Slashdot Mirror
Google Plans Upgrade of Two-Factor Authentication For Politicians and CEOs (theverge.com)
An anonymous reader quotes the Verge:
Google plans on upgrading its two-factor authentication tool with an improved, physical security measure aimed at protecting high-profile users from politically motivated cyberattacks, according to a report from Bloomberg. The new service, to be called Advanced Protection Program and potentially slated to launch next month, will trade out the standard authentication process for services like Gmail and Google Drive with physical USB security keys. The service would also restrict the types of third-party apps and services that could connect to a user's Google account.
The changes are not likely to affect standard Google account owners, as Bloomberg reports that Google "plans to market the product to corporate executives, politicians and others with heightened security concerns."
The changes are not likely to affect standard Google account owners, as Bloomberg reports that Google "plans to market the product to corporate executives, politicians and others with heightened security concerns."
Yubikeys?
Ok Google, I get it. Us plebs don't deserve good security.
The elite use Google services instead of something private that isn’t reading all their mail and messages to spy on the constantly? What? What politicians and CEOs are stupid enough to trust cloud services they don’t own? Don’t they have IT staff to do this stuff for them in a manner that’s actually secure?
As you hide under the Cloak of A.C. ...
Who knows what is on it, but I'll plug it in to my computer anyway!
. . . but Google would never be lackeys, henchmen and hoodlums for the US government . . . and plant NSA spyware on the sticks . . .
. . . would they . . . ?
Schroedinger's Brexit: The UK is both in and out of the EU at the same time!
How is this left/right? Jared has already been caught along with a number of other trump people using private email. Get over it. But I totally agree with one of the prior comments. Thanks google for reminding us that once again the rich/political class is special.
Ha! Ha! Leftists. Good one.
As if the US has any leftist politicians.
I'd love to know what Google is actually changing, but the article doesn't really say - I've been using a physical security key for my google account logins for a while now. Though the 'limiting apps that can connect' is certainly a good thing, I can't figure out what they are actually changing otherwise.
Does this involve being able to force accounts to use a security key? What's really going on here?
A thousand pounds of wood moving at 300 feet per minute. Don't get in the way.
Because they will spend the money on USB keys and then not bother with creating some form of identity validation policy, cue the "I lost my USB key, can you give me a temporary password?" phone hack in 3...2...
Social Engineering. Because hacking ignorance, is timeless.
Usually giant companies like this have shitload of bureaucracy within and I really doubt that this is an idea of an engineer or a middle management. It's most likely something that the higher ups came up with as a marketing PR move to boost themselves.
Once this gets rolled out, I wouldn't be surprised that they're going to have this for coorperations/business logins, where Google's primary objective is to track people while they're logged in at work, usually at a different IP address as their personal home computer.
That's what all this google drive corporate accounts are for. Right now the authentication is your work login, but the data is stored on google servers.
Google already supports FIDO U2F keys, such as yubikey, that you can use instead of their google 2FA app.
How is this news?
No small wonder Google nonchalantly deactivated Y2F key support for Android recently....
As if the US has any leftist politicians.
Bernard?
If you want news from today, you have to come back tomorrow.
...but some are more equal than others.
-Squealer, Animal Farm
Says a person who doesn’t give away their real name and could have multiple sockpuppet accounts. So brave you are.
when I read this I thought they meant they had dumbed it down to make it easier to use than typing in a password or rubbing your finger over a fingerprint scanner because these has all proven to be overly difficult for CEOs and polititicians.
Nullius in verba
Yep, us and them. Thanks for making that clear, Google.
I thought politicians were supposed to use only their government email address.
"The average reporter we talk to is 27 years old......They literally know nothing." - Ben Rhodes
If you have "heightened security concerns," what on earth are you doing using a public webmail product?
Moderating "-1, Disagree" is simple censorship. Have the guts to post your opinion.
Google will not bite it of course. I would hope they'd spend more effort securing their services and Android, but instead they choose to align with powerful Washington DC elites and to hell with everyone else.
Fuck Google.
My account was hacked! I would never say stuff like that.
Oh, a man can dream, a man can dream.
excitingthingstodo.blogspot.com
That is the new Google "do not evil to the hand that feeds you" policy.
Those two groups are least likely to use it.
It isn't a good testbed.
It implies everyone else is less important.
It won't change hacker's mentality toward hacking.
CEOs shouldn't be using Gmail.
You can lead a man with reason but you can't make him think.
Is there anything but?
You can lead a man with reason but you can't make him think.
So with the increased security, that helps to protect from people trying to hack into Google. But who protects us from Google? They already have too much information and now they insist on having even more:
Google just pushed out an update last week, so apparently unless I turn on tracking and logging of everything I do (location, web history, etc), I can't use my Wear watch to search for ANYTHING anymore. Really?
The watch was great when I first bought it. Then they updated and ruined the search ability. Instead of being a nice, fast, Google web-like search engine, it became some stupid Google Now-like thing that doesn't ever give me what I want and no choices. Several months later it is "upgraded" to "Google Assistant" which REQUIRES I turn on all this tracking and storage. Almost nothing I want to search for requires a "history" of what I have done in the past.
> ... Ok Google, I get it. Us plebs don't deserve good security ...
Google has become an Animal Farm
They now practice the "All animals are equal but some animals are more equal than others " doctrine
Google is not going to sell strong authentication to every atom, Dick and Jane any more than Twitter (officially) sells verification to any plebe that wants it.
Symantec is hurting right now. Has google quietly purchased their RSA token division?
Hell, something like a YubiKey with capacitors to charge the RSA token generator from USB power would be nice.
As if CEOs and Politicians are the only people with important information. I see it as the exact opposite. People at the "top" rarely have the details of what is actually going on.
trump and his putrid ilk thank you for hiding their corruption.
The 1980s called. It wants its dongles back.
Like a lot of other good things in the world, it's not free. You want good things like good security, or good food, or good customer service, you have to be willing to pay for it.
Google likes to brag about improved security, but their "improvements" have led that many ordinary users have been locked out from their legitimate accounts, because Google has decided it knows better what kind of security you need. For instance, Google may reject the correct login and password if you try to login from another computer of yours. There is no clear guidelines how to recover from that. It is just that Google has decided that cookies stored one computer is more important that knowledge of login/password (or even ability to answer all security questions). This is a very poor decision, because if your password is stolen then your cookies can be stolen too. (If the attacker stole your information and erased your cookies, Google will trust more to the attacker than you.) Also, if you lose your cookies for whatever reason (hard-disk failure or whatever), you can lose your Google account. Google will offer you to answer their security questions, but it may not help even if all your answers are correct.
So, perhaps, it is good that they started their new "improvements" with their high-profile users, because if one of them loses his account, it will generate enough noise to force Google to take some real actions...
It allows one to read his post history
...now you know who is important to Google. And it is not virtually everyone reading this forum. Both politicians reading this will be encouraged that they are in the clear.
deleting the extra space after periods so i can stay relevant, yeah.
OOO yeah I use gmail to talk with other CEOs,
Compliance: ok
F*ck everything, we're doing Three-Factor Authentication!
The fact that the republicants currently control everything and still can't agree on healthcare or other issues....doesn't seem like it no.