None of Google's 85,000 Employees Have Been Phished in More Than a Year After Company Required Them to Use Physical Security Keys For 2FA (krebsonsecurity.com)

Google has not had any of its 85,000+ employees successfully phished on their work-related accounts since early 2017, when it began requiring all employees to use physical Security Keys in place of passwords and one-time codes, the company told KrebsOnSecurity. From the report: Security Keys are inexpensive USB-based devices that offer an alternative approach to two-factor authentication (2FA), which requires the user to log in to a Web site using something they know (the password) and something they have (e.g., a mobile device). A Google spokesperson said Security Keys now form the basis of all account access at Google. "We have had no reported or confirmed account takeovers since implementing security keys at Google," the spokesperson said. "Users might be asked to authenticate using their security key for many different apps/reasons. It all depends on the sensitivity of the app and the risk of the user at that point in time." The basic idea behind two-factor authentication is that even if thieves manage to phish or steal your password, they still cannot log in to your account unless they also hack or possess that second factor.

Comments

Wow a whole year

[Anonymous Coward]

I've never fallen for a phishing email with or without 2fa.

If Google's getting kudos after a year, I want a goddamned payout.

Re:Wow a whole year

[Nos.]

I've never fallen for a phishing email with or without 2fa.

If Google's getting kudos after a year, I want a goddamned payout.

Cause that's the same thing as a company with 85,000 employees. /s

Re:Wow a whole year

[Aighearach]

My wife has never fallen for a phishing email either; she uses two factors. One, she got an email she doesn't understand. Two, she asks me to deal with it.

Here is the thing, here is why this is huge news for nerds: Google never had to call me and ask. They didn't need to hire 85,000 nerds to protect 85,000 other employees. Their non-nerd employees were able to avoid phishing attacks with this system, on their own.

And you can have whatever payout you want; I say reward yourself and take yourself outside for an activity.

Re:Wow a whole year

[Actually, I do RTFA]

Google has 85,000 employees. For a phishing attack to work, it has to work on the dumbest employee.

Since this implies that there were successful phishing attacks more than a year ago, congratulations on being better at security than the person in Google who gives the least shits.

Re:Wow a whole year

[jareth-0205]

I've never fallen for a phishing email with or without 2fa.

If Google's getting kudos after a year, I want a goddamned payout.

You think maybe a Google employee is a slightly higher value target than you? And 85000 is a greater number than 1?

Re:Wow a whole year

[Jumperalex]

Its also Google. They are more likely to be spearphished than anonymous cowards ;-)

So they get more of them and better ones.

Re:Wow a whole year

[Anonymous Coward]

Also Google tries to phish themselves and probably hires outside security companies too.

Re:Wow a whole year

[ShanghaiBill]

But why does the key work better than authenticating with a mobile phone?

Both are "something you have" so what's the difference? Of course the phone is "something you already have" while the key is "something you have to buy".

Re:Wow a whole year

[Freischutz]

Google has 85,000 employees. For a phishing attack to work, it has to work on the dumbest employee.

Since this implies that there were successful phishing attacks more than a year ago, congratulations on being better at security than the person in Google who gives the least shits.

You really are quite full of yourself. Just because somebody falls for a phishing attack that does not mean they are dumb. It just means that they don't know as much about computers and malware as you do.

Re: Wow a whole year

[Anonymous Coward]

Because a scammer can call you and pretend to be tech support and say hey we just sent you a code read it to me.... Bam hacked. With psk u2f token the challenge response is automatic and signed from the key they can't ask you to read something to them because there is nothing to read and no prompt to get the challenge response passed from the key and since the key is signed per url you can't even spoof a web page for them to go to unless you are able to modify googles internal DNS servers and I assume the people what control the DNS servers are people that won't fall for social engineering. This protects Google from all those secretaries and accountants that are not IT non skeptical people.

Re: Wow a whole year

[ShanghaiBill]

Because a scammer can call you and pretend to be tech support and say hey we just sent you a code read it to me.... Bam hacked.

That would only work for a very dumb implementation. You can authenticate with an app on your phone that receives a token, hashes it with both the code and a private key, and then sends it back. A scammer will need more than just the code. He will also need the phone.

Re:Wow a whole year

[ShanghaiBill]

It just means that they don't know as much about computers and malware as you do.

It also means they are impervious to learning. Google tries to educate all their employees about security. There is a word for people that are ignorant, and are unwilling or unable to learn: dumb.

There will always be dumb people, so the smart thing to do is to fix the system not the people.

Re:Wow a whole year

[Anonymous Coward]

The headline is misleading. This system doesn't do anything to prevent people from falling for phishing emails, it just makes that error harmless: it prevents the phisher from taking advantage of any passwords that they obtain.

