the code generation (I think it is based on that randomly generated seed and the time, so that then server and client generate the same keys). You could have also typed in the code by hand.
        pooriaazimi 14y ago
        You're absolutely right. My parent was talking about giving Google his/her phone number, which I was responding to :)
the1 14y ago
turned it on. was so annoying that i removed google accounts.
oddthink 14y ago
I did this a few months ago, but I'm thinking of turning it off. I know it's trivial, but there's something deeply annoying about being dinged $0.20 a pop for the SMS message to get the code. I'll have to see if I can set up the Google Authenticator; I hadn't heard of that before.
- yock 14y ago
  Even without GA (which, if you have an Android or iPhone, I don't see why you'd have to be without) $0.20 a month seems an incredibly small price to pay for the benefit of 2-factor auth.
  - oddthink 14y ago
    I know, it's irrational, but it adds an extra annoyance factor, far more than it should. I mean, I spend far more every time I take the subway somewhere. Driving across the GW bridge costs $12, and I don't worry myself about that. It turns into four or five SMS every month, when I usually average zero (various computers, various browsers, etc.) So suddenly, there's this line item where there used to be none. I can't explain quite why it bugs me. In any case, I hadn't heard of GA before. I've installed it and life is good.
  - icebraining 14y ago
    which, if you have an Android or iPhone, I don't see why you'd have to be without You don't even need one of those, there are implementations of the same algorithm for other systems. I use my Nokia S60 with a J2ME application: http://ds3global.com/index.php/en/news-a-events/news/97-securing-data-delivery-hassle-free http://ds3global.com/index.php/en/news-a-events/news/97-secu...
- shawabawa3 14y ago
  You pay for incoming SMS? How does that even work?
  - mike-cardwell 14y ago
    It is standard to pay for receiving as well as sending SMS in the US. Everybody knows this is insane.
mistercow 14y ago
It's a good idea, but it's not the weakest link in user security right now. It does very little to solve problems like Apple positively identifying people based on totally insufficient and publicly available information.
- acdha 14y ago
  > It's a good idea, but it's not the weakest link in user security right now I suspect Google is in a better position to judge how widespread account compromises are than you are. From my perspective, it definitely seems like security people are all saying that account compromises (keyloggers, phishing) have been the predominant threat for several years now because they're suitable for bulk attacks whereas social-engineering Apple is a more limited, if deeply disturbing, process.
  - mistercow 14y ago
    >I suspect Google is in a better position to judge how widespread account compromises are than you are. There are a couple of problems with that reasoning. First off, I don't see where anything Google has said contradicts my point. Yes, MFA is a good idea. But that doesn't mean it's enough to prevent attacks like the one in question. Secondly, Google is not an unbiased source on this matter. For cloud services to succeed (which Google is banking on), it is very important that people perceive that they (the people) have some kind of control over their own security. It is reassuring to hear "here are some steps you can take to make yourself safer". It is terrifying to hear "your security ultimately hinges on the competence of some of the lowest-paid employees of the faceless corporations you rely on". Both of those statements are true, but you're never going to hear the latter emphasized by Google or any other company heavily invested in the continued success of cloud based services. (Which is not to imply that they are dishonest; bias is usually as more about delusion than deception)
    - acdha 14y ago
      My point was simply that Google sees enough attempts to compromise Gmail accounts that I believe them when they claim widespread attacks using valid passwords are common enough that passwords are broken. > Yes, MFA is a good idea. But that doesn't mean it's enough to prevent attacks like the one in question. It would have stopped this one, in several ways: according to Honan's writeup, it would have halted things at a key point in the chain of account compromises. Yes, it's true that you have to trust companies - but that's always been true, even 100% off-line, as any victim of identity theft could tell you. The key point is that having any sort of MFA schema would have contained the damage to one company, halting the cascade.
smountcastle 14y ago
I did this but was expecting more from Google. As an example, it was easier to add two factor auth to my Blizzard account (and install their authenticator) than it was for Google. These are the steps for Google: - Add mobile phone to account - Enter code from SMS - Generate random passwords for multiple apps which don't support two factor auth (this took awhile). - I wasn't given any instructions on how to switch from SMS to Google Authenticator app so I had to search for those instructions and then set that up. Granted Blizzard controls the entire experience, they're not dealing with 3rd party apps, but it seems like Google could make this easier. And once it's trivially easy to setup, then it can be made the default.
- brown9-2 14y ago
  The difference is, as you mention, that for your Blizzard account there is one app that needs to be changed to use 2FA, whereas with Google you are using your account from dozens of apps that they do not control and that can not be made to support the 2FA login process. It's an unfair comparison.
xfax 14y ago
Two-factor auth gets old really fast when you have to use public computers in a setting like a college library. I had turned it on for a while, but turned it off when I had 5 minutes to print out a paper that I had emailed myself (yes, I still do that) and was fiddling with my phone to get the damn PIN. Never again.
- alfiejohn_ 14y ago
  Maybe it's just me but I only trust computers I control. If you don't have root on a box, consider it pwn3d with keyloggers listening to every juicy password you type. Take that as your friend's laptop, a library computer or even your parent's Windows XP box... Trust no one, Mr. Mulder. /tinfoilhat
  - xfax 14y ago
    Yeah, that would be great if the damn wireless printing worked in school. Sometimes you just have to log into a public machine.
    - alfiejohn_ 14y ago
      You couldn't use a USB key instead?
      - xfax 14y ago
        Sure I could. Not denying that there are other ways to get access to the files I need, just that this has become a part of my workflow that two-factor auth disrupts.
        Johngibb 14y ago
        I think having a second gmail address just for emailin yourself files for public computers might work for you. Keep your personal email safe, and forward what you need to the other address. It's a good compromise. Don't underestimate how vulnerable you are when your email gets hacked - virtually every service you use can be accessed by the forgotten password mechanism when your email is breached. I'm pretty lazy and have procrastinated for a long time, but with the recent attacks and realizing what a mess I could face if hacked I finally implemented two factor auth and I have no regrets yet.
avar 14y ago
Something Google could to do drastically improve the security of their two-factor authentication system is to add the ability to give more granular permissions with the application-specific passwords. I have an application that only needs to send E-Mail through my GMail account (git-send-email), another that only needs to write to one specific GMail label (Android SMS Backup), and Google Chrome surely doesn't need access to everything. But you'd get full access to my account if you compromised any of these. They already have this for the Connected Sites, Apps, and Services. I sent them a feature request for this a while ago but it hasn't been answered (and there's no way to view it online).
- estel 14y ago
  I didn't think Chrome any longer required an ASP?
  - deleted 14y ago
    [deleted]
  - jarito 14y ago
    Still did as of a month or two ago when I turned on two-factor.
  - gecko 14y ago
    It still does; I had to go through this yesterday. I don't mind Chrome so much per se, but this also means you need an application-specific password for Chrome OS, at least for he initial sign-on, which I find oddly frustrating.
    - jrockway 14y ago
      It does if you set up the sync account via the Settings page, but if you ignore the request to sign in, visit some Google page that requires login and log in, Chrome will produce a yellow bar at the top of the screen asking if you want to use that account for Chrome sync. Click yes and you don't need to sign in any further.
  - 14y ago
macspoofing 14y ago
Do you trust the minimum wage customer service reps of your phone company to not be susceptible to social engineering? Two factor-auth, via SMS, may not have saved Matt Honan.
- ConstantineXVI 14y ago
  Use the app, it's not vulnerable to such an attack. Or buy a prepaid phone, and don't use the number for anything else.
nicholassmith 14y ago
I'm sure someone is probably working on this, but what about a service that generates a one off seed for the second stage of auth, married with either a desktop or smartphone app for generating it for the user. Lose your phone/laptop/PC simply cancel it remotely so it stops generating, same as you would if you lost your bank card. I'm sure I'm missing something, but I'm not sure what. EDIT: I'll let the post stand but I need to read more clearly, I thought Google Authenticator was purely for Google services.
- alfiejohn_ 14y ago
  Already on the market - YubiKey.
- lreeves 14y ago
  You can actually authenticate against the GA product from any system - hook it into PAM for sshd access, use it for another factor in OpenVPN, or even just wire it into Apache: http://code.google.com/p/google-authenticator-apache-module/ http://code.google.com/p/google-authenticator-apache-module/
kernel_sanders 14y ago
I'm glad this is on the front page again. I just set mine up. thx internet.
JunkDNA 14y ago
I was worried this would be a major pain when I enabled it, but I have to say, it has been much more painless than I thought it would be. Most of the time, I don't even think about it. Most of my consumption of google mail is through clients on my laptops, iPhone, or iPad. So in that sense, it's not much different from a regular password. The difference is that someone else has a much harder time cracking my account. It's actually much less obtrusive than using lastpass (also highly recommended, but not as transparently usable). That being said, two factor google auth wasn't going to save Matt Honan here. Identity, trust, and authentication on the internet are all built on a foundation of sand. We need a new model.
- Xyzodiac 14y ago
  Same here, I just enabled it a few days back and it's much easier than I imagined it would be.
- ja27 14y ago
  If you've spent your career with RSA SecurIDs hanging from your keys, this isn't much of a hassle. I didn't realize that LastPass and others can use the Google Authenticator.
  - quinndupont 14y ago
    I was just thinking that Google should open their service to others... Makes me think about switching from 1Password to Lastpass...
- danso 14y ago
  Why wouldn't two-factor authentication protected Mat from at least his GMail account being hacked? Even if password-resets were being sent to the .Me account, wouldn't the hackers still need to generate the authentication token?
- gilrain 14y ago
  According to Matt (and, apparently, his hacker) you're wrong; two-factor would have saved him in this particular instance: "If I had some other account aside from an Apple e-mail address, or had used two-factor authentication for Gmail, everything would have stopped here." (http://www.wired.com/gadgetlab/2012/08/apple-amazon-mat-honan-hacking/all/ http://www.wired.com/gadgetlab/2012/08/apple-amazon-mat-hona...) Naturally, it's not a panacea, but I think a lot of people allow perfect to be the enemy of quite good when it comes to two-factor auth.
revjx 14y ago
I've been avoiding doing this, and I'm not certain the reason is valid - I don't want Google to have my mobile phone number. Perhaps I'm being overly cautious, but the fact Google already collects such a huge amount of data on me, coupled with the increasing insistent requests to enable two-factor with my mobile phone number, has made me not do it. I got so sick of being pestered about it that I stopped using Gmail a little while ago.
- jarito 14y ago
  You don't need to enter your phone number to use Google's two factor. You can use their smartphone application to generate codes. If you don't want to do that, the algorithm is free and open-source so you can probably find an alternate implementation that works fine.
  - crumblan 14y ago
    Unless I am mistaken, they won't let you do two-factor auth at all unless you put a phone number first.
    - nollidge 14y ago
      I don't think they need a phone number if you use the Google Authenticator app on your phone. The pin for that is generated based on an initial random seed and the current date/time, not your cell number.
      - fr0sty 14y ago
        They do require it. If you remove it 2-factor-authentication is disabled. Nothing says that number needs to be your mobile (or one that you have regular access to) but you do need to provide one.
        SnowLprd 14y ago
        Does that mean that you could use a Google Voice number? Presumably they already know that one, so "divulging" it shouldn't be an issue. ;^)
zumda 14y ago
I'm always dumbfounded when these topics come up and a lot of people start saying how inconvenient it is, that it is all wrong. But these are probably the same people which later accuse Google that they didn't do enough to protect their accounts! Yes, two factor authentication is a small hassle. Yes, two factor authentication requires a bit to set up. But do you realize how much actually depends on your email account being safe? For one, how many times did you use Googles OpenID provider? Yes, that's your Gmail account! Or for how many services did you use your Gmail account as the email address? You know that password resets go to that account, right? Don't do that? Maybe you use Google Calendar, then. So yes, there is actually a lot of sensitive data in there. If you don't believe me, try to get a hold of a friends calendar, and see what you can guess about that person just from the calendar. Or should someone just post some slander about you on you G+ profile? Or buy some apps from the Android Market? Of course this things never happen to you... So just take the time to, besides looking at the time or the latest message on your phone, open that stupid app and type that stupid code in! It's not THAT much work!
