Slashdot Mirror
Less Than 1 in 10 Gmail Users Enable Two-Factor Authentication (theregister.co.uk)
It has been nearly seven years since Google introduced two-factor authentication for Gmail accounts, but virtually no one is using it. From a report: In a presentation at Usenix's Enigma 2018 security conference in California, Google software engineer Grzegorz Milka this week revealed that, right now, less than 10 per cent of active Google accounts use two-step authentication to lock down their services. He also said only about 12 per cent of Americans have a password manager to protect their accounts, according to a 2016 Pew study.
Not everyone wants to give Google more personal info -- working phone #, alternate email, etc and so forth.
Also, this doesn't work well with standards-compatible email clients like Thunderbird or K-9.
About 3 years ago someone stole roughly 2.45 BTC from me.
The event was a real wake up call for me security wise. They hacked e-mail address to access a password reset form on coinbase and they used social engineering on my cell phone carrier to forward SMS messages (which I used as 2FA on coinbase) to steal that money from me. Ever since then I've had all my 2FA set up through google authenticator instead and 2FA set up on literally everything I can.
It was only worth about $700 at the time, but now . . .
In a bit of shameless internet panhandling, I accept Litecoin Donations at Lbd2oH9QsthD1GfuUXPyka12YxvWJYnBVf
Because I refuse to give Google my cell phone number to text me, because there is no way in hell they need to be able to track me even further.
That's a big old "hard no" there, chief.
Google's 2FA is as much about them getting more information about you as it is your security.
Why is everyone talking about cellphone numbers and SMS?
Aren't we talking about Google's own Authenticator application?
#DeleteFacebook
The main reason that I haven't enabled 2-factor on my account is that U.S. cellular carriers charge not only for sent messages but also for received messages. T-Mobile, for example, charges its pay-as-you-go customers 10 cents to send and 10 cents to receive. And no, Google and Twitter don't allow use of a FIDO U2F key or a TOTP client without also having a mobile phone number set up.
You are correct that Google publishes a TOTP client called Google Authenticator. But when I installed Google Authenticator, I discovered that Google is unwilling to offer TOTP authentication unless the account holder has already linked a phone on a supported carrier. From "Install Google Authenticator":
I had 2FA enabled, then left my phone in an uber by accident and a subsequent passenger stole it. The emergency 2FA codes I'd printed out didn't work. In order to track and remotely disable my phone, I ended up having to use a computer which I'd thankfully left logged into gmail to disable 2FA for my account (which for some reason it allowed me to do without any 2FA code), after which I could do what needed doing. I haven't re-enabled it since because I realized that losing or breaking my phone is frankly more likely than having my password stolen, and losing my phone with 2FA enabled can be a disaster of its own (even if emergency codes work, what if I don't have them with me? And if I need to carry them with me whenever I stray more than an hour or so from home, that makes it much more likely that the emergency codes themselves could be lost or stolen.) As I learned after that incident, any other services you've tied into Google Authenticator 2FA also become a huge hassle to regain access to, because just installing Google Authenticator on your replacement phone won't cut it.
"Fewer."
(this is not a
Everyone thinks their secret box is more important than their neighbor's secret box.
Guess what, all your emails are boring! I've been an SA since the 1990s and root on thousands of Unix servers dating back to SunOS-4, and no one has anything interesting in their emails.
Stop inflating your egos by thinking everyone is after your special sauce. Unless you're connected to a politician or celebrity, no one gives the fattest rats posterior what you gotta say or what you're sending plaintext.
"2FA isn't secure if it only relies on a phone number as a substitute for cryptography. A single call to the outsourced customer service department of your phone company could transfer your number to the sim card of a malicious actor."
So now it requires they know your phone number, and dedicate up to an hour or so of human time, of a human capable of social engineering a telco rep...to transfer a sim. They'll do that for a specific high value target, but not some rando.
Plus, without 2FA, i've already pwned your account and stolen your bitcoins by the time you read this post. With 2FA, assuming i can even figure out your phone number (not a given), I'll still be on hold with your telco for another 10 minutes before I can even attempt to start social engineering a SIM transfer.
Your absolutely right... 2FA isn't perfect, especially SMS based 2FA. But its about a million times better than no 2FA at all.
Passwords are bad, but are a lot less annoying than passwords plus 2FA. The loss of the second factor is basically a nightmare, and each service wants you to use their own app or whatever. Even changing phones becomes a hassle. I get it for an enterprise environment, where in an emergency, you can call your local IT guy an get them to reset it for you, but if something goes wrong with Google you're screwed. You can't even pay to talk to someone to get it fixed.