Re: Wow a whole year

[Anonymous Coward]

Wrong. The smart thing to fix is both the system and the presence of dump people by turning the later to absence (as in soap or soylent green raw materials)

Re: Wow a whole year

[ArsenneLupin]

the key is signed per url

No. If they are using Yubikey (as in the picture next to the article), it's just a time- or counter based security token like those homebanking tokens that display a number when you press the key. Except that the Yubikey doesn't display it but emulates a keyboard, and "types" it in. If you're focused on a password field, you don't see the key. But if you're focused on an editor or a terminal you sure well can see it. The Yubikey is an input only device (only sends data to the computer) with no way of knowing at which URL you are.

you can't even spoof a web page for them to go to

Just make a web page with a password entry field, and tell user to press the key. That way user doesn't even have to read it out aloud.

However, there are more sophisticated devices out there. One bank I use has a device with a tiny camera. Their Website displays a QR code. You point the token at your computer screen, it reads the QR Code (challenge), and calculates/displays the response and comment (id of bank). Makes phishing almost impossible (user is supposed to get suspicious if he sees a different id in the comment than the website where he actually is).

Re:Wow a whole year

[golgotha007]

>But why does the key work better than authenticating with a mobile phone?

Because it's trivial for someone to contact your phone provider, pretend they're you and have your phone number ported over to the hacker's device. This gives them SMS 2FA, call-back 2FA, etc.

Best to use a Yubikey and Yubico Authenticator for all 2FA websites that support Google Authenticator.

Re:Wow a whole year

[arglebargle_xiv]

I've never fallen for a phishing email with or without 2fa. If Google's getting kudos after a year, I want a goddamned payout.

Cause that's the same thing as a company with 85,000 employees.

Google controls the employees, the environment they operate in, and the servers they connect to. Given that level of control, if their IT can't prevent phishing then they're pretty incompetent.

Even Mythbusters have shown how easy this can be.

Re:Wow a whole year

[ShanghaiBill]

Because it's trivial for someone to contact your phone provider, pretend they're you and have your phone number ported over to the hacker's device.

The would only work for a very dumb implementation. Google could install a custom app on each employee's phone that had an unique private key. Instead of $20 each, it would cost $0, and would not require every employee to carry an extra dongle everywhere they go.

Re:Wow a whole year

[f3rret]

And you'd just let your employer install arbitrary software on your phone?

Re:Wow a whole year

[AmiMoJo]

When you use a key the browser hashes the domain of the site you are logging in to and sends it to the key. So right away phishing sites don't work. They can't trick users into entering their time dependent codes into the wrong site.

Then the key sends the time dependent code back to the browser. It's never displayed to the user, there is no way to trick the user into giving it to you over the phone etc.

Since it's not SMS based either there is no way to hijack a SIM card to get the code.

Re: Wow a whole year

[Anonymous Coward]

Itâ(TM)s Google. They could just embed it in the Android update. :-)

Re: Wow a whole year

[Anonymous Coward]

That is not how these devices work. TOTP works just as well as PK signing at a fraction of the cost.

Re: Wow a whole year

[Anonymous Coward]

Some of us don't use Android or iOs phones and don't want to carry a second.

Re: Wow a whole year

[hoggoth]

> bank I use has a device with a tiny camera

Great. My bank only has SMS based 2FA, with a checkbox on the screen labelled 'I forgot my device, log me in without it'. I kid you not. I've complained to their minimum wage offshore support people who can't find my words in their script so don't say anything.

Re:Wow a whole year

[Agripa]

But why does the key work better than authenticating with a mobile phone?

Both are "something you have" so what's the difference? Of course the phone is "something you already have" while the key is "something you have to buy".

The phone is something you have only until the scammer convinces the phone company to transfer access to them. So technically, while you may or may not own the physical phone but do control it, you do not own or control the phone's identification; the phone company owns and controls that.

Re:Wow a whole year

[Tony Isaac]

My company conducted a penetration test, which began with the security company sending a phishing email to all employees. AT LEAST one person in EVERY department clicked the link, except software development. That was enough. They got in to multiple servers and were able to harvest some passwords from memory.

Not everyone is as "smart" as you are.

Re: Wow a whole year

[Anonymous Coward]

Because scammers are now doing sim swaps in conjunction with compromising your internet banking (installing key logger etc). Your internet banking profile usually records your mobile number in your customer details. They phone your telco and say their old sim (which is not in their possession) got lost or damaged and ask for "their" phone number to be transferred to the new sim (which is in their possession). Then they do banking transfers and clear out your account (passing the 2fa). Telcos are tightening up sim swap processes but it's not perfect.

Re:Wow a whole year

[Aighearach]

But why does the key work better than authenticating with a mobile phone?

Both are "something you have" so what's the difference? Of course the phone is "something you already have" while the key is "something you have to buy".