Kiro 14y ago
I just turned two-factor authentication on and it forced me to set "program specific" passwords for like 10 different apps and seriously messed up my phone. I had to deactivate it. What's with the hassle?
- Semaphor 14y ago
  Not everything supports the 2-factor auth. And of course you have to set up specific passwords for those. ONCE! You wont have to do that again. What did you expect? That it magically made everything work? Some people -.- And I have no clue how you managed to mess up your phone… By entering new passwords??
  - Kiro 14y ago
    Why can't they just use my "old" password? I don't want to set up 10 new passwords. And yes, I was expecting it to magically work by just enabling it and enter the SMS code. This is too much hassle for something I don't really care about (I don't keep anything of value anywhere online or in my computer/phone).
    - Semaphor 14y ago
      Why? Maybe because that would defeat the whole purpose? And why use a (relatively, before someone calls me out) high security measure for something unimportant in the first place? You wouldn't use a full biometric security scanner setup for your pantry either, would you?
- maxerickson 14y ago
  For the second factor to mean anything, all the apps that don't support it need a password that has less rights. Hopefully they figure out a nice way to make the rights more granular (so that a chat app can't mess with email or whatever).
  - sp332 14y ago
    Do those passwords have less rights? I figured that if any of those passwords got compromised, you were screwed (until you found out which one and revoked it).
xmpir 14y ago
did it today :)
andyakb 14y ago
really surprised so many people that post here refuse to use google authenticator because its "annoying." is it a hassle? yes, but if you have ever had your email (and other accounts) compromised you understand why it is worth that small 5 second hassle when you login. one feature that i cannot understand why it hasnt been implemented though is protecting the app itself with a password or pin. some people say to just protect your whole phone, but i dont really want to do that because to me that _is_ too large a hassle. if i lose my phone i can revoke access to my email and other similar apps, but not if the person that finds it opens up google authenticator (which shows the account the id is used for) and logs in to change the password before i have a chance to. even just allowing for it to display an account nickname instead of full login would be a huge step forward
- sp332 14y ago
  It's not a 5 second hassle. I don't get a cell signal in the steel gymnasium even though the wifi works fine. I physically have to go outside to get a code every time I want to log in. And then if my phone is not working, or I leave it at home, I'm screwed.
  - fr0sty 14y ago
    FTA: You can install a standalone app called Google Authenticator (it’s also available in the App Store), so your cell phone doesn’t need a signal. Also: You can print out a small piece of paper with 10 one-time rescue codes and put that in your wallet. Use those one-time codes to log in even without your phone.
    - sp332 14y ago
      Hm, can you generate new codes whenever you need to? It might be cool to use these 10 at a time as a one-time pad.
      - prawn 14y ago
        Yes, you can revoke those printed codes or issue more whenever you like.
dholowiski 14y ago
Sigh, OK. I'm turning it on today. Was going to do it right now, but then I realized that I'm at Starbucks right now... probably not the best time to be messing with passwords.
billpg 14y ago
Is there a way to use a separate hardware device? Using my phone as the second factor is nice, but my phone is vulnerable to theft because of its value for resale. A sealed gizmo that shows a number just looks like an el-cheapo souvenier. Without knowing my username and password too, it really is worthless.
- jsight 14y ago
  The linked article mentioned this: http://static.yubico.com/var/uploads/pdfs/Howto_GmailYubiKey.pdf http://static.yubico.com/var/uploads/pdfs/Howto_GmailYubiKey... YubiKeys are relatively cheap and would provide a nice alternative to using a phone, IMO.
mike-cardwell 14y ago
I hear a lot of people advising to turn on two factor auth on Google because of this incident, but I haven't heard anyone say that we should be deleting our card details from Amazon. Well, I have, and you should too. Lots of places use the last 4 digits of your card as "authentication", and Amazon happily displays those details in your account.
- bcl 14y ago
  Note that they had to break into the account in order to view those last 4 digits. You seem to be implying that they show them to anyone. Either way, using the last 4 digits as 'security' is just stupid. You can get those from a receipt.
  - danso 14y ago
    * Edit: Ah, technically they did break into the email account. The first time I read this I thought that they just had access to the account info page (doing things, such as purchasing or accessing account settings, requires password-entry by Amazon) No, they did not have to break into the Amazon account. http://www.wired.com/gadgetlab/2012/08/apple-amazon-mat-honan-hacking/all/ http://www.wired.com/gadgetlab/2012/08/apple-amazon-mat-hona... > First you call Amazon and tell them you are the account holder, and want to add a credit card number to the account. All you need is the name on the account, an associated e-mail address, and the billing address. Amazon then allows you to input a new credit card. (Wired used a bogus credit card number from a website that generates fake card numbers that conform with the industry’s published self-check algorithm.) Then you hang up. > Next you call back, and tell Amazon that you’ve lost access to your account. Upon providing a name, billing address, and the new credit card number you gave the company on the prior call, Amazon will allow you to add a new e-mail address to the account. From here, you go to the Amazon website, and send a password reset to the new e-mail account. This allows you to see all the credit cards on file for the account — not the complete numbers, just the last four digits. But, as we know, Apple only needs those last four digits. We asked Amazon to comment on its security policy, but didn’t have anything to share by press time.
    - 14y ago
OoTheNigerian 14y ago
Like the second class citizens of the web we are, Nigeria does not have 2 factor authentication. Ghana, Pakistan, Iran, North Korea, Russia, all have 2 factor authentication. Why not Nigeria? This is just another example why being Nigerian is kinda hard on the internet. https://accounts.google.com/b/0/SmsAuthConfig https://accounts.google.com/b/0/SmsAuthConfig http://oonwoye.com/2011/01/23/life-as-a-second-class-citizen-of-the-web/ http://oonwoye.com/2011/01/23/life-as-a-second-class-citizen...
- nodata 14y ago
  > Why not Nigeria? Can Nigerians use the Google Authenticator app? If yes, then the answer is probably high SMS costs.
  - OoTheNigerian 14y ago
    High SMS costs? It is exactly why I put the range of countries above. Can we be in a worse situation than them all?
    - nodata 14y ago
      Then why? Lack of demand? Market not interested? Support costs too high?
larsberg 14y ago
It seems to work well with Firefox and Safari, but I've found that two-factor auth doesn't work well with Chrome if you've set it to clear cached files (not cookies) on exit. For some reason, that setting causes Chrome to lose the 30-day permission, so every time Chrome crashed or I rebooted my machine, I'd have to go through the SMS dance. Doesn't happen with the similar setting in Firefox.
mike-cardwell 14y ago
Somebody should set up a website dedicated to listing organisations and what information is required in order to obtain access to an account at that organisation.
Karunamon 14y ago
The reason I'm not using 2FA right now is twofold. First, because Google doesn't have half of their services using it for some undefined reason (for at least a year plus!). Also, the whole "app specific password" thing is a huge pain in the ass. (And appears to randomly stop working on say, IMAP mail). Second, because the mobile authenticator is not feasible for me right now. I do a lot of android development work (well, mostly screwing around, but we'll call it work) on the side, with the result that I'm wiping my phone for romflashes at least once a week. Makes everything going through a mobile app a little useless. I really wish Google would support a hardware token of some kind.
- smackfu 14y ago
  Yes, can someone explain why Google Chrome doesn't support 2FA on the desktop or iOS? It's bizarre. (Well, I suppose it's tragically normal. I'm sure there is a corporate directive that says every Google service must support 2FA, but Chrome has an exception so they don't need to do it yet.)
  - mithaler 14y ago
    Dunno about iOS, but Chrome does on the desktop; it asks you for an application-specific password when you turn on sync.
    - smackfu 14y ago
      OK, but it should be asking your for an authenticator code instead. It uses this bizarre "normal password + app specific password" requirement that isn't used anywhere else.
      - gergles 14y ago
        Your data is encrypted with the normal password, so it needs it to decrypt the sync data. The App-specific password is used to log in to the server to GET the sync data in the first place.
smackfu 14y ago
OK, so I turn on two-factor authentication for GMail, but... 1) I immediately have to create a application specific password to actually read my mail on my iPhone. 2) If anyone ever gets access to that secret password, or any of the others I create, they have full access to my email and any password resets they generate. 3) I will have no idea this is happening since I would expect my mail to access that app password daily. So your fancy two factor authentication still ends up resting on one piece of secret info as the weak point. Am I missing something?
- roc 14y ago
  You only type that application specific password once. You're not typing it to log in via wifi at coffee shops, airports, etc. You're not typing it every day for a keylogger to pick up, should your machine be compromised in the future. You're not typing it into borrowed machines or net cafe machines in some hotel business center. So, no, it isn't perfect, but it's a heck of an improvement. That is, if you believe your machine to be reasonably secure on day 1.
  - sigkill 14y ago
    Calling it an "application specific password" is actually a misnomer. WE create the app-labels. For all practical purposes it's a backdoor entry into your account. So, I'd say for absolute 2FA, you must give up Chrome browser profiles, device mail sync (till Google comes up with a compatible client) and Google Talk/any Jabber client. I don't care about Chrome browser profiles but I need/want my Android phone to have full connectivity viz. push mail and gtalk access to my account. I could always keep a separate browser window on the PC with my gmail signed in and IM notifications enabled for my third point. Overall, I feel losing my Android connectivity is not worth the 2FA.
- adgar 14y ago
  > So your fancy two factor authentication still ends up resting on one piece of secret info as the weak point. Am I missing something? A vastly reduced, easily managed attack surface area that in practice results in overwhelmingly fewer account compromises.
OriginalSyn 14y ago
The only time I regret turning on TFA is when I'm laying in bed with my laptop and my phone is slightly out of reach.
peterwwillis 14y ago
Here's why I don't use two-factor authentication for my Google accounts. It's not worth it. I don't run a business. I'm not a celebrity. I don't keep confidential information in my e-mail. And I don't register all of my various accounts at sites around the web to just one e-mail address. If someone got access to one of my e-mail accounts it would probably be a general-use one, and quite honestly it wouldn't affect me much. It's also annoying to have to verify every time I log in. I probably log in more often than most people. When my browser session ends, all my cookies, cache and history are erased (not because i'm paranoid, but to help guard against CookieMonster, history probing and similar attacks on sites that don't do secure browsing right). Even though it may only be occasionally, having to go find my phone to authenticate the login takes away from my browsing experience, and I don't find the tradeoff worth the hassle. It doesn't help that Google's authenticator medium is SMS. As a hacker, I find there's way too many avenues to intercept the token (not the least of which is an already-logged-in Google Voice session!). I like the idea of using a YubiKey, but if I have to stick the device into my computer, it's annoying. I prefer plain-old tokens like RSA's SecurID or the PayPal token (I got mine when it was still only $5). But it's not automatic. I have to do a bunch of work to set it up, and i'm lazy. At the end of the day, even once you set up two factor, a good attacker will still get past it if they really want to. Separation of accounts will go a lot farther towards keeping your digital self safe than putting all your eggs into a two-factor single-account Google basket. Edit: This post has encouraged me to pay the $20 for Bank of America's SafePass Card, which I consider to be much more secure than an app or sms.
- fr0sty 14y ago
  Please, please, please, please RTFA before ranting. SMS is not required (you can use the google Authenticator App). The Authenticator app works just like a "plain old token". Separation of accounts means squat if your passwords are intercepted. 2 factor auth requires physical access and reduces the possible pool of attackers from billions to hundreds.
  - nagisa 14y ago
    You still need to hunt for phone (on top of that you must have one) to log in...
jonknee 14y ago
What's the status of Google's two-factor authentication with Sync (Exchange)? Last time I tried it was a mess and the added security was not worth the hassle of not having everything pushed and kept up to date.
petenixey 14y ago
