15 ms·

Disable SMS for 2-step and SMS for password resets and use a 2-step mobile app. https://support.google.com/accounts/answer/1066447 https://support.google.com/a

by abraham 12y ago

Disable SMS for 2-step and SMS for password resets and use a 2-step mobile app. https://support.google.com/accounts/answer/1066447 https://support.google.com/accounts/answer/1066447

anonymoushn 12y ago
After enabling 2FA, disabling SMS for 2-step and SMS for password resets, and ensuring that you don't have any phone number set as a way to get into you account, what is your plan for continuing to use your account if your phone is stolen?
- subliminalbrad 12y ago
  Backup codes.
  - patrickdavey 12y ago
    I thought that would be an answer, but then if your phone is stolen and they get in, couldn't they simply invalidate your 2fa codes too? Mind you, it's probably the best idea.
    - abraham 12y ago
      Simply stealing your phone isn't enough. They also need to know your password change 2-step settings.
      - mbrubeck 12y ago
        So you also need to make sure that your phone's browser doesn't have your Google password stored, and/or your phone's storage is encrypted with a strong-enough key.
        trentmb 12y ago
        Google has made me re-enter my password when modifying 2fa settings.
        eli 12y ago
        Sure, but if it's saved in the browser than it can be extracted from the browser
      - founder6564 12y ago
        Last I checked, this was not the case- And a major cause for concern.
        abraham 12y ago
        Everytime I go to https://www.google.com/settings/security https://www.google.com/settings/security and click on 2-step verification, I'm required to enter my password if I haven't done so in the last 5 min or so.
    - anonymoushn 12y ago
      With this scheme someone can't access your account by stealing your phone. You also can't access your account by getting your phone number to point to your new phone though.
    - abalone 12y ago
      Put a strong password on the phone. Not just a PIN. Touch ID makes that practical now.
      - hahainternet 12y ago
        If you have a targeted attacker then Touch ID is actually less secure.
  - bigiain 12y ago
    It's also possible to install the seed for the TOPT generator on multiple devices - all the ones I've bumped into have a mechanism for typing in a long-ish string as well as scanning a QR code - record that string (secured like a password, in something like 1Password) and you can always re-seed another device to come up with the same codes. I've got all mine on two phones and a iPad - one of the phones is usually in my pocket, the other is almost always at home. As always, it's a security/convenience tradeoff - I've gone from needing "something I know and something I have" to "something I know and any one of several things I have". Your tradeoffs there may vary - if I were a political-dissident/whistleblower/drug-czar I'd probably consider the risk of losing access altogether preferable to opening up additional avenues for vulnerabilities - an NSA-level adversary would probably have a significantly easier time if they knew they only needed to stealthily subvert one of several devices (at least one of which I don't usually have on my person) to get access to all my tfa secured assets, but the additional risk if I'm protecting myself from 4chan-grade griefers or non-network-pervasive internet criminals is - for me - low enough to accept for the additional reliability and convenience of multiple authorised tfa token generating devices.