The phone is not "something you have," it is just a networked host that you believe yourself to control. It is not different than renting a VPS in a datacenter somewhere and running some software on it.

The dongle is something you have, because it isn't networked, and it isn't a general purpose computing device that could be doing something different than you expect.

Re: Wow a whole year

[Aighearach]

Phones don't have some sort of protected hardware keyboard that can be connected to a particular data stream. Anything that the phone can send when you touch the screen, it can send when contacted by the author of an app you installed.

Also, anything that can have new apps installed by the user is not secure, and you can't promise that it does anything the way it is supposed to.

It isn't enough to have an implementation that would work in a perfect world. If the implementation runs on a phone, you have no idea what it does in the future after one of the manufacturer's backdoors is found by your attacker.

Plus, because the general software quality on phones is so low, even a well-implemented app is going to need a lot of support. And that need for support causes users to touch stuff they're not supposed to, because they're also not supposed to waste people's time, or look stupid asking basic questions. So a security key that is only a security key gets used only as a security key, and doesn't need support staff to encourage that it get used correctly.

Re: Wow a whole year

[Aighearach]

But how do they discover all the hardware backdoors on the platform to verify the security?

Just having permission to install stuff on your phone, or having complete control of your OS, that's not enough for them to know what code runs when they try to run their code on it.

Re: Wow a whole year

[Anonymous Coward]

That's not really true, they may be using the yubikey as 2fa with OTP, however yubikey clearly supports U2F which is not OTP it is PSK challenge response signed on the key which is what vanguard as well as others use for U2F and if so like I said it is url dependent.

Comment removed

[account_deleted]

Comment removed based on user account deletion

2FA finally

[supernova87a]

It was this article that finally made me switch from SMS verification codes for my personal email (gmail): Wired article

And I went to Google Authenticator only after I figured out how to put the same code on multiple devices and assure myself that I had enough backup hard copies of keys that I would not likely get locked out permanently should I ever lose my phone, etc.

The U2F works great for corporate, etc. where you have a support team who can help you in case you lose it or forget anything. They can make you come in person and prove that you are you.

The problem with implementing this (without enough backups) for personal is that if you ever lose all of your key info or code generator, you are absolutely fucked because there is no way to prove who you are to Google and have them reset your password / security. So you've got to have multiple backups in different places should your house ever burn down, etc.

Re:2FA finally

[bobstreo]

JWZ had a writeup about SMS, Google Auth and OTP

https://www.jwz.org/blog/2018/...

Re:2FA finally

[Ichijo]

So you've got to have multiple backups in different places should your house ever burn down, etc.

Yes, the 3-2-1 backup strategy. Keep 3 copies on 2 different storage types with 1 of those copies offsite.

It's really, really nice knowing that nobody can hack into my e-mail even if they somehow managed to obtain the password. I just wish Amazon and my bank supported U2F.

Re:2FA finally

[swillden]

The problem with implementing this (without enough backups) for personal is that if you ever lose all of your key info or code generator, you are absolutely fucked because there is no way to prove who you are to Google and have them reset your password / security. So you've got to have multiple backups in different places should your house ever burn down, etc.

You can use multiple U2Fs, and store one (or more) offsite. I'd recommend a set of backup codes offsite as well, where you won't be tempted to use them (to make phishing you harder), but where you can get them if needed.

Re:2FA finally

[swillden]

JWZ had a writeup about SMS, Google Auth and OTP

https://www.jwz.org/blog/2018/...

Using a TOTP solution like 1password or Google Authenticator is better than SMS, because unlike SMS it's very difficult to hijack. But it's still not as good as security keys (AKA FIDO U2F) as described in this article, because it can be phished. If you're certain that you could never, under any circumstances, be social-engineered into giving up your TOTP code then you're probably wrong about how gullible you are, because there are some really talented social engineers out there. But with U2F, you just can't do it.

Also, U2F is much more convenient. You have to buy a USB dongle (or three) and stick one in your USB port, but then when you have to authenticate all you have to do is touch it. So much more convenient than looking at a number and typing it in. I work for Google, and the various systems I use require me to authenticate about a dozen times every day -- but often the authentication required is U2F only (because I already authenticated recently with my password) so it's very low-effort. The same would not be true if TOTP were required.

Do keep in mind if you go U2F only, though, that losing or destroying your security key means you're locked out of your account and the only available recovery process will be intentionally tortuous and may fail. So use multiple security keys, and I'd suggest keeping a set of backup codes in a safe place that is also quite inconvenient for you to access (making it hard for anyone to social engineer you into giving them a code).

Re:2FA finally

[supernova87a]

I agree.

I think that for most people, the combination of relative usability and risk leads to the choice of using TOTP on your phone, not the extent of a hardware dongle / key.