I'm really frustrated with Google and this 2-factor authentication. They are in such a great position to really change the way in which people secure themselves and they've completely missed the trick [edit: FOR THE AVERAGE USER]. Google 2-step auth is very hard to use and for how hard it is to use it doesn't provide all that much protection. It protects against phishing (mostly) but not against someone who has your phone. Malicious ex-girlfriend trying to do you harm? Google 2-factor won't help you a bit as long as at some point she had access to your phone. Any security improvement is better than no improvement so let's concentrate on the real issue which is ease of use. 1. Google 2-factor auth requires application specific passwords are deeply confusing I founded Clickpass and I can only just get my head around this. One password per application? This is a very confusing concept and very difficult for the average person to understand. There's no indication of whether you can reasonably create one password and reuse it in all your apps (which I think you can). Application specific passwords are very confusing and not that much more secure than one revokable password for all applications. 2. Application specific passwords are almost impossible to use on mobile apps Ever tried copying a 12-digit long string into a keyboard which only shows you the last letter you entered and even then only for half a second? It's really hard. You can't copy and paste them and you have to have a computer nearby to do it (it's very hard to use the Google password-generator page on mobile) Here is the list of the application-specific passwords that have to be individually entered (10+ characters each): On my mobile - iphone mail - iPhone Google account (through browser) - iphone work mail - iPhone (work Google account through browser) - iphone calendar - iPhone calendar (work) DUPLICATE ALL OF THE ABOVE FOR iPad DUPLICATE ALL OF THE ABOVE FOR MacBook Air Switch on 2-factor auth and you immeidately find all these apps go dead until you do this. It will take you about 15m at least to do this and you'll have to do it again if you change your password or get a new device. You can't copy and paste because the Google auth-token page is unusable on moble. What we need is easy, incremental security improvement The problem with Google 2-factor auth is that it was designed by security geeks. It takes 3m just to watch their setup video! The system needs to be designed by usability geeks and audited by security geeks. 2-factor auth is no use at all if it's switched off. Contrast my switched off 2-factor auth with my Facebook auth which texts me every time someone logs in from a new machine and you contrast a system which provides me with a bit more security (FB) and one which pertains to be secure (Google) but which adds nothing. Google needs to rip the security guys out of their security team and put the user experience people in. End-user security is a UX problem and Google is in a powerful position to effect change. [Edited above for (a little) brevity] EDIT BELOW: for folks who feel this account is unfair: I realise that if you keep a PGP encrypted file on another device that is necessary to do your password reset then yes, Google 2-factor auth is very strong indeed. I also realise that you shouldn't tell someone your password. The point is though that resetting your password is something that only really needs your phone. The key elements to resetting your password usually involve sending a password or an out-of-channel token to another acccount. For most people that other account is their work mail or Facebook, both of which are usually accessible via their phone. I'm not talking about the absolute strength of Google 2-factor authentication. I'm talking about how that type of process applies to the type of internet user who tries to log into Facebook through ReadWriteWeb: http://www.readwriteweb.com/archives/facebook_wants_to_be_your_one_true_login.php http://www.readwriteweb.com/archives/facebook_wants_to_be_yo...
pikewood 14y ago
I'll propose a sideways solution: implement an "Administrator" mode on these accounts that requires separate authentication--perhaps enforcing two-factor authentication there. There are many complaints about how Microsoft didn't protect Windows users enough because everyone had administrator access as a default. But isn't that the same problem with these Google and Apple accounts? With your standard account, you can change your password, delete all data, and do many other damaging acts. I don't really want to enter in multiple pins/passwords each time I read email. But I would be more than fine doing so before being given the ability to damage my account.
3amOpsGuy 14y ago
Browser compromises are the one I worry about. A remote attack that reveals everything your browser has or knows. I've been using 2 factor on google for a year or so now. It's not perfect - especially the ways it can be disabled - but it's better than the status quo for now.
tammer 14y ago
Quick question for all you security experts: Which is more secure: LastPass with 2factor, or a gpg encrypted password safe on my home server accessed by a passphrase-locked rsa-encrypted key? I've been trying to decide for the past few weeks. Copying and pasting passwords isn't as annoying as I thought it would be, and it seems like keeping my pwsafe locally reduces the attack vector of the LastPass servers. Then again, it's in LastPass's absolute interest that my info never gets leaked, and they've built up a good reputation. Further, at a public terminal my usb drive would need to be connected while I unlock the key, thus possibly exposing my unencrypted key. Any ideas?
- sigkill 14y ago
  At the absolute best, I'd say using an app like Pocket (on Android) on a non-network connected device is probably the safest setup. Granted you'd have to type the passwords in manually, but nothing beats air-gap security, and you'd need to remember just one password. Also, if you lose your device, you're screwed, unless you've dropbox synced it of course. In which case, you lose the air-gap.
- mike-cardwell 14y ago
  LastPass is only one persistent XSS flaw away from having your password store completely compromised. I found a non-persistent one last year which exposed a lot of information about you, but not your password: https://grepular.com/LastPass_Vulnerability_Exposes_Account_Details https://grepular.com/LastPass_Vulnerability_Exposes_Account_... Specifically it exposed your email address, your password reminder, the list of sites you log into and the history of your logins, including which sites you logged into, the time and dates you logged into them, and the IP addresses you logged in from. EDIT: I used to use LastPass but now I use a GPG encrypted file, which I sync between machines. I set up a simple helper script so I can just type for example "password facebook" at a terminal and it will do a gpg --decrypt on the text file, grab the facebook password, display it, and also copy it into my clipboard for ten seconds.
  - tammer 14y ago
    Thanks for the detailed info! Combined with two-factor ssh auth[0] for using a public connection, looks my gpg file is the perfect solution. [0] http://news.ycombinator.com/item?id=3029680 http://news.ycombinator.com/item?id=3029680
joshstrange 14y ago
Well I turned on two-factor authentication and then updated Sparrow (iOS and OS X) with the new password and everything was fine... Until the iOS version constantly kept telling me I had an incorrect password. I tried various troubleshooting tips online but to no avail. Until I can use this with everything I can't use it at all.
cs702 14y ago
Two-factor authentication improves security, but cannot solve the online security problem for most people, because the vulnerabilities are primarily CULTURAL: the average person does not understand the risks nor what they could do to ameliorate them. Compare the attitude towards security that people have in the physical world with their attitude online. No sane person would ever want to use the same exact key to open their home, car, desk, safety deposit box, etc., because that would obviously be unsafe. Yet most people today will happily use the same easy-to-remember password for all online accounts without giving it a second thought. Similarly, no sane person would ever lend their wallet and keys to a stranger, because that would obviously be unsafe. Yet most people today will happily walk into an Internet cafe or hotel business center and enter all their online credentials without giving it a second thought. Providers of online services like Google, Amazon, Apple, etc. will find it difficult to solve the security problem until society has evolved its understanding of, and attitude towards, online security. -- Edit: softened the tone of the last paragraph to make it more accurately reflects my views.
- sigkill 14y ago
  I do agree with you on the key analogy but there's a security breach there as well. Most of the keys are generally found on the same keyring. So, in effect it's identical to using a single password.
  - cs702 14y ago
    That's true only to some extent: people keep on their keyring only those keys they need for daily use. Less frequently used keys (e.g., keys to a safety deposit box at the bank, keys to a home safe, keys to a second home) are typically stored in a drawer, a closet, or a safe. Also, note that having different keys means one can give copies of different keys to different persons for different purposes -- e.g., copy of the home key to a baby sitter, copy of the desk key to a co-worker, copy of the home key to trusted neighbors. People today intrinsically understand that they have to be mindful about whom they lend their keys to, who gets copies of their keys, and where the keys are stored.
    - 14y ago
MatthewPhillips 14y ago
Question: How many designers/UX people were in the first meeting about two-factor authentication at Google? How many security engineers?
smackfu 14y ago
>Reality: You can tell Google to trust your computer for 30 days and sometimes even longer. How is that "even longer" part supposed to work? I have a desktop Mac that prompt me every 30 days to re-logon to GMail in Safari. Is there a way to add it to the trusted computer list?
- sundarurfriend 14y ago
  The image linked from there says it's a new feature. I couldn't check it even by logging out of my account and logging in again (this doesn't deauth the computer? didn't know), so not sure if it's available for everyone yet.
ck2 14y ago
How does it work with pop3/imap?
- kral 14y ago
  You can generate specific password for applications: http://support.google.com/accounts/bin/answer.py?hl=en&answer=185833 http://support.google.com/accounts/bin/answer.py?hl=en&a...
dendory 14y ago
I would add to that: Web developers, please implement two factor auth for your own apps as well. It takes minutes, literally, to add support for the Google Authenticator to your own app. I made a demo a while back inside of an hour. http://dendory.net/twofactors http://dendory.net/twofactors
- danweber 14y ago
  That is very helpful. I'm going to be proposing this to work very soon thanks to you.
T-R 14y ago
I use 2FA, but it's an absolutely frustrating experience. Most apps just don't support it. Google Music Manager requires a trip to accounts.google.com for a new App Specific Password every time I restart my computer, whereas Swiftkey just loses its ability to offer suggestions until I manually re-authenticate, which takes several minutes every time it happens, while I wait for an SMS and switch between apps.
- abraham 14y ago
  Sounds like something is wrong with your computer. I set up Music Manager months ago on two different computers and they have been humming along fine ever since.
andrewcooke 14y ago
is there an authenticator that can run on my computer? i see an android app - is there something similar that can run on linux? or does that defeat the purpose because it's not going to be a push notification? (if so, anyway to fix that?). i'm not normally mobile. if i am travelling and need gmail, i will have my laptop. i don't have a smartphone and my dumbphone won't work abroad. EDIT2: oops. ignore previous edit. that was using Google to connect to linux. Not vice-versa.
- subsection1h 14y ago
  Here are a few implementations that supposedly run on Linux, but I haven't tried them yet: https://code.google.com/p/cuteauthenticator/ https://code.google.com/p/cuteauthenticator/ https://github.com/mclamp/jauth https://github.com/mclamp/jauth http://blog.jcuff.net/2011/02/cli-java-based-google-authenticator.htmllinus http://blog.jcuff.net/2011/02/cli-java-based-google-authenti... Also, Android can apparently be run in VirtualBox, but I haven't tried that yet, either: http://www.buildroid.org/blog/?page_id=121 http://www.buildroid.org/blog/?page_id=121
  - andrewcooke 14y ago
    thanks. the first link makes the valid point that it's not that smart to run this code on the same machine used to access the service (if that machine is compromised then the "two factor" aspect becomes a single, compromised factor). so i guess maybe what i was planning is not so good an idea. on the other hand, maybe it's better than nothing.
robomartin 14y ago
All this talk about security and multiple authentication levels yet, your browser --if you use Chrome-- is the worst security leak in a persons digital life. It would take almost anyone a minute in front of a computer to fire-up Chrome and have every single login and password available in plain text. I've written about this before and so have countless of other techies. A non-techie has not a single clue, making them perfect victims. Any number of scenarios can be imagined: From taking your laptop in for repairs/upgrades to someone gaining physical access to your machine for just a few minutes. And, just like that, your digital life is turned upside-down.
- lee 14y ago
  Curious, could you point to a blog post or article that explains how to do this?
  - robomartin 14y ago
    Here's what a thief could do: Open Chrome Go to Settings Click on "Show Advanced Settings" Click on "Managed Saved Passwords" Click on a saved password Click on "Show" Write down or copy/paste/email the login in this fashion one-by-one. If they are after a pile of logins, keep clicking "Show" all the way down the list. Capture the screen and email/print or simply take your smartphone and snap a picture. Scroll through the entire login list to get it all. Takes very little time to get all of someone's private login data in this fashion. An, since the vast majority of Internet users re-use login user id's and passwords across many services I would imagine it might not take long to identify this pattern and have access to every login. Locking the workstation behind a password doesn't help either for a number of reasons, not the least of which is that workstation password removal, recovery or cracking tools are widely and easily available.
- danweber 14y ago
  I think most people are aware that the passwords saved in their browser are, well, saved in their browser, and if someone unkind gains access to the browser they gain access to all the sites with saved passwords.
dredmorbius 14y ago
Just answer me this: why does Google insist on using a phone for this? Really: the company's got far too much personal information on me. Pick something else I can use. An OTPG (similar to the RSA keyfob), say. Added bonus: this gives a pathway for other services to also offer 2-factor auth.
- pnathan 14y ago
  From what I understand, a phone number is close to a primary key to people in the US these days.
JohnBooty 14y ago
I turned it on. Had been meaning to for ages, but never did. Thank you, Mr. Article Writer.