    - deleted 12y ago
      [deleted]
    - seanp2k2 12y ago
      In my experience, when setting up a new device, you have to scan the QR or type in a code, then verify a generated key or two to "confirm" the new device. I'm not sure if that's an optional step, but it seems like you'd need to log in first, thus creating a chicken-egg situation for yourself. I'm sure you could enroll another device (e.g. tablet that always stays in the house, SO's phone, whatever), but it doesn't seem like it'd work as you spelled it out. Backup codes may be a good option if kept somewhere very safe.
      - bigiain 12y ago
        The "enter a generated code to confirm" step is to confirm at the server end that you've got an identical seed - they (presumably) use that before committing that seed to your user account (to ensure you aren't about to lock yourself out). It's mot needed at the client end. I've got at least gmail, aws(/amazon), Github, Dropbox, Zoho, and several TOTP TFA protected WordPress sites on 3 different devices using this method. It definitely works. I see additional devices start to generate the same codes when I add the same seed (so long as their clocks are reasonable synced...) This is using the Google Authenticatior app on iOS and Android, I _think_ any RFC6238 compliant TOTP app that lets you type in a string to key it should "just work".
- abandonliberty 12y ago
  Also other trusted devices can bypass 2factor. Less secure, of course, but my desktop and laptop bypass two factor.
  - abraham 12y ago
    Bypass 2-step to access your account but they can't change your Google password.
    - abandonliberty 12y ago
      I responded to a comment about, "what is your plan for continuing to use your account if your phone is stolen?" Did you downvote and responded to a thread incorrectly?
      - deleted 12y ago
        [deleted]
        abraham 12y ago
        That requires you entering your password which shouldn't be left in plaintext on your device.
        abandonliberty 12y ago
        Yes, but many people leave their gmail accounts logged in. That's enough to access and disable 2factor on a laptop/desktop. Also, what's with the downvotes?
        abraham 12y ago
        Even if you are logged into your Gmail account, Google still requires you to enter your password to disable 2-step auth.
      - abraham 12y ago
- deleted 12y ago
  [deleted]
bigiain 12y ago
Indeed, as advised by telcos themselves (at least all _my_ local telcos): http://www.itnews.com.au/News/322194,telcos-declare-sms-unsafe-for-bank-transactions.aspx http://www.itnews.com.au/News/322194,telcos-declare-sms-unsa... '"SMS is not designed to be a secure communications channel and should not be used by banks for electronic funds transfer authentication," Stanton told iTnews this week.'
founder6564 12y ago
Make sure you disable it in BOTH spots, or you are still vulnerable! Disabling mobile for account recovery still leaves it for 2FA. You need to do both. https://accounts.google.com/b/0/SmsAuthSettings?LoginInterstitial=1#devices https://accounts.google.com/b/0/SmsAuthSettings?LoginInterst... AND https://security.google.com/settings/security/contactinfo?pli=1 https://security.google.com/settings/security/contactinfo?pl...