For some service where you have no other way to prove yourself, losing the hardware is just too risky. For me at least.

Re:2FA finally

[nine-times]

The problem with implementing this (without enough backups) for personal is that if you ever lose all of your key info or code generator, you are absolutely fucked

They just really need to come up with a coherent standard and get everyone onboard. Because SMS kind of made sense, until you find out that SMS is totally insecure. Then Google Authenticator (and similar OTP) comes out, which... really isn't half as good as people make it out to be. It's really just a second password, but stored and transmitted in a different way. That is, as far as I understand, the difference is that instead of sending the password over the internet and then storing a hash on the website, you store the password on the website and transmit part of the hash.

But it kind of works, except sometimes you still need to share an account with someone, and it doesn't work for that. And if you lose the cell phone it's on, it's a huge pain. So companies get smart, and they start allowing you to sync the OTP token or include it in your password manager, which makes it much more convenient-- but then compromises the security benefits you were trying for in the first place.

And then they have these USB dongles, which are kind of neat, but as you mention, are a pain if you lose them. And if you have the USB-A model and you have a device that only has USB-C ports, that's annoying. Same thing if you get the USB-C model and only have a machine with USB-A ports. Or if you have a phone with no USB ports, I guess that they have those wireless ones. And then some sites support some of these things and not others. A lot of sites support none of these things. And in any case, you're still stuck managing a bunch of passwords.

It seems like we should be able to do something better than that. Why don't we do something where each user gets a password-protected private key, and websites all get a public key, and you verify your identity that way? You'd still have a password to protect things, but you'd just need one. If websites get hacked, there's no password to be compromised. We wouldn't need elaborate password managers or SSO, just methods of keeping the certificate safe, secure, and available.

Ok, I'm sure that's not the best solution, but I'm not a security genius. Let some security genius figure out how we can make this stuff work that's not absurdly stupid.

Re:2FA finally

[Anonymous Coward]

If you're certain that you could never, under any circumstances, be social-engineered into giving up your TOTP code then you're probably wrong about how gullible you are, because there are some really talented social engineers out there.

If by "really talented social engineers" you mean "guys named Vinnie who enjoy breaking peoples' legs" then yeah. Otherwise no.

Re:2FA finally

[swillden]

I think that for most people, the combination of relative usability and risk leads to the choice of using TOTP on your phone, not the extent of a hardware dongle / key.

I disagree. I think the security key is the most usable solution, especially if you get the nano-sized keys that fit almost entirely into the USB port so you can just leave them plugged in all the time. This does mean that if you lose your laptop you lose the security key as well, but (a) you can revoke the key, (b) the most important risks are from remote attackers and (c) if a sophisticated attacker gets your laptop you're probably SoL anyway.

The only real argument against U2F, IMO, is cost. You have to buy the security keys.

For some service where you have no other way to prove yourself, losing the hardware is just too risky. For me at least.

That problem is orthogonal to the question of what type of 2FA to use. If you only use TOTP on your phone, then losing your phone (or dropping it in the toilet, etc.) leaves you without a way to recover. With Google's services, you can use U2F *and* TOTP *and* SMS *and* backup codes if you want. Of course, the more you use the more opportunities you give an attacker, so there's a tradeoff.

IMO, the best solution is a nano U2F security key which you leave in a USB port of each computer you use, plus another (larger) U2F security key on your key ring and one more stored in a safe place, along with a printed list of backup codes. This is not the cheapest solution, however, since if you have a laptop and a desktop it means you need four U2F keys.

Re:2FA finally

[libra-dragon]

I recommend using Authy vs. Google Authenticator: https://authy.com/blog/authy-v...
It resolves your issues.

Re: 2FA finally

[Anonymous Coward]

Hmm, I have three Yubikey devices, which are all registered to my Gmail and other services that support them.

For other things that only support Google Auth, I still use the Yubikey, but with the authenticator OTP app.

One of the keys even works for my phone.
I keep the plain USB one in my safe deposit box, and you can also set up your osx and windows systems to accept them for login

Re:2FA finally

[WaffleMonster]

I disagree. I think the security key is the most usable solution, especially if you get the nano-sized keys that fit almost entirely into the USB port so you can just leave them plugged in all the time. This does mean that if you lose your laptop you lose the security key as well, but (a) you can revoke the key, (b) the most important risks are from remote attackers and (c) if a sophisticated attacker gets your laptop you're probably SoL anyway.

In other words client certificates are sufficient and always plugged in hardware tokens unnecessary.

The only real argument against U2F, IMO, is cost. You have to buy the security keys.

Or being stupid enough to allow let alone require use of USB ports in the first place.

