Slashdot Mirror
Google Apps Gets Two-Factor Security
judgecorp writes "Passwords alone are not enough to secure access. Many organisations require two-factor authentication with a token. Google just added free two-factor verification to Google Apps, sending a one-off token to the user's mobile phone. It's good to have this for free, and it backs up Google's assertion that cloud apps are more secure — but it doesn't answer how it helps if an intruder is getting into Apps through a lost or stolen phone."
Or you know, a Google (or any other cloud service) employee access all your data because they own it then... No, cloud services are not more secure. Especially free ones who's business model is to make money off your private information.
For the low low price of your mobile phone number we will give you some extra security!
...which means if someone gets one factor (your phone), they still don't have the other (your password).
Learn to keep track of your damn phone...
We're all full up on Crazy here...
Does this mean that a misplaced phone will present a serious impediment to being able to access your work on Google Apps?
My postings are informational and does not constitute legal advice. Act on it at your risk.
It sort of compromises everything - but that doesn't mean it's a bad form of authentication, does it?
Once your machine, token, credentials, anything have been physically compromised, it's generally accepted that you're hosed (at least for that one factor).
Seems like a step in the right direction.
You mean it's not just Wish-it-was-Two-Factor? Google never ceases to amaze me. Now, how long must we wait before online banks finally get their security model right?
I'm worried because in all the years I've had a Google mail account I haven't had any issues, yet a month after getting an Android 2.1 phone, despite being really careful about only installing high rated applications with tens of thousands of users and mostly keeping an eye on what they're allowed to access, my gmail account was hacked and used to send out a spam email via a mobile device in canada.
I've never had an email account hacked before, so I'm pretty convinced that some phone app has leaked my account details (as it's the gmail account tethered to my phone).
Admittedly Google immediately suspended my account due to suspicious activity (access from Mobile Canada (71.17.214.49), I live in the UK), and a token to my mobile phone was how I unlocked it and changed my password, but I'm still rather wary now despite how much I love my Galaxy S mobile.
I have bought apps I don't want to lose wiping the phone, and I have no real way to tell what it may have been that leaked my data.
I have droidsecurity antivirus installed now, but wish google could offer some stronger post-install controls on what an app's allowed to do.
but it doesn't answer how it helps if an intruder is getting into Apps through a lost or stolen phone
When you lose your phone, the vast, vast, vast, vast majority of the time they just want to wipe your iPhone and sell it to the local pawn shop. They don't care about your data, your songs, your apps, etc. they simply see that shiny, new hardware = money. Same thing with laptops, they don't care about the data on it, they want to wipe "that funny looking OS" off of it and put a pirated copy of XP on there and sell it on eBay.
The idea that stolen gadgets are going to be used for something beyond simple hardware really overestimates either your value of data or the intelligence of thieves.
Taxation is legalized theft, no more, no less.
but it doesn't answer how it helps if ...
Judgecorp should wait until after second coffee to post.
What happens when an attacker has both factors in a two-factor situation is that security is breached. The same applies for any number of factors.
The objective is to improve security, nothing can guarantee it. No "answer" is needed.
(.....)
I'm a Programmer. That's one level above Software Engineer and one level below Engineer.
... that Paris Hilton lied when she said those pictures were obtained from her stolen phone?
Two factor authentication is the way to go. Sending a code to your phone is a great idea as cell phones / smart phones are very much a commonplace item in a user's inventory. Relying upon passwords alone is incredibly risky and should be augmented by a second form. This comes generally down to a physical special-use hardware token or we can use or better yet, use a cell phone and send the code to it instead. I know that this feature is available to World of Warcraft users (via the iPod / iPhone apps) and many banks have this as an option for online banking. The complaints revolving around losing one's cellphone are pointless. Yes, it compromises the second layer of authentication but the intruder would still need the initial password. The point is, it's a huge step forward in terms of security and should be adopted by anyone who is concerned about someone else capturing / guessing their password and accessing files etc.
...and they don't use Google apps, right?
Is it just my observation, or are there way too many stupid people in the world?
Would someone tell me how this happened? We were the fucking vanguard of security in this country. The password needing numbers was the password to own. Then the other guy came out with a need for numbers. Were we scared? Hell, no. Because we hit back with a little thing called the case sensitive and symbols. That's needing to remember your capitals and lowercases. For complexity. But you know what happened next? Shut up, I'm telling you what happened—the bastards went to 2 factor. Now we're standing around with our cocks in our hands, selling case sensitive in our passwords. Capitals or no, suddenly we're the chumps. Well, fuck it. We're going to 3 factor.
Sure, we could go to 2 factors next, like the competition. That seems like the logical thing to do. After all, one worked out pretty well, and two is the next number after one. So let's play it safe. Let's add on symbols and call it the strong passwords. Why innovate when we can follow? Oh, I know why: Because we're a business, that's why!
You think it's crazy? It is crazy. But I don't give a shit. From now on, we're the ones who have the edge in the security game. Are they the best a man can get? Fuck, no. Google is the best a man can get.