224 points by cleverjake 14y ago

kral 14y ago

Done.

I really hope other services start offering it as a feature. Namecheap, I'm looking at you. DNS web apps are a huge possible attack vector. Also, RE the Google one time use passwords for POP/IMAP. They are all lower case, alpha/numeric, and 8 chars long. How secure are they against brute force? Why wouldn't Google offer 16 char options, or even longer? Is 8 good enough?

scraplab 14y ago
I make it 4 blocks of 4 random alphanumerics each, which is a pretty big search space.
nodata 14y ago
> Is 8 good enough? Depends on how good their intrusion detection is.
zapman449 14y ago
the application specific passwords are 16 characters long. Four blocks of four lowercase characters. I too would rather them be longer, and involve at least some numbers if not specials... but they're not THAT short.
- coffeecheque 14y ago
  Really? I was sure it was only 8 when I went through the process 2 weeks ago. 2 lots of 4. Time to go and generate some new passwords!
  - pooriaazimi 14y ago
    Hmmm... I generated a batch about 2 months ago and another batch last week. In both cases, they were of the form llll llll llll llll (l: [a-z])
    - coffeecheque 14y ago
      Happy to stand corrected. My apologies all round. Thanks everyone!
  - zwily 14y ago
    They've been 16 chars for at least several months.
slig 14y ago
> Namecheap, I'm looking at you. DNS web apps are a huge possible attack vector. The least they could do if offer IP whitelisting like Linode does.
- alfiejohn_ 14y ago
  Doesn't help if they target your provider: http://slashdot.org/story/12/03/02/0059202/linode-exploit-caused-theft-of-thousands-of-bitcoins
drcongo 14y ago
I'm getting 16 character app specific passwords having just turned it on on one of my Google Accounts (all lowercase alpha though).