Re:2FA finally

[Anonymous Coward]

I have 4 U2F tokens but I am still a bit nervous about turning off OTP. If I lose one and have to replace it, I will have to go through all of my online accounts to update them with the new one. This is where I wish that openid was still well supported so I can have my own authentication service for all my online accounts.

Re:2FA finally

[stikves]

Actually you can have backups.

When you enable 2FA, you'll get 10 backup codes which you can print and store offline (in a safe place).
You can also associate more than once device for 2FA. I actually have 4 active devices on my account. (One on the keychain, another on my badge, 2 backups at home).

Even if you were to lose all of them, it would still be possible to recover your account, however would of course require some effort.

Re:2FA finally

[AmiMoJo]

The only thing I worry about with U2F is that no one seems to make a key with an emergency erase feature.

Re: 2FA finally

[Anonymous Coward]

Certs can be copied to another machine. USB dongles cannot. Doesnâ(TM)t that make a huge difference and invalidate your argument?

Re:2FA finally

[swillden]

The only thing I worry about with U2F is that no one seems to make a key with an emergency erase feature.

All U2F security keys I've used can be erased... you just delete the U2F applet. But in an emergency I think it's more likely that what you need to do is to remove trust on the server side.

What threat are you trying to address?

Re:2FA finally

[swillden]

I disagree. I think the security key is the most usable solution, especially if you get the nano-sized keys that fit almost entirely into the USB port so you can just leave them plugged in all the time. This does mean that if you lose your laptop you lose the security key as well, but (a) you can revoke the key, (b) the most important risks are from remote attackers and (c) if a sophisticated attacker gets your laptop you're probably SoL anyway.

In other words client certificates are sufficient and always plugged in hardware tokens unnecessary.

Absolutely not. There are crucial differences between U2F security keys and client side certs:

1. U2F keys only sign an auth request when touched. This means that purely remote attacks can't work; the attacker has to arrange for the user to prove that they're physically present.

2. U2F keys do not allow a remote attacker to obtain a copy of the private key material. At most the attacker can convince the user to touch the key to activate each authentication operation. With client side certificates, if the attacker can remotely exploit the machine, he can steal a copy of the private key material and have unlimited use of it and most likely the user will have no idea.

3. U2F keys are highly resistant to extraction of the key material even with physical access. An attacker with physical access can steal the key, but when the user notices it, it will be revoked.

The only real argument against U2F, IMO, is cost. You have to buy the security keys.

Or being stupid enough to allow let alone require use of USB ports in the first place.

That is a risk, but in most environments USB ports are essential and cannot be entirely disabled anyway. Plus, the primary goal is defense against remote attacks, not physical attacks. If the attacker has physical access to your machine, you're screwed, even if your machine has no USB ports. The one thing that USB blocking/disabling does do is to mitigate the "Thumb drive dropped in the parking lot" attack, and similar. But that attack vector is less common and easier to mitigate with education than remote vulnerability exploitation or (spear) phishing.

Re:2FA finally

[mjwx]

JWZ had a writeup about SMS, Google Auth and OTP

https://www.jwz.org/blog/2018/...

Using a TOTP solution like 1password or Google Authenticator is better than SMS, because unlike SMS it's very difficult to hijack.

You see the problem is... I need 2FA (Two Factor Authentication) for a variety of things, several banks, work, access to some government services. Most people do. SMS is available to everyone and universally accepted, not to mention cheap. I dont want to have to have a dongle for every single different bank nor can I believe that all these different services are going to get behind a single 2FA token (definitely not without some govt intervention and whilst I'm not one to go on wild anti-govt conspiracy theories but history has demonstrated that govt + tech == utter disaster).

The "problem" (sarcastic quotes) with SMS 2FA is that telephone companies in the US are easily duped by social engineering. This problem has been largely alleviated in the rest of the world by simple methods such as requiring sensitive items to be signed for in person (preventing someone from stealing your mail) usually with photo ID presented. The same problem will exist with any other multiple use 2FA system like U2F token/dongle. In fact it makes the system less secure as it's an item that can be easily stolen and cannot be secured by password or other means.

Sure SMS and phones are not perfect, but they're good enough. Telco's need to secure themselves against social engineering attacks (now this is one area where governments excel at... fining companies for privacy breaches).

Re:2FA finally

[AmiMoJo]

Someone tries to take your key away. You fear it may be confiscated. You need to pass through some security without having the opportunity to erase it first.

I've been thinking about building something like this for a while. All it would need is a small battery to give it enough energy to do the secure erase when a button is held for several seconds.

Re:2FA finally

[swillden]

Hmm. The key by itself isn't useful, so this concern only applies if you can also be coerced into providing your password. In that case, I'm not sure having destroyed the security key is going to help you. Still, I suppose there are probably some situations in which this would be useful.

