6 ms·
Could anyone explain to me what's the point of Google's two-factor authentication? I mean, before that, I used to have one password I had to guard carefully, an
by xyzzyz 14y ago
Could anyone explain to me what's the point of Google's two-factor authentication? I mean, before that, I used to have one password I had to guard carefully, and now I have ten passwords I have to guard carefully, and the one I enter most often requires me to additionally type some digits I have to read from my smartphone? What plausible attack scenario does two-factor authentication protect me from?
- grey-area 14y agoCould anyone explain to me what's the point of Google's two-factor authentication? Without application specific passwords it's actually pretty secure. With ASP of course, according to this article, it's no more secure at all. So it looks like ASPs need to be revised/locked down. That doesn't mean that 2-factor security is useless in principle, just that this facet of it is insecure.
- badgar 14y ago> With ASP of course, according to this article, it's no more secure at all. This is not at all the conclusion of the article. This isn't a bright-line issue; security exists on a spectrum.
- Inufu 14y agoIf I want to hack your account, it's not enough to steal your password, I also need to steal your smartphone to generate the tokens. edit: I was referring to the Google Authenticator App, not sending the codes over SMS. That's imho less secure.
- deleted 14y ago[deleted]
- xyzzyz 14y agoYou don't have to steal a master password. It's enough to steal an application specific password, and if you do that, you won't need a smartphone to read my mail.
- cryptoz 14y agoThe really funny situation regarding the phone is that Google makes you do this when logging in on your phone too. So if you go buy a new phone, in order to log in you will have to undergo a few failed attempts, use their web log in form, which SMSs a password to the very same device you're using in the first place.
- 6thSigma 14y agoI think that's what the ASPs are for.
- objclxt 14y agoBecause the code is sent to a device Google know you have had physical possession of in the past. It's either sent by SMS, voice call, or to a pre-registered mobile app. The general point of two factor authentication is that you need physical access to something (phone, token generator, etc), meaning that if somebody across the world knew your password they'd still be unable to cause any damage - or rather, it would take a lot more effort.
- cryptoz 14y ago> Because the code is sent to a device Google know you have had physical possession of in the past. It's either sent by SMS, voice call, or to a pre-registered mobile app. None of those connect to device you've had "physical possession in the past". Only the present. Phone calls, SMS and apps are all portable across hardware.
- Sidnicious 14y agoAt least on iOS, the Google Authenticator app doesn't allow its tokens to be backed up or transferred.
- chirayuk 14y agoFor TOTP, you can have the same account on more than one device (I do for convenience). All you need is the initial seed which you can either enter manually, or scan the barcode using more than one device.
- xyzzyz 14y agoIf they know my master password, they also need to have a phone, that is correct. But if they know a single application specific password, they can read my mail just fine. How does the two-factor authentication protect me in this case?
- wting 14y agoMulti-factor authentication means choosing from: 1. something you know (password) 2. something you have (phone, yubikey) 3. something you are (biometrics) With Google's two-factor, logging in requires something you know (password) and something you have (phone). The 10 passwords should be locked somewhere physically safe as a fail-safe. Two-factor authentication protects against password leaks and brute force password attacks.[0] It now takes two security failures to access your account rather than one. On a side note, this is why secret questions are worthless as a security measure. Backing up a password with another mental fact is still single factor authentication. [0]: Unless the attackers were able to attain your fail-safe passwords, but unlikely given the entropy and presumably Google's security.
- xyzzyz 14y agoI'm not talking about 10 passwords I have as a backup. I'm talking about 10 application specific password that are used every day by my phone, mail client, xmpp client etc. They just need to intercept any single of these password to compromise my mail account. How's this different from the situation before two-factor authentication?
- marshray 14y agoAll I can figure is it makes it easier to revoke one password without changing all the others.
- bigiain 14y agoI think this is the answer, and I think it would have made sense if they'd called it a "device specific password" instead of an "application specific password". I've got an asp (dsp?) for my phone (which all the applications that need one on my phone use), another for my iPad, another for each of my laptops, home computers, and my work computer. If I lose (or have stolen) my phone, I can revoke the password it knows - without needing to change any of my other devices. Using the word "Application" allows everybody (including, I think, google's own security people) to make the incorrect assumption that the "iPhone mail password" is "specific" to mail - and only allows POP and IMAP to work. Instead, what "application" means is not the easily assumed "a piece of software" interpretation, but the "use to which something is put" interpretation. The decision and management of that "use to which a password is put" is not made nor emforced by Google, but is all up to _me_ (or, as it turned out, to any attacker who could lever one out of me).
- deleted 14y ago[deleted]
- agsamek 14y agoThe main advantage is that people need to remember lower entropy passwords or can use the same password in multiple places without compromising two factor protected system. Also two factor auth protects against keyloggers.