4 ms·

You had two step verification, or not? I'm hoping you'll say no, because my feeling of security comes from the fact I've enabled TSV.

flanbiscuit 11y ago
second this! Hope it's a no
danieldk 11y ago
What kind of two factor authentication? TOTP codes don't protect you against e.g. phishing. A MITM can request codes and forward them (since they are time-based). Get a U2F key. They work with Google accounts and provide much better protection against phishing (the phishing site does not have the key handle and cannot initiate the challenge-response as a result): https://www.yubico.com/products/yubikey-hardware/fido-u2f-security-key/ https://www.yubico.com/products/yubikey-hardware/fido-u2f-se...
- artursapek 11y ago
  I love my Yubikey! I use it with all my Google accounts.
  - salibhai 11y ago
    Any benefit to Yubikey over Authenticator? EDIT: good points here: https://bitcointalk.org/index.php?topic=159444.0 https://bitcointalk.org/index.php?topic=159444.0
    - danieldk 11y ago
      This is old. They old Yubikeys with HOTP provided some advantages over authenticator, but new Yubikeys provide U2F which is much more resilient against phishing attacks. https://www.yubico.com/applications/fido/ https://www.yubico.com/applications/fido/ Moreover, U2F does not present itself as a USB keyboard (which had security implications on X11, since every application can listen in on keyboard events.)
  - rogeryu 11y ago
    So what happens when you lose that?
    - danieldk 11y ago
      You can associate multiple U2F keys with one Google account. Buy two, put one in a safe. They only cost ~15 Euro a pop.
- nadams 11y ago
  > What kind of two factor authentication? TOTP codes don't protect you against e.g. phishing. Sure it does. TOTP codes are only good for X seconds and most phishing scammers merely collect the information to use much later (I have seen the source behind the actual phishing sites). I have yet to hear of a story of someone's account being compromised while using TOTP (knock on wood). But seriously though - companies like Google, Facebook, Gandi, Dropbox, and Microsoft all use TOTP. So I would wager that TOTP is pretty safe to use.
  - danieldk 11y ago
    Sure it does. TOTP codes are only good for X seconds Not seconds, usually a minute: https://tools.ietf.org/html/rfc6238#page-6 https://tools.ietf.org/html/rfc6238#page-6 (This is mandated because the user could start typing at the end of a time step and/or clocks can be slightly out of sync.) and most phishing scammers merely collect the information to use much later Right. It's probably still profitable to do things in this manner because most people do not use any second factor. That does not change the fact that TOTP is extremely vulnerable to phishing. Most people here could probably a code that does this live in an hour or so. But seriously though - companies like Google, Facebook, Gandi, Dropbox, and Microsoft all use TOTP. Yes, because TOTP adds good security against other attacks, such as password leaks, since every site has its own shared secret.
    - nadams 11y ago
      > Not seconds, usually a minute: Almost every service I use is 30 seconds - including Google's [1]. Even in the RFC you linked it says 30 seconds. > This is mandated because the user could start typing at the end of a time step and/or clocks can be slightly out of sync. That is the downside of TOTP. If your clock isn't in sync with the server's then you may never have a valid OTP. However, I have seen many implementations allow for time shifting - ie the code that was generated in the past 30 seconds, this 30 seconds and the next 30 seconds are all valid. I didn't do that for my source code hosting service - but it makes sense in case the user hit enter right after the 30 second window. I suppose HOTP is supposed to solve the timing problem. > That does not change the fact that TOTP is extremely vulnerable to phishing. This doesn't make sense - TOTP isn't any more vulnerable than the password itself. You still need my password. And even if you phished that - by the time you would attempt to access my account the TOTP would be invalid. The only way that would work is if you were actively watching the captured credentials and attempted to login right away. That to me would be a targeted attack rather than some random phish. [1] - https://github.com/google/google-authenticator/wiki https://github.com/google/google-authenticator/wiki
larrys 11y ago
"You had two step verification, or not?" Upvoted you but... A company offers a free service. "Your aunt" does know know or understand the need for "two step verification" nor do almost certainly a large percentage of people using gmail. This idea that companies resolve themselves of all responsibility to provide reasonable customer support for a free product with such wide adoption is ridiculous. Google derives benefit from the relationship regardless of the fact that the service is free.
- finnjohnsen2 11y ago
  Yea but technical strong people like yourself are always able to handle themselves better in all aspects of computing. This is why you end up fixing your aunts printer. And why you have a more secure e-mail account than her. And why you can handle backing up your photos.... etc It's not Google's fault entirely.
  - larrys 11y ago
    "but technical strong people like yourself" I like the sound of that. I actually have run my own mail servers since the mid 90's [1] but I am more of a business guy who knows computers than a strong technical guy the way that I see it. I don't use gmail (for anything important I do use it for unimportant things) I don't like the idea of my mail sitting on their servers. [1] Actually if you include non internet mail dates back to the mid 80's on a Unix system V.
    - finnjohnsen2 11y ago
      How do you deal with spam when self hosting?
      - larrys 11y ago
        I don't filter any spam at all. I have found it helpful and have done deals with people that would normally be considered spammers. Wish I could provide details but let's just say that some people who spam actually are legitimate buyers of certain products or services and respond quite well to reply emails. How much spam do I get and have to go through? Easily 3000 messages per day. You will have to trust me when I say I have not regretted not doing any filtering in terms of what I do [1] [1] And no I do not sell a product or service to spammers...