Lagged2Death 14y ago

Am I the only person in the world who doesn't have a cell phone? It annoys me that the two-factor auth setups at sites (like Google) assume I have one and don't even have an option for "I don't have a cell phone, please stop nagging me about this."

nodata 14y ago
Yes you are, and I suspect you know this. Even in most third world countries cell-phones are common.
- acqq 14y ago
  Still, if I plan to use Google Authenticator, I don't want to give Google my phone number at all. When they insist to get the phone number from me, I don't like it.
  - nodata 14y ago
    Are you talking about Google Authenticator the Android app, or the SMS service?
  - pooriaazimi 14y ago
    I don't think you need to get them a phone number. I use Google Authenticator app on my iPhone, and didn't give them anything. It just scanned a barcode on a webpage IIRC.
    - zumda 14y ago
      The bar code was actually just a code to initialize the code generation (I think it is based on that randomly generated seed and the time, so that then server and client generate the same keys). You could have also typed in the code by hand.
      - pooriaazimi 14y ago
        You're absolutely right. My parent was talking about giving Google his/her phone number, which I was responding to :)

the1 14y ago

turned it on. was so annoying that i removed google accounts.

oddthink 14y ago

I did this a few months ago, but I'm thinking of turning it off. I know it's trivial, but there's something deeply annoying about being dinged $0.20 a pop for the SMS message to get the code. I'll have to see if I can set up the Google Authenticator; I hadn't heard of that before.

yock 14y ago
Even without GA (which, if you have an Android or iPhone, I don't see why you'd have to be without) $0.20 a month seems an incredibly small price to pay for the benefit of 2-factor auth.
- oddthink 14y ago
  I know, it's irrational, but it adds an extra annoyance factor, far more than it should. I mean, I spend far more every time I take the subway somewhere. Driving across the GW bridge costs $12, and I don't worry myself about that. It turns into four or five SMS every month, when I usually average zero (various computers, various browsers, etc.) So suddenly, there's this line item where there used to be none. I can't explain quite why it bugs me. In any case, I hadn't heard of GA before. I've installed it and life is good.
- icebraining 14y ago
  which, if you have an Android or iPhone, I don't see why you'd have to be without You don't even need one of those, there are implementations of the same algorithm for other systems. I use my Nokia S60 with a J2ME application: http://ds3global.com/index.php/en/news-a-events/news/97-securing-data-delivery-hassle-free http://ds3global.com/index.php/en/news-a-events/news/97-secu...
shawabawa3 14y ago
You pay for incoming SMS? How does that even work?
- mike-cardwell 14y ago
  It is standard to pay for receiving as well as sending SMS in the US. Everybody knows this is insane.

mistercow 14y ago

It's a good idea, but it's not the weakest link in user security right now. It does very little to solve problems like Apple positively identifying people based on totally insufficient and publicly available information.

acdha 14y ago
> It's a good idea, but it's not the weakest link in user security right now I suspect Google is in a better position to judge how widespread account compromises are than you are. From my perspective, it definitely seems like security people are all saying that account compromises (keyloggers, phishing) have been the predominant threat for several years now because they're suitable for bulk attacks whereas social-engineering Apple is a more limited, if deeply disturbing, process.
- mistercow 14y ago
  >I suspect Google is in a better position to judge how widespread account compromises are than you are. There are a couple of problems with that reasoning. First off, I don't see where anything Google has said contradicts my point. Yes, MFA is a good idea. But that doesn't mean it's enough to prevent attacks like the one in question. Secondly, Google is not an unbiased source on this matter. For cloud services to succeed (which Google is banking on), it is very important that people perceive that they (the people) have some kind of control over their own security. It is reassuring to hear "here are some steps you can take to make yourself safer". It is terrifying to hear "your security ultimately hinges on the competence of some of the lowest-paid employees of the faceless corporations you rely on". Both of those statements are true, but you're never going to hear the latter emphasized by Google or any other company heavily invested in the continued success of cloud based services. (Which is not to imply that they are dishonest; bias is usually as more about delusion than deception)
  - acdha 14y ago
    My point was simply that Google sees enough attempts to compromise Gmail accounts that I believe them when they claim widespread attacks using valid passwords are common enough that passwords are broken. > Yes, MFA is a good idea. But that doesn't mean it's enough to prevent attacks like the one in question. It would have stopped this one, in several ways: according to Honan's writeup, it would have halted things at a key point in the chain of account compromises. Yes, it's true that you have to trust companies - but that's always been true, even 100% off-line, as any victim of identity theft could tell you. The key point is that having any sort of MFA schema would have contained the damage to one company, halting the cascade.

smountcastle 14y ago

I did this but was expecting more from Google. As an example, it was easier to add two factor auth to my Blizzard account (and install their authenticator) than it was for Google. These are the steps for Google: - Add mobile phone to account - Enter code from SMS - Generate random passwords for multiple apps which don't support two factor auth (this took awhile). - I wasn't given any instructions on how to switch from SMS to Google Authenticator app so I had to search for those instructions and then set that up. Granted Blizzard controls the entire experience, they're not dealing with 3rd party apps, but it seems like Google could make this easier. And once it's trivially easy to setup, then it can be made the default.

brown9-2 14y ago
The difference is, as you mention, that for your Blizzard account there is one app that needs to be changed to use 2FA, whereas with Google you are using your account from dozens of apps that they do not control and that can not be made to support the 2FA login process. It's an unfair comparison.

xfax 14y ago

Two-factor auth gets old really fast when you have to use public computers in a setting like a college library. I had turned it on for a while, but turned it off when I had 5 minutes to print out a paper that I had emailed myself (yes, I still do that) and was fiddling with my phone to get the damn PIN. Never again.

alfiejohn_ 14y ago
Maybe it's just me but I only trust computers I control. If you don't have root on a box, consider it pwn3d with keyloggers listening to every juicy password you type. Take that as your friend's laptop, a library computer or even your parent's Windows XP box... Trust no one, Mr. Mulder. /tinfoilhat
- xfax 14y ago
  Yeah, that would be great if the damn wireless printing worked in school. Sometimes you just have to log into a public machine.
  - alfiejohn_ 14y ago
    You couldn't use a USB key instead?
    - xfax 14y ago
      Sure I could. Not denying that there are other ways to get access to the files I need, just that this has become a part of my workflow that two-factor auth disrupts.
      - Johngibb 14y ago
        I think having a second gmail address just for emailin yourself files for public computers might work for you. Keep your personal email safe, and forward what you need to the other address. It's a good compromise. Don't underestimate how vulnerable you are when your email gets hacked - virtually every service you use can be accessed by the forgotten password mechanism when your email is breached. I'm pretty lazy and have procrastinated for a long time, but with the recent attacks and realizing what a mess I could face if hacked I finally implemented two factor auth and I have no regrets yet.

avar 14y ago

Something Google could to do drastically improve the security of their two-factor authentication system is to add the ability to give more granular permissions with the application-specific passwords. I have an application that only needs to send E-Mail through my GMail account (git-send-email), another that only needs to write to one specific GMail label (Android SMS Backup), and Google Chrome surely doesn't need access to everything. But you'd get full access to my account if you compromised any of these. They already have this for the Connected Sites, Apps, and Services. I sent them a feature request for this a while ago but it hasn't been answered (and there's no way to view it online).

estel 14y ago
I didn't think Chrome any longer required an ASP?
- deleted 14y ago
  [deleted]
- jarito 14y ago
  Still did as of a month or two ago when I turned on two-factor.
- gecko 14y ago
  It still does; I had to go through this yesterday. I don't mind Chrome so much per se, but this also means you need an application-specific password for Chrome OS, at least for he initial sign-on, which I find oddly frustrating.
  - jrockway 14y ago
    It does if you set up the sync account via the Settings page, but if you ignore the request to sign in, visit some Google page that requires login and log in, Chrome will produce a yellow bar at the top of the screen asking if you want to use that account for Chrome sync. Click yes and you don't need to sign in any further.
- 14y ago

macspoofing 14y ago

Do you trust the minimum wage customer service reps of your phone company to not be susceptible to social engineering? Two factor-auth, via SMS, may not have saved Matt Honan.

ConstantineXVI 14y ago
Use the app, it's not vulnerable to such an attack. Or buy a prepaid phone, and don't use the number for anything else.

nicholassmith 14y ago

I'm sure someone is probably working on this, but what about a service that generates a one off seed for the second stage of auth, married with either a desktop or smartphone app for generating it for the user. Lose your phone/laptop/PC simply cancel it remotely so it stops generating, same as you would if you lost your bank card. I'm sure I'm missing something, but I'm not sure what. EDIT: I'll let the post stand but I need to read more clearly, I thought Google Authenticator was purely for Google services.

alfiejohn_ 14y ago
Already on the market - YubiKey.
lreeves 14y ago
You can actually authenticate against the GA product from any system - hook it into PAM for sshd access, use it for another factor in OpenVPN, or even just wire it into Apache: http://code.google.com/p/google-authenticator-apache-module/ http://code.google.com/p/google-authenticator-apache-module/

kernel_sanders 14y ago

I'm glad this is on the front page again. I just set mine up. thx internet.

