Slashdot Mirror
Google Is Finally Making Two-Step Verification Less Annoying (theguardian.com)
Google, which first introduced two-factor authentication about five years ago, is now making it a little easier to utilize this security measure. Instead of users having to manually enter a code that they received in a text message, they will now see a prompt message that only requires them to tap on the phone to approve login requests. The feature will be available on Android as well as iOS soon. The Guardian reports: You do have to turn this service on even if you already use two-step. To turn it on you need to first login to Google and then go to My Account > Sign-in & security > Signing in to Google > 2-step Verification. There you will have options to turn on two-step verification, add Google prompt as an extra form of authentication or replace your existing two-step method. Google isn't the first to use notifications as a method of login verification, both Twitter and Facebook allow users to confirm logins using notifications from their respective smartphone apps. But even they require entering the app, viewing the alert and tapping confirm. Google's one-tap confirm is much faster.
And why on God's green earth would I want to give Google my telephone number?
I like the current setup as it does not require my phone to have a data connection. Not everywhere I have a computer connected to the internet do I have wifi available. The app generating a code seems more flexible in my opinion.
Don't use Google's stuff. Problem solved.
Let's face it: the IT industry has, intentionally or otherwise, pretty much trained users to just robotically click "Yes" and "I Accept" on eight trillion things they don't understand. And now we will have eight trillion and one, and security will be worse for it.
Help save the critically endangered Blue Iguana
And how long do you think it'll take for the Bad Guys [tm] to invent their own "one-tap app", that will look and act exactly like Google's .. or worse, will be phished or sneaked into your system without your knowing, will act like your phone, and will transmit everything it discovers to its real owners? Lessee, what is today .. Tuesday?
But I don't find SMS two-factor with to be particularly burdensome. It's simple, it works, and it relies only on a de-facto standard method of communication that pretty much everyone already has access to - no vendor lock-in required.
#DeleteChrome
LOL, Microsoft has been doing this for a long time already.
I've already enabled 2factor on my Google Accounts, yet I don't have a smart phone so what use is this? Hell all they now need is to get hold of your smart phone and steal not only your Gmail but any accounts that use it for the reset pw's. Once they've got that, you're screwed, blued and tattooed in hot pink/lime/dayglo orange just to make sure they remember who've they've already pawned.
I'll stick with the simple text message and enter it into the website instead of allowing my phone to simply be tapped to confirm. This way, I have the possibility of preventing any changes as I get the request.
Air Droid has this since a while...
Does Google allow you to use Google Authenticator?
If you reply, do so only to what I explicitly wrote. If I didn't write it, don't assume or infer it.
It's useless if you don't have a data plan on your phone.
Previously I could read the auth code off of my home screen and type it in.
If I enable this I will have to :
1) enter my 6 digit pin number to unlock my phone.
2) Pull down the notifications bar.
3) Pull down again to expand the notifications / scroll through them.
4) Tap the notification
5) Tap 'Yes/Accept'
6) Lock Phone
Your Android steps may differ (I'm running custom cyanogenmod) and haven't tested it yet. I think I'll stick to Read, Swipe, and Type.
This is probably way worse security for the techno-illiterate.
Attacker enters password.
Clueless user gets notification, taps it.
Attacker is let in.
Whereas before it would be:
Attacker enters password.
Clueless user gets a number that they don't know what to do with
Attacker is not let in.
Ah yes.
That obstacle to logging in, making it impossible to access Google services if you do not carry your phone, lost it, it got stolen, the battery is empty, it crashed, it's out of coverage area.
Not sure how that can be made "less annoying".
Will it turn on the phone's flash to see the FUCKING KEYBOARD? Google wants everything BRIGHT FUCKING WHITE instead of dark. C'mon Google, why is a dark theme for your Google Authenticator like a suppository you you won't cram up your ass?
Blizzard has similar functionality where the app will look at queued login attempts and ask for approval. Before that, it was IBM's ZTIC which was one of the first 2FA systems which did this.
I wish this were open source, just like TOTP is right now. I use a third party application that allows me to sync my 2FA codes (encrypted, of course) among my devices, including my Linux boxes, and my NAS machines. Having the ability to just tap "approve" for SSH connections would be nice, but it likely would require more moving parts outside my LAN, which could make things less secure.
I do. I'm nearly 50 years old, have lived in several places, have worked at a number of jobs over the years, had multiple romantic relationships in my life. I've made friends every year, in all of those places, through many diverse ways. Are all of the folks I've friended currently on my short list? No. But that list of a dozen close friends has evolved over time with new ones entering and others dropping off as we move about, go through various stages of life, some have died, etc. But they have my phone number. I have theirs. I may also have their closest friends or family members phone numbers. That adds up to well over a hundred people. And while I'm social I'm nobody compared to some of the butterflies I know. More than two people for every year of life? Those gregarious folks get, and use, that many numbers in a night on the town. No, for most of us non-hermetic folks I'd guess a hundred friends or more is entirely unsurprising.
I don't read ACs: If a post isn't worth so much as a nom de plume to its author then I wont bother either.
There is another option, which is the the FIDO U2F Authenticator, which Google calls a Security Key. While not flawless (see below) it provides much better security than SMS based authentication and is designed from the ground up to protect privacy.
The Security Key is really the right solution to solving the second factor problems as it is based on public key crypto and incorporates additional security mechanisms (TLS Channel and Web Origin are included in the signature) that make the authentication not phishable.
The biggest flaw right now to the problem is adoption, Chrome is the only browser that currently supports it and NFC is just getting started so mobile support is lacking. However, if your setup lends itself to a security key solution then you will benefit greatly from the configuration.
If they implement this properly it will be awesome with smartwatches!
My school uses 2FA through a company called Duo and anytime I go to log in to a school website a notification pops up on my Apple Watch and I just need to touch "Approve" and I'm in. No fumbling for my phone or a key-fob... it's instant and convenient... takes all of the pain out of 2FA.
I don't have a phone! Can't you buy some rolling key fob somewhere and register the code with them?
I have no phone!
Twinstiq, game news
I've been doing this for months. I'm sure the service has been available for much longer.
But without google.
Something like an android app and some web service coupled with a pam module. The login prompt then displays a number, the app displays the number as well and i can accept the login from the app with a single tap. Fallback to normal google authenticator.
Another alternative is to use TOTP (Time-derived One-time password):
an ever changing code that is based on a hash, computed out of the current time (hence the ever changing) and a shared secret that only you and google know.
Only someone possessing the shared secret can compute the correct code for that time.
The secret itself is never sent on the wire, only the current-time code derived of the secret is.
You can find apps running on tons of other hardware if you don't own an Android nor an iPhone (or simply don't want to give that phone number to google).
You could even built your own, using an Arduino, an LCD display and some mean to get accurate(-ish enough*) time (e.g.: GPS chip or a DCF77 receiver if you're in Europe, or a RDS FM radio receiver, or extract it from TV broadcast, etc.)
TOTP is supported as a two-factor standard at lots of other companies (Facebook has it as a possibility, nearly every bitcoin-related website I've seen has it, Microsoft too, etc.)
(*) - a new code gets generated every 30 seconds, and some server-side implementation also compare against the past couple of code.
So your clock doesn't necessarily need to be that much precise.
You could get the time from your wrist watch if you don't have any time source.
Or you could run the TOTP *on* the wrist watch if yours happen to be programmable (e.g.: Pebble)
"Sufficiently advanced satire is indistinguishable from reality." - [Tips: 1DrYakQDKCQ6y52z6QbnkxHXAocMZJE61o ]