Since I cannot have a cellphone in the office, no 2FA for gmail for me.
I'm not going to use 2 factor because I don't want Google to know my gmail address.
I'll see your senator, and I'll raise you two judges.
Your 2FA can be via mobile phone (SMS), another email account, the Google Authenticator app (though I'd recommend Authy instead), or a pre-generated set of recovery keys you can store on your computer (or write down on a post-it and stick it to your monitor if you wish). The latter two don't require giving up any personal info, and are arguably more secure anyway.
Just because my browser has a built-in password manager, doesn't mean I use it. I use Keepass instead
You aren't using it because you are already using something else. But for 90% of the public, if a popup asks "Do you want Chrome to remember this password?", they are going to think "Sure, why not?". But if someone later asks them "Are you using a password manager?", they will say "No", because they don't even know what that is.
The concept is great, but if I accidentally left my phone at home, I'm locked out of my email.
"I believe in Karma. That means I can do bad things to people all day long and I assume they deserve it." : Dogbert
For, who uses gmail for anything serious?
Anyone clicking "Yes" on a "Remember the password for this Site?" prompt in Chrome, Firefox or Safari is a complete moron. Why would anyone trust Apple, Google or Mozilla with the Keys To Their Kingdom? I might have trusted Mozilla with them a decade ago, but not any more.
If you use your gmail account as the primary account on all of your other sites, you are trusting Google with the Keys to Your Kingdom. Substitute whatever email service provider you use, because anyone who controls your email can almost certainly reset the password on any other account you have, unless that other account has some 2FA of its own. Security questions are weak in general, but even weaker against someone who has all your email and can mine it for answers.
Also... you're apparently saying that you trust Google, Mozilla or Apple enough to type your passwords into their browsers but not enough to use their password storage solutions. Does that make any sense at all? The only way it makes sense is if you assume that they're not competent to properly secure the password database (which is fairly easy), but are competent enough to get the rest of the security right (which is very hard). It clearly makes no sense if you assume they might be maliciously interested in stealing your passwords, because you're typing your passwords into their browser.
And, FWIW, if you set a sufficiently-long sync password on Chrome, Google has no access to the passwords that Chrome stores for you. Yes, they all get uploaded to Google, so they can be synced between Chrome instances on different machines, but they're all encrypted with your sync password.
Note to ACs: I usually delete AC replies without reading them. If you want to talk to me, log in.
Well guess what? I'm going to hack your email and you'll be getting dogfood WHEN YOU STILL HAVE SOME! AHAHAHAHA
The "second factor" in most cases can absolutely be put into something like KeePass if you have the plugins to work with it. It's just a seed you jam into a hashing algorithm along with the current time.
The only ones you need a third party for are those which are unknown to you (an awful idea). For example, a site sending you a one-time code (randomly generated, hopefully) via text or email. That's not 2 factor, that's 2 channel. (And SMS is a joke in terms of security, and email just verifies the person logging in has access to that email, there's not actual check that they are the person they claim to be.)
Multi-factor authentication traditionally relies on 3 things. Something you are (a fat, ugly slob), something you have (the worst BO of all time) and something you know (a password). In the real world this works just fine. The guard at your workplace knows you, asks to see your badge, and you put in you password into whatever terminal. There is active verification of these 3 different types of criteria. On the internet, they try to ape that security but in the end it's all "something you know". Whether that's the password, the seed for somsone's password-generating clock, their phone number to pull the SMS down, a hash of their retina/fingerprint/anus/etc. it doesn't matter.
My keyfile is the a specific string of text (with no returns to avoid the /n/r and /n text file differences between Windows and *nix). That way I can't lose it unless I forget that string of text, and I can easily remake it if need be from any text editor.
I started using 2FA recently, before that unique passwords & pw manager. I've never been bitten by security problems, but I'm relatively low profile.
Working with u2f (yubikey) and totp (google authenticator) has been a bit annoying. Most sites don't support u2f, or even 2FA in general. The ones I want to have 2FA, like my bank, do not or they implement it through sms/email. Some sites, like Facebook, have issues with multiple u2f tokens (ie. second and subsequent tokens do not work). It requires extra effort to get gmail working in external clients with saved device trust instead of 2FA as well.
Actually using u2f has been nice though, even with chrome on android via nfc. Once things are set up on a site, it's very reliable.
Who uses a web based email server and expects security? Even back in the 90s people knew better than rely on Hotmail, Yahoo, and Gmail. I don't bother with high security on gmail as it is my throw away spamertizer catcher address used to sign onto web pages that require a valid email to read their articles.
NRRPT/RCT