JunkDNA 14y ago

I was worried this would be a major pain when I enabled it, but I have to say, it has been much more painless than I thought it would be. Most of the time, I don't even think about it. Most of my consumption of google mail is through clients on my laptops, iPhone, or iPad. So in that sense, it's not much different from a regular password. The difference is that someone else has a much harder time cracking my account. It's actually much less obtrusive than using lastpass (also highly recommended, but not as transparently usable). That being said, two factor google auth wasn't going to save Matt Honan here. Identity, trust, and authentication on the internet are all built on a foundation of sand. We need a new model.

Xyzodiac 14y ago
Same here, I just enabled it a few days back and it's much easier than I imagined it would be.
ja27 14y ago
If you've spent your career with RSA SecurIDs hanging from your keys, this isn't much of a hassle. I didn't realize that LastPass and others can use the Google Authenticator.
- quinndupont 14y ago
  I was just thinking that Google should open their service to others... Makes me think about switching from 1Password to Lastpass...
danso 14y ago
Why wouldn't two-factor authentication protected Mat from at least his GMail account being hacked? Even if password-resets were being sent to the .Me account, wouldn't the hackers still need to generate the authentication token?
gilrain 14y ago
According to Matt (and, apparently, his hacker) you're wrong; two-factor would have saved him in this particular instance: "If I had some other account aside from an Apple e-mail address, or had used two-factor authentication for Gmail, everything would have stopped here." (http://www.wired.com/gadgetlab/2012/08/apple-amazon-mat-honan-hacking/all/ http://www.wired.com/gadgetlab/2012/08/apple-amazon-mat-hona...) Naturally, it's not a panacea, but I think a lot of people allow perfect to be the enemy of quite good when it comes to two-factor auth.

revjx 14y ago

I've been avoiding doing this, and I'm not certain the reason is valid - I don't want Google to have my mobile phone number. Perhaps I'm being overly cautious, but the fact Google already collects such a huge amount of data on me, coupled with the increasing insistent requests to enable two-factor with my mobile phone number, has made me not do it. I got so sick of being pestered about it that I stopped using Gmail a little while ago.

jarito 14y ago
You don't need to enter your phone number to use Google's two factor. You can use their smartphone application to generate codes. If you don't want to do that, the algorithm is free and open-source so you can probably find an alternate implementation that works fine.
- crumblan 14y ago
  Unless I am mistaken, they won't let you do two-factor auth at all unless you put a phone number first.
  - nollidge 14y ago
    I don't think they need a phone number if you use the Google Authenticator app on your phone. The pin for that is generated based on an initial random seed and the current date/time, not your cell number.
    - fr0sty 14y ago
      They do require it. If you remove it 2-factor-authentication is disabled. Nothing says that number needs to be your mobile (or one that you have regular access to) but you do need to provide one.
      - SnowLprd 14y ago
        Does that mean that you could use a Google Voice number? Presumably they already know that one, so "divulging" it shouldn't be an issue. ;^)

zumda 14y ago

I'm always dumbfounded when these topics come up and a lot of people start saying how inconvenient it is, that it is all wrong. But these are probably the same people which later accuse Google that they didn't do enough to protect their accounts! Yes, two factor authentication is a small hassle. Yes, two factor authentication requires a bit to set up. But do you realize how much actually depends on your email account being safe? For one, how many times did you use Googles OpenID provider? Yes, that's your Gmail account! Or for how many services did you use your Gmail account as the email address? You know that password resets go to that account, right? Don't do that? Maybe you use Google Calendar, then. So yes, there is actually a lot of sensitive data in there. If you don't believe me, try to get a hold of a friends calendar, and see what you can guess about that person just from the calendar. Or should someone just post some slander about you on you G+ profile? Or buy some apps from the Android Market? Of course this things never happen to you... So just take the time to, besides looking at the time or the latest message on your phone, open that stupid app and type that stupid code in! It's not THAT much work!

Kiro 14y ago

I just turned two-factor authentication on and it forced me to set "program specific" passwords for like 10 different apps and seriously messed up my phone. I had to deactivate it. What's with the hassle?

Semaphor 14y ago
Not everything supports the 2-factor auth. And of course you have to set up specific passwords for those. ONCE! You wont have to do that again. What did you expect? That it magically made everything work? Some people -.- And I have no clue how you managed to mess up your phone… By entering new passwords??
- Kiro 14y ago
  Why can't they just use my "old" password? I don't want to set up 10 new passwords. And yes, I was expecting it to magically work by just enabling it and enter the SMS code. This is too much hassle for something I don't really care about (I don't keep anything of value anywhere online or in my computer/phone).
  - Semaphor 14y ago
    Why? Maybe because that would defeat the whole purpose? And why use a (relatively, before someone calls me out) high security measure for something unimportant in the first place? You wouldn't use a full biometric security scanner setup for your pantry either, would you?
maxerickson 14y ago
For the second factor to mean anything, all the apps that don't support it need a password that has less rights. Hopefully they figure out a nice way to make the rights more granular (so that a chat app can't mess with email or whatever).
- sp332 14y ago
  Do those passwords have less rights? I figured that if any of those passwords got compromised, you were screwed (until you found out which one and revoked it).

xmpir 14y ago

did it today :)

andyakb 14y ago

really surprised so many people that post here refuse to use google authenticator because its "annoying." is it a hassle? yes, but if you have ever had your email (and other accounts) compromised you understand why it is worth that small 5 second hassle when you login. one feature that i cannot understand why it hasnt been implemented though is protecting the app itself with a password or pin. some people say to just protect your whole phone, but i dont really want to do that because to me that _is_ too large a hassle. if i lose my phone i can revoke access to my email and other similar apps, but not if the person that finds it opens up google authenticator (which shows the account the id is used for) and logs in to change the password before i have a chance to. even just allowing for it to display an account nickname instead of full login would be a huge step forward

sp332 14y ago
It's not a 5 second hassle. I don't get a cell signal in the steel gymnasium even though the wifi works fine. I physically have to go outside to get a code every time I want to log in. And then if my phone is not working, or I leave it at home, I'm screwed.
- fr0sty 14y ago
  FTA: You can install a standalone app called Google Authenticator (it’s also available in the App Store), so your cell phone doesn’t need a signal. Also: You can print out a small piece of paper with 10 one-time rescue codes and put that in your wallet. Use those one-time codes to log in even without your phone.
  - sp332 14y ago
    Hm, can you generate new codes whenever you need to? It might be cool to use these 10 at a time as a one-time pad.
    - prawn 14y ago
      Yes, you can revoke those printed codes or issue more whenever you like.

dholowiski 14y ago

Sigh, OK. I'm turning it on today. Was going to do it right now, but then I realized that I'm at Starbucks right now... probably not the best time to be messing with passwords.

billpg 14y ago

Is there a way to use a separate hardware device? Using my phone as the second factor is nice, but my phone is vulnerable to theft because of its value for resale. A sealed gizmo that shows a number just looks like an el-cheapo souvenier. Without knowing my username and password too, it really is worthless.

jsight 14y ago
The linked article mentioned this: http://static.yubico.com/var/uploads/pdfs/Howto_GmailYubiKey.pdf http://static.yubico.com/var/uploads/pdfs/Howto_GmailYubiKey... YubiKeys are relatively cheap and would provide a nice alternative to using a phone, IMO.

mike-cardwell 14y ago

I hear a lot of people advising to turn on two factor auth on Google because of this incident, but I haven't heard anyone say that we should be deleting our card details from Amazon. Well, I have, and you should too. Lots of places use the last 4 digits of your card as "authentication", and Amazon happily displays those details in your account.

bcl 14y ago
Note that they had to break into the account in order to view those last 4 digits. You seem to be implying that they show them to anyone. Either way, using the last 4 digits as 'security' is just stupid. You can get those from a receipt.
- danso 14y ago
  * Edit: Ah, technically they did break into the email account. The first time I read this I thought that they just had access to the account info page (doing things, such as purchasing or accessing account settings, requires password-entry by Amazon) No, they did not have to break into the Amazon account. http://www.wired.com/gadgetlab/2012/08/apple-amazon-mat-honan-hacking/all/ http://www.wired.com/gadgetlab/2012/08/apple-amazon-mat-hona... > First you call Amazon and tell them you are the account holder, and want to add a credit card number to the account. All you need is the name on the account, an associated e-mail address, and the billing address. Amazon then allows you to input a new credit card. (Wired used a bogus credit card number from a website that generates fake card numbers that conform with the industry’s published self-check algorithm.) Then you hang up. > Next you call back, and tell Amazon that you’ve lost access to your account. Upon providing a name, billing address, and the new credit card number you gave the company on the prior call, Amazon will allow you to add a new e-mail address to the account. From here, you go to the Amazon website, and send a password reset to the new e-mail account. This allows you to see all the credit cards on file for the account — not the complete numbers, just the last four digits. But, as we know, Apple only needs those last four digits. We asked Amazon to comment on its security policy, but didn’t have anything to share by press time.
  - 14y ago

OoTheNigerian 14y ago

Like the second class citizens of the web we are, Nigeria does not have 2 factor authentication. Ghana, Pakistan, Iran, North Korea, Russia, all have 2 factor authentication. Why not Nigeria? This is just another example why being Nigerian is kinda hard on the internet. https://accounts.google.com/b/0/SmsAuthConfig https://accounts.google.com/b/0/SmsAuthConfig http://oonwoye.com/2011/01/23/life-as-a-second-class-citizen-of-the-web/ http://oonwoye.com/2011/01/23/life-as-a-second-class-citizen...

nodata 14y ago
> Why not Nigeria? Can Nigerians use the Google Authenticator app? If yes, then the answer is probably high SMS costs.
- OoTheNigerian 14y ago
  High SMS costs? It is exactly why I put the range of countries above. Can we be in a worse situation than them all?
  - nodata 14y ago
    Then why? Lack of demand? Market not interested? Support costs too high?

larsberg 14y ago

It seems to work well with Firefox and Safari, but I've found that two-factor auth doesn't work well with Chrome if you've set it to clear cached files (not cookies) on exit. For some reason, that setting causes Chrome to lose the 30-day permission, so every time Chrome crashed or I rebooted my machine, I'd have to go through the SMS dance. Doesn't happen with the similar setting in Firefox.

mike-cardwell 14y ago

Somebody should set up a website dedicated to listing organisations and what information is required in order to obtain access to an account at that organisation.