What part of this don't you understand? If one factor is good, and two factors are better, obviously three factors would make us the best fucking password that ever existed. Comprende? We didn't claw our way to the top of the security game by clinging to the one factor industry standard. We got here by taking chances. Well, three factors is the biggest chance of all.
Here's the report from Engineering. Someone put it in my pocket: I want to log into shit with it. They don't tell me what to invent—I tell them. And I'm telling them to stick two more factors in there. I don't care how. Make the factors so varied they're everywhere. Put some in their iPad. I don't care if they have to cram the third factor in sequence to the other two, just do it!
You're taking the "protected" part of "password protected" too literally, grandma. Cut the strings and soar. Let's hit it. Let's roll. This is our chance to make security history. Let's dream big. All you have to do is say that three factors can happen, and it will happen. If you aren't on board, then fuck you. And if you're on the board, then fuck you and your father. Hey, if I'm the only one who'll take risks, I'm sure as hell happy to hog all the glory when the three factor security becomes the security tool for the U.S. of "this is how we secure now" A.
People said we couldn't go to case sensitive. It'll cost a fortune to manufacture, they said. Well, we did it. Now some egghead in a lab is screaming "three factor's crazy?" Well, perhaps he'd be more comfortable in the labs at Microsoft, working on fucking administrator permission. Confirm permission, my white ass!
Maybe I'm wrong. Maybe we should just ride in Apple's wake and make phones. Ha! Not on your fucking life! The day I shadow a penny-ante outfit like Apple is the day I leave the security game for good, and that won't happen until the day I die!
The market? Listen, we make the market. All we have to do is put her out there with a little jingle. It's as easy as, "Hey, security with anything less than three factors is like twittering your passwords to the world." Or "You'll be so secure, you won't even need condoms anymore." Try "Your encryption's gonna be so complex, Turing's going to come back to make an encryption algorithm with the key YOU ARE FUCKING AWESOME."
I know what you're thinking now: What'll people say? Mew mew mew. Oh, no, what will people say?! Grow the fuck up. When you're on top, people talk. That's the price you pay for being on top. Which Google is, always has been, and forever shall be, Amen, three factors, sweet Jesus in heaven.
Stop. I just had a stroke of genius. Are you ready? Open your mouth, baby birds, cause Mama's about to drop you one sweet, fat nightcrawler. Here she comes: Put another password on that fucker, too. That's right
it doesn't answer how it helps if an intruder is getting into Apps through a lost or stolen phone.
Nor does it handle lost luggage, traffic jams, or slow-pouring ketchup. Yes, we all bow to your cleverness at identifying situations that it doesn't address, but in the 99.9999% of other situations, it's a nice bonus.
Dewey, what part of this looks like authorities should be involved?
but it doesn't answer how it helps if an intruder is getting into Apps through a lost or stolen phone.
Nor does it help if your employees are disclosing your secrets at gunpoint while simultaneously receiving the oral attentions of Halle Berry.
But what it does do is what it says on the tin: prevents people getting in to your apps by guessing a user's password is "swordfish" (or "joshua" or "kronos" or "peekaboo" or the cat's birthday) or otherwise fishing or sniffing it.
In a survey of 100 programmers, 111111 thought that duck-typing was a good idea.
I don't think judgecorp can count. The idea of the 2 step authentication is that there are two steps. This means that just having your password is not enough. It also means that just having your mobile phone is not enough either.
This means that if somebody steals your phone, they still can't get in as they don't have your password.
Phillip.
Property for sale in Nice, France
That's a great example of why some argue that the "secret questions" approach to "enhanced security" is actually less secure than just a password.
Bruce Schneier has written about this, twice. Yet Target.com insists on having credit card holders set five (!) secret questions.
Your phone is too smart to be secure. Buy a $10 Alcatel.
If I buy a dumb phone, then on what device will I run apps? Google hasn't officially opened the Market to Android devices other than phones.
What do they mean "it doesn't answer the question..." about if someone has your phone. If they have your phone, duh, it won't help. Then again, they will probably not need google apps, since they can use the native mail applications (if it's a smartphone at least), and have all your data that's on the phone.
but it doesn't answer how it helps if an intruder is getting into Apps through a lost or stolen phone
That would be what the first factor is for. Unless you also store your passwords on your phone in which case you've just intentionally reduced yourself back to one-factor security and well.. don't do that.
Two-factor security isn't 100% perfect. Its always possible for someone who knows your password to also steal your phone. But the chance is significantly reduced compared to the individual chances of your phone being stolen or your password being keylogged/otherwise compromised. Three-factor security would be better still (a biometric "touch" perhaps?).. 100-factor security would be better still. But as with most security issues, you get an annoyance/benefit trade-off and its a matter of figuring out how much people will be willing to do to prevent their friends from changing their facebook status to "I am the suxx0r!" That amount will go up as time goes on of course -- between more people being aware of security issues, and technology making the extra factors less intrusive (oh, and they have to be free -- few home users will be willing to drop $50 or $100 for a biometric scanner for example. Unless they've already been a victim of identity theft.)