Re:2FA finally

[AmiMoJo]

True, it's still only 1 of 2 factors. I want one with HID keyboard mode too, so I can use it to enter a really long password (with my own password prefixed of course) for stuff that doesn't support proper 2FA.

Re:2FA finally

[swillden]

You see the problem is... I need 2FA (Two Factor Authentication) for a variety of things, several banks, work, access to some government services. Most people do. SMS is available to everyone and universally accepted, not to mention cheap.

And insecure. You argue that it could be made more secure, but I don't see any sign that that is going to happen.

I dont want to have to have a dongle for every single different bank nor can I believe that all these different services are going to get behind a single 2FA token

You may not believe it, but it's happening. So far, I use my FIDO U2F keys for logging into email (work and personal; though both are gmail), Github, Dropbox, Twitter, my Vanguard 401K account, my health savings account, and my health insurance account. There are still a lot of institutions that haven't yet adopted U2F, but it is the standard and obvious next step beyond SMS, so as organizations recognize the problems with SMS and TOTP, U2F is what they will move to.

If you want to check whether the organizations you use support U2F, there's a decent crowdsourced database at: https://www.dongleauth.info/

I have disabled SMS authentication on every bank account, etc., where they provide the option. If they don't support U2F, I use email 2FA, since my email is protected with U2F. This doesn't protect me against phishing, and it also means that if gmail were hacked my 2FA messages could be hijacked, but that's far less likely than an SMS hijack.

Re:2FA finally

[hoggoth]

I have TOPT (Google Authenticator, Authy, Auth+ etc) on my phone and on an old iPod Touch I wasn't using anymore. If I lose my phone I'm not locked out of my accounts.

Re:2FA finally

[hoggoth]

> U2F is much more convenient

Not if you have an iPhone. It doesn't work on an iPhone so you can't access any of your accounts from the phone.

Re:2FA finally

[swillden]

> U2F is much more convenient

Not if you have an iPhone. It doesn't work on an iPhone so you can't access any of your accounts from the phone.

Works great on Android :-)

(Though you have to get an NFC-enabled U2F key. Also, Android devices with appropriate security hardware implement the new FIDO standard, so in many cases the phone itself can act as the U2F key.)

Re:2FA finally

[WaffleMonster]

Absolutely not. There are crucial differences between U2F security keys and client side certs:

Comments were about practical differences not physical differences.

All physical differences cited vanish when client certs are stored in TPM.

1. U2F keys only sign an auth request when touched. This means that purely remote attacks can't work; the attacker has to arrange for the user to prove that they're physically present.

Anyone can set a client certs to prompt prior to use.

Attackers probably have many sheep to attend to. Waiting for you to press a button before they can hijack your session is probably not top of mind / significant hurdle.

2. U2F keys do not allow a remote attacker to obtain a copy of the private key material. At most the attacker can convince the user to touch the key to activate each authentication operation. With client side certificates, if the attacker can remotely exploit the machine, he can steal a copy of the private key material and have unlimited use of it and most likely the user will have no idea.

You seem to have made a fairly rational case for this being mostly irrelevant in practice when YOU stated the following: "(a) you can revoke the key, (b) the most important risks are from remote attackers and (c) if a sophisticated attacker gets your laptop you're probably SoL anyway."

The key can always be revoked and it's game over regardless if your system is compromised so what effective differences does it make if someone is able to obtain private key by compromising your system?

Regardless of the above nothing prevents client certs from simply being stored in the systems TPM with the same properties as U2F key.

3. U2F keys are highly resistant to extraction of the key material even with physical access. An attacker with physical access can steal the key, but when the user notices it, it will be revoked.

In this scenario does the "noticing" and revocation happen before or after you insert attacker provided replacement key that totally compromises your system?

Again this is exactly what TPM is for except without ridiculous requirement of USB.

That is a risk, but in most environments USB ports are essential and cannot be entirely disabled anyway.

This doesn't mean you make the problem worse by requiring users plug in USB keys in order to access secure resources.

Plus, the primary goal is defense against remote attacks, not physical attacks.

Which is why client certs are sufficient.

If the attacker has physical access to your machine, you're screwed, even if your machine has no USB ports. The one thing that USB blocking/disabling does do is to mitigate the "Thumb drive dropped in the parking lot" attack, and similar.

USB keys hurt rather than helps the cause. If you carried around a smart card and it were stolen and replaced the chance of it being leveraged as a proxy for physical access is much less even if the smart card reader itself is simply plugged into a USB port.

Re: 2FA finally

[WaffleMonster]

Certs can be copied to another machine. USB dongles cannot. DoesnÃ(TM)t that make a huge difference and invalidate your argument?

Not if you take steps to avoid it.

This is similar to taking steps from avoiding keys distributed to USB dongles from being duplicated during the process.