Karunamon 14y ago

The reason I'm not using 2FA right now is twofold. First, because Google doesn't have half of their services using it for some undefined reason (for at least a year plus!). Also, the whole "app specific password" thing is a huge pain in the ass. (And appears to randomly stop working on say, IMAP mail). Second, because the mobile authenticator is not feasible for me right now. I do a lot of android development work (well, mostly screwing around, but we'll call it work) on the side, with the result that I'm wiping my phone for romflashes at least once a week. Makes everything going through a mobile app a little useless. I really wish Google would support a hardware token of some kind.

smackfu 14y ago
Yes, can someone explain why Google Chrome doesn't support 2FA on the desktop or iOS? It's bizarre. (Well, I suppose it's tragically normal. I'm sure there is a corporate directive that says every Google service must support 2FA, but Chrome has an exception so they don't need to do it yet.)
- mithaler 14y ago
  Dunno about iOS, but Chrome does on the desktop; it asks you for an application-specific password when you turn on sync.
  - smackfu 14y ago
    OK, but it should be asking your for an authenticator code instead. It uses this bizarre "normal password + app specific password" requirement that isn't used anywhere else.
    - gergles 14y ago
      Your data is encrypted with the normal password, so it needs it to decrypt the sync data. The App-specific password is used to log in to the server to GET the sync data in the first place.

smackfu 14y ago

OK, so I turn on two-factor authentication for GMail, but... 1) I immediately have to create a application specific password to actually read my mail on my iPhone. 2) If anyone ever gets access to that secret password, or any of the others I create, they have full access to my email and any password resets they generate. 3) I will have no idea this is happening since I would expect my mail to access that app password daily. So your fancy two factor authentication still ends up resting on one piece of secret info as the weak point. Am I missing something?

roc 14y ago
You only type that application specific password once. You're not typing it to log in via wifi at coffee shops, airports, etc. You're not typing it every day for a keylogger to pick up, should your machine be compromised in the future. You're not typing it into borrowed machines or net cafe machines in some hotel business center. So, no, it isn't perfect, but it's a heck of an improvement. That is, if you believe your machine to be reasonably secure on day 1.
- sigkill 14y ago
  Calling it an "application specific password" is actually a misnomer. WE create the app-labels. For all practical purposes it's a backdoor entry into your account. So, I'd say for absolute 2FA, you must give up Chrome browser profiles, device mail sync (till Google comes up with a compatible client) and Google Talk/any Jabber client. I don't care about Chrome browser profiles but I need/want my Android phone to have full connectivity viz. push mail and gtalk access to my account. I could always keep a separate browser window on the PC with my gmail signed in and IM notifications enabled for my third point. Overall, I feel losing my Android connectivity is not worth the 2FA.
adgar 14y ago
> So your fancy two factor authentication still ends up resting on one piece of secret info as the weak point. Am I missing something? A vastly reduced, easily managed attack surface area that in practice results in overwhelmingly fewer account compromises.

OriginalSyn 14y ago

The only time I regret turning on TFA is when I'm laying in bed with my laptop and my phone is slightly out of reach.

peterwwillis 14y ago

Here's why I don't use two-factor authentication for my Google accounts. It's not worth it. I don't run a business. I'm not a celebrity. I don't keep confidential information in my e-mail. And I don't register all of my various accounts at sites around the web to just one e-mail address. If someone got access to one of my e-mail accounts it would probably be a general-use one, and quite honestly it wouldn't affect me much. It's also annoying to have to verify every time I log in. I probably log in more often than most people. When my browser session ends, all my cookies, cache and history are erased (not because i'm paranoid, but to help guard against CookieMonster, history probing and similar attacks on sites that don't do secure browsing right). Even though it may only be occasionally, having to go find my phone to authenticate the login takes away from my browsing experience, and I don't find the tradeoff worth the hassle. It doesn't help that Google's authenticator medium is SMS. As a hacker, I find there's way too many avenues to intercept the token (not the least of which is an already-logged-in Google Voice session!). I like the idea of using a YubiKey, but if I have to stick the device into my computer, it's annoying. I prefer plain-old tokens like RSA's SecurID or the PayPal token (I got mine when it was still only $5). But it's not automatic. I have to do a bunch of work to set it up, and i'm lazy. At the end of the day, even once you set up two factor, a good attacker will still get past it if they really want to. Separation of accounts will go a lot farther towards keeping your digital self safe than putting all your eggs into a two-factor single-account Google basket. Edit: This post has encouraged me to pay the $20 for Bank of America's SafePass Card, which I consider to be much more secure than an app or sms.

fr0sty 14y ago
Please, please, please, please RTFA before ranting. SMS is not required (you can use the google Authenticator App). The Authenticator app works just like a "plain old token". Separation of accounts means squat if your passwords are intercepted. 2 factor auth requires physical access and reduces the possible pool of attackers from billions to hundreds.
- nagisa 14y ago
  You still need to hunt for phone (on top of that you must have one) to log in...

jonknee 14y ago

What's the status of Google's two-factor authentication with Sync (Exchange)? Last time I tried it was a mess and the added security was not worth the hassle of not having everything pushed and kept up to date.

petenixey 14y ago

I'm really frustrated with Google and this 2-factor authentication. They are in such a great position to really change the way in which people secure themselves and they've completely missed the trick [edit: FOR THE AVERAGE USER]. Google 2-step auth is very hard to use and for how hard it is to use it doesn't provide all that much protection. It protects against phishing (mostly) but not against someone who has your phone. Malicious ex-girlfriend trying to do you harm? Google 2-factor won't help you a bit as long as at some point she had access to your phone. Any security improvement is better than no improvement so let's concentrate on the real issue which is ease of use. 1. Google 2-factor auth requires application specific passwords are deeply confusing I founded Clickpass and I can only just get my head around this. One password per application? This is a very confusing concept and very difficult for the average person to understand. There's no indication of whether you can reasonably create one password and reuse it in all your apps (which I think you can). Application specific passwords are very confusing and not that much more secure than one revokable password for all applications. 2. Application specific passwords are almost impossible to use on mobile apps Ever tried copying a 12-digit long string into a keyboard which only shows you the last letter you entered and even then only for half a second? It's really hard. You can't copy and paste them and you have to have a computer nearby to do it (it's very hard to use the Google password-generator page on mobile) Here is the list of the application-specific passwords that have to be individually entered (10+ characters each): On my mobile - iphone mail - iPhone Google account (through browser) - iphone work mail - iPhone (work Google account through browser) - iphone calendar - iPhone calendar (work) DUPLICATE ALL OF THE ABOVE FOR iPad DUPLICATE ALL OF THE ABOVE FOR MacBook Air Switch on 2-factor auth and you immeidately find all these apps go dead until you do this. It will take you about 15m at least to do this and you'll have to do it again if you change your password or get a new device. You can't copy and paste because the Google auth-token page is unusable on moble. What we need is easy, incremental security improvement The problem with Google 2-factor auth is that it was designed by security geeks. It takes 3m just to watch their setup video! The system needs to be designed by usability geeks and audited by security geeks. 2-factor auth is no use at all if it's switched off. Contrast my switched off 2-factor auth with my Facebook auth which texts me every time someone logs in from a new machine and you contrast a system which provides me with a bit more security (FB) and one which pertains to be secure (Google) but which adds nothing. Google needs to rip the security guys out of their security team and put the user experience people in. End-user security is a UX problem and Google is in a powerful position to effect change. [Edited above for (a little) brevity] EDIT BELOW: for folks who feel this account is unfair: I realise that if you keep a PGP encrypted file on another device that is necessary to do your password reset then yes, Google 2-factor auth is very strong indeed. I also realise that you shouldn't tell someone your password. The point is though that resetting your password is something that only really needs your phone. The key elements to resetting your password usually involve sending a password or an out-of-channel token to another acccount. For most people that other account is their work mail or Facebook, both of which are usually accessible via their phone. I'm not talking about the absolute strength of Google 2-factor authentication. I'm talking about how that type of process applies to the type of internet user who tries to log into Facebook through ReadWriteWeb: http://www.readwriteweb.com/archives/facebook_wants_to_be_your_one_true_login.php http://www.readwriteweb.com/archives/facebook_wants_to_be_yo...

pikewood 14y ago

I'll propose a sideways solution: implement an "Administrator" mode on these accounts that requires separate authentication--perhaps enforcing two-factor authentication there. There are many complaints about how Microsoft didn't protect Windows users enough because everyone had administrator access as a default. But isn't that the same problem with these Google and Apple accounts? With your standard account, you can change your password, delete all data, and do many other damaging acts. I don't really want to enter in multiple pins/passwords each time I read email. But I would be more than fine doing so before being given the ability to damage my account.