by abraham 12y ago

Disable SMS for 2-step and SMS for password resets and use a 2-step mobile app. https://support.google.com/accounts/answer/1066447 https://support.google.com/accounts/answer/1066447

anonymoushn 12y ago

After enabling 2FA, disabling SMS for 2-step and SMS for password resets, and ensuring that you don't have any phone number set as a way to get into you account, what is your plan for continuing to use your account if your phone is stolen?

subliminalbrad 12y ago
Backup codes.
- patrickdavey 12y ago
  I thought that would be an answer, but then if your phone is stolen and they get in, couldn't they simply invalidate your 2fa codes too? Mind you, it's probably the best idea.
  - abraham 12y ago
    Simply stealing your phone isn't enough. They also need to know your password change 2-step settings.
    - mbrubeck 12y ago
      So you also need to make sure that your phone's browser doesn't have your Google password stored, and/or your phone's storage is encrypted with a strong-enough key.
      - trentmb 12y ago
        Google has made me re-enter my password when modifying 2fa settings.
        eli 12y ago
        Sure, but if it's saved in the browser than it can be extracted from the browser
    - founder6564 12y ago
      Last I checked, this was not the case- And a major cause for concern.
      - abraham 12y ago
        Everytime I go to https://www.google.com/settings/security https://www.google.com/settings/security and click on 2-step verification, I'm required to enter my password if I haven't done so in the last 5 min or so.
  - anonymoushn 12y ago
    With this scheme someone can't access your account by stealing your phone. You also can't access your account by getting your phone number to point to your new phone though.
  - abalone 12y ago
    Put a strong password on the phone. Not just a PIN. Touch ID makes that practical now.
    - hahainternet 12y ago
      If you have a targeted attacker then Touch ID is actually less secure.
- bigiain 12y ago
  It's also possible to install the seed for the TOPT generator on multiple devices - all the ones I've bumped into have a mechanism for typing in a long-ish string as well as scanning a QR code - record that string (secured like a password, in something like 1Password) and you can always re-seed another device to come up with the same codes. I've got all mine on two phones and a iPad - one of the phones is usually in my pocket, the other is almost always at home. As always, it's a security/convenience tradeoff - I've gone from needing "something I know and something I have" to "something I know and any one of several things I have". Your tradeoffs there may vary - if I were a political-dissident/whistleblower/drug-czar I'd probably consider the risk of losing access altogether preferable to opening up additional avenues for vulnerabilities - an NSA-level adversary would probably have a significantly easier time if they knew they only needed to stealthily subvert one of several devices (at least one of which I don't usually have on my person) to get access to all my tfa secured assets, but the additional risk if I'm protecting myself from 4chan-grade griefers or non-network-pervasive internet criminals is - for me - low enough to accept for the additional reliability and convenience of multiple authorised tfa token generating devices.
  - deleted 12y ago
    [deleted]
  - seanp2k2 12y ago
    In my experience, when setting up a new device, you have to scan the QR or type in a code, then verify a generated key or two to "confirm" the new device. I'm not sure if that's an optional step, but it seems like you'd need to log in first, thus creating a chicken-egg situation for yourself. I'm sure you could enroll another device (e.g. tablet that always stays in the house, SO's phone, whatever), but it doesn't seem like it'd work as you spelled it out. Backup codes may be a good option if kept somewhere very safe.
    - bigiain 12y ago
      The "enter a generated code to confirm" step is to confirm at the server end that you've got an identical seed - they (presumably) use that before committing that seed to your user account (to ensure you aren't about to lock yourself out). It's mot needed at the client end. I've got at least gmail, aws(/amazon), Github, Dropbox, Zoho, and several TOTP TFA protected WordPress sites on 3 different devices using this method. It definitely works. I see additional devices start to generate the same codes when I add the same seed (so long as their clocks are reasonable synced...) This is using the Google Authenticatior app on iOS and Android, I _think_ any RFC6238 compliant TOTP app that lets you type in a string to key it should "just work".
abandonliberty 12y ago
Also other trusted devices can bypass 2factor. Less secure, of course, but my desktop and laptop bypass two factor.
- abraham 12y ago
  Bypass 2-step to access your account but they can't change your Google password.
  - abandonliberty 12y ago
    I responded to a comment about, "what is your plan for continuing to use your account if your phone is stolen?" Did you downvote and responded to a thread incorrectly?
    - deleted 12y ago
      [deleted]
      - abraham 12y ago
        That requires you entering your password which shouldn't be left in plaintext on your device.
        abandonliberty 12y ago
        Yes, but many people leave their gmail accounts logged in. That's enough to access and disable 2factor on a laptop/desktop. Also, what's with the downvotes?
        abraham 12y ago
        Even if you are logged into your Gmail account, Google still requires you to enter your password to disable 2-step auth.
    - abraham 12y ago
deleted 12y ago
[deleted]

bigiain 12y ago

Indeed, as advised by telcos themselves (at least all _my_ local telcos): http://www.itnews.com.au/News/322194,telcos-declare-sms-unsafe-for-bank-transactions.aspx http://www.itnews.com.au/News/322194,telcos-declare-sms-unsa... '"SMS is not designed to be a secure communications channel and should not be used by banks for electronic funds transfer authentication," Stanton told iTnews this week.'

founder6564 12y ago

Make sure you disable it in BOTH spots, or you are still vulnerable! Disabling mobile for account recovery still leaves it for 2FA. You need to do both. https://accounts.google.com/b/0/SmsAuthSettings?LoginInterstitial=1#devices https://accounts.google.com/b/0/SmsAuthSettings?LoginInterst... AND https://security.google.com/settings/security/contactinfo?pli=1 https://security.google.com/settings/security/contactinfo?pl...