Re:2FA finally

[swillden]

TPMs do address most of the issues. One they don't address is proof of user presence. If the TPM can be activated from software at any time, an attacker who compromises the machine remotely can use it to gain access to user accounts. Of course, an attacker who does that can also wait until the user touches the U2F key, or try to prompt the user to do so, or just scrape data when the user accesses the site. But with a TPM in the same scenario, the attacker has unlimited access as long as he retains (remote) access to the machine.

Google's 2FA defaults are annoying

[DigitAl56K]

Every time I log into a new box, the checkbox to remember this computer (and thus bypass 2FA in future) is pre-checked when inserting my hardware token.

Yes, signing into a machine means that to a certain degree I believe it's not already compromised. However, if I was wrong, and it was compromised, at least the hardware token should prevent password replays after 20 seconds had elapsed. Not with Google's defaults though! AFAIK there isn't even an option to change the default to unchecked if I wanted to.

Yubico was talking about this during a Linux talk

[ctilsie242]

Earlier this summer, Yubico mentioned this as part of a conference. For something as large as Google, this is pretty notable.

The biggest advantage the Yubikeys give is the proof there is some type of living being at the machine, via the button press. Of course, this doesn't mean 100% security in the future, but it means that an attack has to be done and queued up when someone is using the machine.

Re:Happy Monday from The Golden Girls!

[Anonymous Coward]

So...

https://en.wikipedia.org/wiki/RSA_SecurID March 2011 system compromise

YMMV

a freind.

Re:There was one Google employee

[CaptainDork]

I don't have mod points but I sure as hell got a fucking sense of humour and this in funny.

Lemme get this straight ...

[CaptainDork]

... Manning walks past security with a Lady Gaga CD and inserts that into a computer and walks out with the good stuff.

Now we have a shit load of people pulling out USB sticks ...

I'm surprised

[Colourspace]

that a company so legendary for its recruitment practices, would let people who would fall for phishing scams join in the first place. Time to reapply!

Re:I'm surprised

[jareth-0205]

that a company so legendary for its recruitment practices, would let people who would fall for phishing scams join in the first place. Time to reapply!

Hehe. I imagine though that a Google employee makes for quite a high-value target, corporate espionage for example. You would think that a bad actor would put a bit more effort into them than your usual mass-emailed phish.

When will banks do this?

[blindseer]

People are amazed I don't do on-line banking, given my high tech lifestyle and knowledge of computers. I don't do online banking precisely because of what I know of computer security.

I'll take on-line banking seriously when my bank takes it seriously. That means offering some kind of key for user verification. This might be in the form of one of those pseudo-random number generators I had from a previous employer, a USB key like mentioned in the fine article, or whatever else of similar function that might be out there. I'd like something that I can use from any computer but even if it's limited to my home computer or smart phone then I'd be very pleased. Until then I'm fine with going to the conveniently located brick and mortar bank location and take advantage of the BTMs (bio-teller machines) inside.

Re:When will banks do this?

[Colourspace]

My bank here in the UK used to provide a standalone reader that you had to put your banking card and PIN in in order to generate a time limited token per login. Once smartphones became almost ubiquitous they moved it to an app, which is what I now use. No system is ever 100% secure, but I feel quite comfortable using it. They even have the option to use the old (air-gapped) hardware if you don't trust the integrity of your phone or phone OS, but I don't know how much longer they will continue to support that.

Re:When will banks do this?

[r1348]

Your bank didn't give you an OTP generator? Dude, change bank, I got mine 9 years ago.

Re: When will banks do this?

[Anonymous Coward]

That doesn't help. The hackers will do you're "banking" for you using your account

Re:When will banks do this?

[Anonymous Coward]

Fuck that bank, hmmm, Nationwide?

Every banked with Lloyds by chance? They only allow SMS 2FA on their net banking. I hate it and cancelled my account with them after a year. Why should I pay to maintain my own device to access my online banking? Sure, give me the option to use an App, but don't eliminate the key generators entirely.

Fuck Lloyds and that stupid fucking horse they rode in on.

U2F for cheap (if you can come up with 4 friends)

[rthille]

This usb-connector sized ARM computer can run the U2F stack: http://tomu.im/
At $12/each (quantity 5) they aren't the cheapest out there (Amazon has 2 for $10), but they are fully open source.

What happens

[DarkRookie]

What happens when you lose the thing?
Also, passwords are free. Those USB 2FA are $20.

Re:What happens

[davide marney]

You use more than one 2FA method, of course. I have a smartphone app as a backup, SMS as a backup, and a printed copy of backup keys.

There is NO reason not to implement 2FA. You don't even need the hardware key. Just stop relying on a password alone.

Re:What happens

[DarkRookie]

Besides that it is a royal pain in the ass that doesn't always work.
That and most of them require a device that I might not have or is not working.

