Slashdot Mirror
Google To Replace SMS Codes With Mobile Prompts in 2-Step-Verification Procedure (bleepingcomputer.com)
Starting next week Google will overhaul its two-step verification (2SV) procedure and replace one-time codes sent via SMS with prompts shown on the user's smartphone. From a report: This change in the Google 2SV scheme comes after an increase in SS7 telephony protocol attacks that have allowed hackers to take over people's mobile phone numbers to receive one-time codes via SMS and break into user accounts. The rollout process for this feature is scheduled to start next week when Google will invite users to try mobile prompts instead of receiving a one-time code via SMS. Users need an Internet-connected smartphone to use this feature. Every time users will try to log in, Google will show a prompt on their phone asking the account owner to approve the login request. There's no one-time code that users have to fill in, and users can authorize a login request with the tap of a button.
I know stories are posted farther apart at night, but it's embarrassing to have stories three hours apart on a weekday afternoon. These editors suck. There used to be a lot of pornographic fiction involving Slashdot editors. I'd like to see what you guys can come up with to explain why the editors weren't posting stories.
I am already on 2FA. I wonder about the situation where the user lost his/her one and only an Android phone, and is in the process of signing into a new one. How will this work?
..but won't this require a more persistent data connection than SMS needs?
I've had this for at least a year and a half, maybe more. I login to a Google service and it pops up a Yes/No prompt on my Android phone to confirm the login. This is news?
I usually don't keep have my iPhone with me when I'm working in my home office. Whenever I log into a website that requires me to look at my iPhone, I have to stop everything while I got fetch my iPhone from the kitchen table. A security token would be more convenient.
I don't know why the summary says "starting next week"... I used the new mobile prompt last week.
Google has been doing phone app prompts for 2FA for a while.
Is anything actually different with this system? Or is this just a campaign to encourage SMS code users to switch?
So what am I? Chopped liver?
I am Slashdot. Are you Slashdot as well?
You don't use android or have anything related to Google on your phone? like a Windows phone or iphone?
If it doesn't work, that sound like shutting off your customers out because they aren't 100% in your eco system.
n/t
...if I don't have Gapps installed?
If one uses Thunderbird and POP/IMAP will they get prompted every time the client downloads mail or just when done from a "new" system?
It must have been something you assimilated. . . .
Don't brake my heart, my achy braky heart, I just don't think Google would understand.
Uhhwoooooooo !!
I don't have to worry about people hacking SMS or whatever 2FA system because I don't use 2FA. I use a good unique password.
The trouble is, that's not good enough for Google. If I try to sign on from a different IP address I have to jump through impossible hoops. It's stupid because I can't even access my own account. What if for some reason I NEED to sign in using a different IP? Knowing the password should be enough, period. That's all I want and all I'm signed up for. I fucking hate them adding layers of bullshit above that which can potentially make it impossible to access my account if all I have is my password (ie. I lose my phone, IP/ISP, etc).
..and that the phone I do have (cheap-ass $50 plastic LG dumbphone, LOL) is turned off most of the time. Turn it on a couple times a day just to see if there are any messages for me. Physically shorted the GPS antenna on the main board to ground, so no GPS tracking when it's on anyway, just what tower it's connected to.
I'd never bothered to learn how worldwide PSTN actually worked until I read this article and looked up SS7. Scary, that all that has been done for decades in the clear.
But what if ... You don't use android or have anything related to Google on your phone?
Also: How is this displayed and the reply collected? Does it require the Chrome (or another) browser?
I haven't accepted the Chrome EULA on my Android phone (because it includes the Adobe Flash EULA, which in turn includes a lifetime non-compete, non-reverse-engineer provision).
So does that mean I can't auth with Google?
Bantam Dominique roosters crow a four-note song. Once you've heard it as "Happy BIRTHday" you can't NOT hear it that way
I got Goat Cheese Quesadilla. Where are my cock eggs?
I think you need the google search app installed for this to work.
Now I get to find out if my phone is a smartphone---or it's the user, dammit
Comment removed based on user account deletion
Comment removed based on user account deletion
More Complicated does NOT mean More Secure.
They never seem to remember this. However, I suppose it does stroke their unearned "I am a Wizard, fear me!" egos.
That is beyond incompetence.
vos nescitis quicquam, nec cogitatis quia expedit nobis ut unus moriatur homo pro populo et non tota gens pereat.
While your rabbi might give dispensation to read an SMS code on Saturday, there's no way you can press the ok button on the Sabbath.
And routing for sms to the handset is hijacked, how is routing for the voice path not also hijacked?
Something isn't kosher here.
Google stopped actually sending me text messages about 3 months ago, out of the blue. Oh, it still SAYS it's sending me one, but nothing. It used to work. Same phone, same number. Everyone else is still able to send me a text to log into my accounts, but not Google.
So, for me at least I'm fine with this, but I've already switched to Authenticator out of need.
On Windows phone and Android the Google app will send prompts to the lock screen.
IOS however Google chooses not to use notification center and you have to intentionally open the app to display the prompt.
Regardless of greater security I don't welcome this change as I hate that they don't push to notification center like they could.
I know stories are posted farther apart at night, but it's embarrassing to have stories three hours apart on a weekday afternoon. These editors suck.
Did you check the Firehose?
Maybe there wasn't anything else WORTHY of being posted.
When that happens I'd rather they DON'T post crummy junk articles just to make a quota.
And I bet, if they DID post such junk, we'd hear even more complaining about the quality of the editorial staff.
Once upon I time I was one of the sysops on an early conferencing system. You would not BELIEVE the amount of what we'd now call cyber-bullying that was directed at the sysops by people who wanted the site run THEIR way.
Bantam Dominique roosters crow a four-note song. Once you've heard it as "Happy BIRTHday" you can't NOT hear it that way
A few years ago, while I was too busy to realize how much I had spent, I found that I had at home: Desktop Workstation PC, Travel Laptop, Mobile Phone, 2 Tablets, and a kindle e-reader....
Apparently, I had an expensive gadget addiction...so I promised not to replace those devices that I didn't need.
Now, I'm down to a Microsoft Surface 3-in-1 (replaced my tablet, laptop,and phone). And, I gave my desktop workstation PC to my son. I still have the e-reader and the tablets which serve as my backup computer if something happens to the surface. For emergencies, I do have a samsung phone but it's turned off 90% of the time and all calls are forwarded to the surface.
The surface has a fingerprint reader and face camera so it can do some biometric identification...but I'm not really sure what the best implementation of 2 factor authentication should be in my situation. Google and most sites just blithely assume people like me don't exist.
It is just hidden from the user. It's not much of 2 factor if there is no code. Morrons.