4 ms·

It's a quick shot in the video, but part of opening the app is unlocking it with a PIN, which is the second factor. We know that a PIN will not stop a determine

It's a quick shot in the video, but part of opening the app is unlocking it with a PIN, which is the second factor. We know that a PIN will not stop a determined attacker for long, but since we make it possible to remotely deactivate a lost or stolen phone, it only needs to slow them down long enough for you to report it.

czbond 14y ago
I actually think that's important to note. I personally was less interested when I thought it was 1 factor - but 2fa makes this much more interesting.
Navarr 14y ago
Eh... I guess.. If you look at it that way with Google I'm using Three-Factor. I just.. a PIN doesn't seem like much of a factor, and is a drop in security from a password.
- gcr 14y ago
  What do you mean, "three factor"? The factors are something you have (telephone), something you know (secret or password), and something you are (biometric). Google isn't allowing you to use biometrics like your fingerprint to log into your account; thus, you aren't using three-factor authentication.
jetti 14y ago
Oh that was part of the app? I thought that was just the iphone lock screen. "We know that a PIN will not stop a determined attacker for long, but since we make it possible to remotely deactivate a lost or stolen phone, it only needs to slow them down long enough for you to report it." And how would one be able to do this? Would they need a password? (Genuine question, not trying to be an ass)
- brennenHN 14y ago
  Haha, I definitely don't take that as being an ass, it's an important question and it's part of an area that we're trying to improve. We have a section of our website clef.io/lost where you go when you lose a phone. It asks for your email and PIN, then sends an email to you confirming the deactivation. If you click on the link in your email, the phone is immediately deactivated. If you open the app and enter your PIN, the deactivation is canceled. We want to make sure that an attacker has a hard time deactivating your account, but that you are able to quickly deactivate it when you need to. In the long run, we do not want to rely on email, and so we will need to move to a paradigm of trusted computers or other methods of valid-user-identification.
a3_nm 14y ago
Is the app's data on the phone encrypted using the PIN? If the phone is found by an attacker which can access its memory, will bruteforcing the PIN slow them down long enough?
- brennenHN 14y ago
  On the iPhone, all of the data on the phone is hardware encrypted using the device keychain. The Android app does use PBKDF2-derived PIN-based encryption to store the data. A rooted device would be cracked more quickly than an unrooted one, but the brute forcing process is quite slow because the hashing is iterated many times.

czbond 14y ago

I actually think that's important to note. I personally was less interested when I thought it was 1 factor - but 2fa makes this much more interesting.

Navarr 14y ago

Eh... I guess.. If you look at it that way with Google I'm using Three-Factor. I just.. a PIN doesn't seem like much of a factor, and is a drop in security from a password.

gcr 14y ago
What do you mean, "three factor"? The factors are something you have (telephone), something you know (secret or password), and something you are (biometric). Google isn't allowing you to use biometrics like your fingerprint to log into your account; thus, you aren't using three-factor authentication.

jetti 14y ago

Oh that was part of the app? I thought that was just the iphone lock screen. "We know that a PIN will not stop a determined attacker for long, but since we make it possible to remotely deactivate a lost or stolen phone, it only needs to slow them down long enough for you to report it." And how would one be able to do this? Would they need a password? (Genuine question, not trying to be an ass)

brennenHN 14y ago
Haha, I definitely don't take that as being an ass, it's an important question and it's part of an area that we're trying to improve. We have a section of our website clef.io/lost where you go when you lose a phone. It asks for your email and PIN, then sends an email to you confirming the deactivation. If you click on the link in your email, the phone is immediately deactivated. If you open the app and enter your PIN, the deactivation is canceled. We want to make sure that an attacker has a hard time deactivating your account, but that you are able to quickly deactivate it when you need to. In the long run, we do not want to rely on email, and so we will need to move to a paradigm of trusted computers or other methods of valid-user-identification.

a3_nm 14y ago

Is the app's data on the phone encrypted using the PIN? If the phone is found by an attacker which can access its memory, will bruteforcing the PIN slow them down long enough?

brennenHN 14y ago
On the iPhone, all of the data on the phone is hardware encrypted using the device keychain. The Android app does use PBKDF2-derived PIN-based encryption to store the data. A rooted device would be cracked more quickly than an unrooted one, but the brute forcing process is quite slow because the hashing is iterated many times.