flanbiscuit 11y ago

second this! Hope it's a no

danieldk 11y ago

What kind of two factor authentication? TOTP codes don't protect you against e.g. phishing. A MITM can request codes and forward them (since they are time-based). Get a U2F key. They work with Google accounts and provide much better protection against phishing (the phishing site does not have the key handle and cannot initiate the challenge-response as a result): https://www.yubico.com/products/yubikey-hardware/fido-u2f-security-key/ https://www.yubico.com/products/yubikey-hardware/fido-u2f-se...

artursapek 11y ago
I love my Yubikey! I use it with all my Google accounts.
- salibhai 11y ago
  Any benefit to Yubikey over Authenticator? EDIT: good points here: https://bitcointalk.org/index.php?topic=159444.0 https://bitcointalk.org/index.php?topic=159444.0
  - danieldk 11y ago
    This is old. They old Yubikeys with HOTP provided some advantages over authenticator, but new Yubikeys provide U2F which is much more resilient against phishing attacks. https://www.yubico.com/applications/fido/ https://www.yubico.com/applications/fido/ Moreover, U2F does not present itself as a USB keyboard (which had security implications on X11, since every application can listen in on keyboard events.)
- rogeryu 11y ago
  So what happens when you lose that?
  - danieldk 11y ago
    You can associate multiple U2F keys with one Google account. Buy two, put one in a safe. They only cost ~15 Euro a pop.
nadams 11y ago
> What kind of two factor authentication? TOTP codes don't protect you against e.g. phishing. Sure it does. TOTP codes are only good for X seconds and most phishing scammers merely collect the information to use much later (I have seen the source behind the actual phishing sites). I have yet to hear of a story of someone's account being compromised while using TOTP (knock on wood). But seriously though - companies like Google, Facebook, Gandi, Dropbox, and Microsoft all use TOTP. So I would wager that TOTP is pretty safe to use.
- danieldk 11y ago
  Sure it does. TOTP codes are only good for X seconds Not seconds, usually a minute: https://tools.ietf.org/html/rfc6238#page-6 https://tools.ietf.org/html/rfc6238#page-6 (This is mandated because the user could start typing at the end of a time step and/or clocks can be slightly out of sync.) and most phishing scammers merely collect the information to use much later Right. It's probably still profitable to do things in this manner because most people do not use any second factor. That does not change the fact that TOTP is extremely vulnerable to phishing. Most people here could probably a code that does this live in an hour or so. But seriously though - companies like Google, Facebook, Gandi, Dropbox, and Microsoft all use TOTP. Yes, because TOTP adds good security against other attacks, such as password leaks, since every site has its own shared secret.
  - nadams 11y ago
    > Not seconds, usually a minute: Almost every service I use is 30 seconds - including Google's [1]. Even in the RFC you linked it says 30 seconds. > This is mandated because the user could start typing at the end of a time step and/or clocks can be slightly out of sync. That is the downside of TOTP. If your clock isn't in sync with the server's then you may never have a valid OTP. However, I have seen many implementations allow for time shifting - ie the code that was generated in the past 30 seconds, this 30 seconds and the next 30 seconds are all valid. I didn't do that for my source code hosting service - but it makes sense in case the user hit enter right after the 30 second window. I suppose HOTP is supposed to solve the timing problem. > That does not change the fact that TOTP is extremely vulnerable to phishing. This doesn't make sense - TOTP isn't any more vulnerable than the password itself. You still need my password. And even if you phished that - by the time you would attempt to access my account the TOTP would be invalid. The only way that would work is if you were actively watching the captured credentials and attempted to login right away. That to me would be a targeted attack rather than some random phish. [1] - https://github.com/google/google-authenticator/wiki https://github.com/google/google-authenticator/wiki

larrys 11y ago

"You had two step verification, or not?" Upvoted you but... A company offers a free service. "Your aunt" does know know or understand the need for "two step verification" nor do almost certainly a large percentage of people using gmail. This idea that companies resolve themselves of all responsibility to provide reasonable customer support for a free product with such wide adoption is ridiculous. Google derives benefit from the relationship regardless of the fact that the service is free.

finnjohnsen2 11y ago
Yea but technical strong people like yourself are always able to handle themselves better in all aspects of computing. This is why you end up fixing your aunts printer. And why you have a more secure e-mail account than her. And why you can handle backing up your photos.... etc It's not Google's fault entirely.
- larrys 11y ago
  "but technical strong people like yourself" I like the sound of that. I actually have run my own mail servers since the mid 90's [1] but I am more of a business guy who knows computers than a strong technical guy the way that I see it. I don't use gmail (for anything important I do use it for unimportant things) I don't like the idea of my mail sitting on their servers. [1] Actually if you include non internet mail dates back to the mid 80's on a Unix system V.
  - finnjohnsen2 11y ago
    How do you deal with spam when self hosting?
    - larrys 11y ago
      I don't filter any spam at all. I have found it helpful and have done deals with people that would normally be considered spammers. Wish I could provide details but let's just say that some people who spam actually are legitimate buyers of certain products or services and respond quite well to reply emails. How much spam do I get and have to go through? Easily 3000 messages per day. You will have to trust me when I say I have not regretted not doing any filtering in terms of what I do [1] [1] And no I do not sell a product or service to spammers...