3amOpsGuy 14y ago

Browser compromises are the one I worry about. A remote attack that reveals everything your browser has or knows. I've been using 2 factor on google for a year or so now. It's not perfect - especially the ways it can be disabled - but it's better than the status quo for now.

tammer 14y ago

Quick question for all you security experts: Which is more secure: LastPass with 2factor, or a gpg encrypted password safe on my home server accessed by a passphrase-locked rsa-encrypted key? I've been trying to decide for the past few weeks. Copying and pasting passwords isn't as annoying as I thought it would be, and it seems like keeping my pwsafe locally reduces the attack vector of the LastPass servers. Then again, it's in LastPass's absolute interest that my info never gets leaked, and they've built up a good reputation. Further, at a public terminal my usb drive would need to be connected while I unlock the key, thus possibly exposing my unencrypted key. Any ideas?

sigkill 14y ago
At the absolute best, I'd say using an app like Pocket (on Android) on a non-network connected device is probably the safest setup. Granted you'd have to type the passwords in manually, but nothing beats air-gap security, and you'd need to remember just one password. Also, if you lose your device, you're screwed, unless you've dropbox synced it of course. In which case, you lose the air-gap.
mike-cardwell 14y ago
LastPass is only one persistent XSS flaw away from having your password store completely compromised. I found a non-persistent one last year which exposed a lot of information about you, but not your password: https://grepular.com/LastPass_Vulnerability_Exposes_Account_Details https://grepular.com/LastPass_Vulnerability_Exposes_Account_... Specifically it exposed your email address, your password reminder, the list of sites you log into and the history of your logins, including which sites you logged into, the time and dates you logged into them, and the IP addresses you logged in from. EDIT: I used to use LastPass but now I use a GPG encrypted file, which I sync between machines. I set up a simple helper script so I can just type for example "password facebook" at a terminal and it will do a gpg --decrypt on the text file, grab the facebook password, display it, and also copy it into my clipboard for ten seconds.
- tammer 14y ago
  Thanks for the detailed info! Combined with two-factor ssh auth[0] for using a public connection, looks my gpg file is the perfect solution. [0] http://news.ycombinator.com/item?id=3029680 http://news.ycombinator.com/item?id=3029680

joshstrange 14y ago

Well I turned on two-factor authentication and then updated Sparrow (iOS and OS X) with the new password and everything was fine... Until the iOS version constantly kept telling me I had an incorrect password. I tried various troubleshooting tips online but to no avail. Until I can use this with everything I can't use it at all.

cs702 14y ago

Two-factor authentication improves security, but cannot solve the online security problem for most people, because the vulnerabilities are primarily CULTURAL: the average person does not understand the risks nor what they could do to ameliorate them. Compare the attitude towards security that people have in the physical world with their attitude online. No sane person would ever want to use the same exact key to open their home, car, desk, safety deposit box, etc., because that would obviously be unsafe. Yet most people today will happily use the same easy-to-remember password for all online accounts without giving it a second thought. Similarly, no sane person would ever lend their wallet and keys to a stranger, because that would obviously be unsafe. Yet most people today will happily walk into an Internet cafe or hotel business center and enter all their online credentials without giving it a second thought. Providers of online services like Google, Amazon, Apple, etc. will find it difficult to solve the security problem until society has evolved its understanding of, and attitude towards, online security. -- Edit: softened the tone of the last paragraph to make it more accurately reflects my views.

sigkill 14y ago
I do agree with you on the key analogy but there's a security breach there as well. Most of the keys are generally found on the same keyring. So, in effect it's identical to using a single password.
- cs702 14y ago
  That's true only to some extent: people keep on their keyring only those keys they need for daily use. Less frequently used keys (e.g., keys to a safety deposit box at the bank, keys to a home safe, keys to a second home) are typically stored in a drawer, a closet, or a safe. Also, note that having different keys means one can give copies of different keys to different persons for different purposes -- e.g., copy of the home key to a baby sitter, copy of the desk key to a co-worker, copy of the home key to trusted neighbors. People today intrinsically understand that they have to be mindful about whom they lend their keys to, who gets copies of their keys, and where the keys are stored.
  - 14y ago

MatthewPhillips 14y ago

Question: How many designers/UX people were in the first meeting about two-factor authentication at Google? How many security engineers?

smackfu 14y ago

>Reality: You can tell Google to trust your computer for 30 days and sometimes even longer. How is that "even longer" part supposed to work? I have a desktop Mac that prompt me every 30 days to re-logon to GMail in Safari. Is there a way to add it to the trusted computer list?

sundarurfriend 14y ago
The image linked from there says it's a new feature. I couldn't check it even by logging out of my account and logging in again (this doesn't deauth the computer? didn't know), so not sure if it's available for everyone yet.

ck2 14y ago

How does it work with pop3/imap?

kral 14y ago
You can generate specific password for applications: http://support.google.com/accounts/bin/answer.py?hl=en&answer=185833 http://support.google.com/accounts/bin/answer.py?hl=en&a...

dendory 14y ago

I would add to that: Web developers, please implement two factor auth for your own apps as well. It takes minutes, literally, to add support for the Google Authenticator to your own app. I made a demo a while back inside of an hour. http://dendory.net/twofactors http://dendory.net/twofactors

danweber 14y ago
That is very helpful. I'm going to be proposing this to work very soon thanks to you.

T-R 14y ago

I use 2FA, but it's an absolutely frustrating experience. Most apps just don't support it. Google Music Manager requires a trip to accounts.google.com for a new App Specific Password every time I restart my computer, whereas Swiftkey just loses its ability to offer suggestions until I manually re-authenticate, which takes several minutes every time it happens, while I wait for an SMS and switch between apps.

abraham 14y ago
Sounds like something is wrong with your computer. I set up Music Manager months ago on two different computers and they have been humming along fine ever since.

andrewcooke 14y ago

is there an authenticator that can run on my computer? i see an android app - is there something similar that can run on linux? or does that defeat the purpose because it's not going to be a push notification? (if so, anyway to fix that?). i'm not normally mobile. if i am travelling and need gmail, i will have my laptop. i don't have a smartphone and my dumbphone won't work abroad. EDIT2: oops. ignore previous edit. that was using Google to connect to linux. Not vice-versa.

subsection1h 14y ago
Here are a few implementations that supposedly run on Linux, but I haven't tried them yet: https://code.google.com/p/cuteauthenticator/ https://code.google.com/p/cuteauthenticator/ https://github.com/mclamp/jauth https://github.com/mclamp/jauth http://blog.jcuff.net/2011/02/cli-java-based-google-authenticator.htmllinus http://blog.jcuff.net/2011/02/cli-java-based-google-authenti... Also, Android can apparently be run in VirtualBox, but I haven't tried that yet, either: http://www.buildroid.org/blog/?page_id=121 http://www.buildroid.org/blog/?page_id=121
- andrewcooke 14y ago
  thanks. the first link makes the valid point that it's not that smart to run this code on the same machine used to access the service (if that machine is compromised then the "two factor" aspect becomes a single, compromised factor). so i guess maybe what i was planning is not so good an idea. on the other hand, maybe it's better than nothing.

robomartin 14y ago

All this talk about security and multiple authentication levels yet, your browser --if you use Chrome-- is the worst security leak in a persons digital life. It would take almost anyone a minute in front of a computer to fire-up Chrome and have every single login and password available in plain text. I've written about this before and so have countless of other techies. A non-techie has not a single clue, making them perfect victims. Any number of scenarios can be imagined: From taking your laptop in for repairs/upgrades to someone gaining physical access to your machine for just a few minutes. And, just like that, your digital life is turned upside-down.

lee 14y ago
Curious, could you point to a blog post or article that explains how to do this?
- robomartin 14y ago
  Here's what a thief could do: Open Chrome Go to Settings Click on "Show Advanced Settings" Click on "Managed Saved Passwords" Click on a saved password Click on "Show" Write down or copy/paste/email the login in this fashion one-by-one. If they are after a pile of logins, keep clicking "Show" all the way down the list. Capture the screen and email/print or simply take your smartphone and snap a picture. Scroll through the entire login list to get it all. Takes very little time to get all of someone's private login data in this fashion. An, since the vast majority of Internet users re-use login user id's and passwords across many services I would imagine it might not take long to identify this pattern and have access to every login. Locking the workstation behind a password doesn't help either for a number of reasons, not the least of which is that workstation password removal, recovery or cracking tools are widely and easily available.
danweber 14y ago
I think most people are aware that the passwords saved in their browser are, well, saved in their browser, and if someone unkind gains access to the browser they gain access to all the sites with saved passwords.

dredmorbius 14y ago

Just answer me this: why does Google insist on using a phone for this? Really: the company's got far too much personal information on me. Pick something else I can use. An OTPG (similar to the RSA keyfob), say. Added bonus: this gives a pathway for other services to also offer 2-factor auth.

pnathan 14y ago
From what I understand, a phone number is close to a primary key to people in the US these days.

JohnBooty 14y ago

I turned it on. Had been meaning to for ages, but never did. Thank you, Mr. Article Writer.