Re:What happens

[Tony Isaac]

Like a hotel key, IT can just associate a new key with your account.

Also, passwords are not free when they result in data breaches.

Best backup solution...

[sweet 'n sour]

The problem with implementing this (without enough backups) for personal is that if you ever lose all of your key info or code generator, you are absolutely fucked because there is no way to prove who you are to Google and have them reset your password / security. So you've got to have multiple backups in different places should your house ever burn down, etc.

QC tattoos make a great long-term backup solution. Preferably under hair -- on a pet.

Re:Best backup solution...

[Anonymous Coward]

QC tattoos make a great long-term backup solution. Preferably under hair -- on a pet.

barbers and vets are vastly underpaid and easy to bribe

How many were scammed before 2FA?

[networkzombie]

In other news, my car doors have not opened since I welded them shut.

Re:How many were scammed before 2FA?

[Anonymous Coward]

Ok, Luke Duke...yeehaw!

Re:There was one Google employee

[Anonymous Coward]

Ya mamma so stoopid, someone said "It's chilly outside," and bitch ran and grabbed a spoon!

Absolutely nothing to do with the security keys

[holophrastic]

"...unless they also hack or possess that second factor" . . or socially engineer a user in a dozen ways.

Google's success here has absolutely nothing to do with the security keys. This kind of success has everything to do with being different.

Around here, we call this "the club" scenario. For those not in the know, there is (was?) a car security device called "the club" that locked your car's steering wheel, making it physically impossible (inconvenient?) to drive. Was it difficult for a car-thief to disable the club? Not really. Was it easier for a thief to steal a different car in the parking lot? Absolutely.

To forego the another-car-analogy, we can also look at the reason that left-handed sports players are always statistically better -- it's simply because most players aren't left-handed, which means that most players encounter fewer lefties, and hence are less experienced against lefties.

In either case, it's called a dominant minority.

Google's not successful here because they have chosen to use security keys. Google is successful here because they spent a lot of time and money and training and effort and co-ordination to do something that most people aren't currently doing.

Security keys are the minority. Hence, they are more troublesome targets.

Wait a few years.

The win here is "something new". The moment it isn't new, it won't be any more secure than anything else.

Re:Absolutely nothing to do with the security keys

[davide marney]

Except that in this case, the hardware keys they are using generate one-time passwords. So yeah, their success IS a result of what they are doing, not just that they're doing "anything".

Re:Absolutely nothing to do with the security keys

[holophrastic]

You misunderstood. They are doing something "different". As a direct result, they are harder targets than others. The moment everyone does the same thing, bad actors will happily target google the same as everyone else.

It's only difficult to break security keys because they aren't everywhere...yet.

Re:Absolutely nothing to do with the security keys

[Anonymous Coward]

It is vulnerable to man in the middle attacks. They are more difficult to do but entirely possible. No one bother because it is currently easier to go after those who use simpler authentication scheme.

Re:Absolutely nothing to do with the security keys

[Anonymous Coward]

Interesting that you mention "the club". Its main impact was not deterrence of theft, but a significant rise in the value of an intact steering wheel. Thieves stole the car they wanted, the notion that they went to an easier target may support your contention about Google's security but it is not well founded. A joy rider would certainly be less likely to target a vehicle equipped with a club, but when you are after making money you target the vehicles that provide the most value. (Which, incidentally, are not always the high profile cars one would think.)

For those not in the know, the premise of the club was a thick steel shaft with a heavy lock that was run through the wheel. It was extremely sturdy and tough and could not be readily defeated. The steering wheel, on the other hand, was trivial to cut through. Which then made removing the club trivial. But you did need a new steering wheel to maintain the vehicle's value. A small price for an entire car...

Re:Absolutely nothing to do with the security keys

[Tony Isaac]

You're partly right, in that hackers can potentially find a way to get around these security keys. But password-based security is SO easy to defeat that it's barely better than just SHUTTING your car doors, without locking them. If you have no password to type, you can't be tempted to type it into a fake Web site linked by a suspicious email. You won't have a password to supply to the fake Web site. That's the point. Using hardware keys eliminates the weakest link in security: the human.

Re:Absolutely nothing to do with the security keys

[holophrastic]

I couldn't have said it better myself -- in support of the reverse point.

Locking your car door is barely better than just shutting it. Took me 4 minutes to break into a friends' sports car last week when she locked her keys in her trunk. You don't need to be a locksmith to use a wire hanger through the window seal.

Saying that keys remove the human element is like saying, oh wait, that keys remove the human element. You have keys to your office, so you don't need to say the magic word to the guard through the slit in the door. But it's not like office keys and car keys and house keys have made it difficult for anyone to break into your office, your car, or your house. Keys can be copied. Keys can be lost. Keys can be duplicated. And you can get someone to use their key where they shouldn't.

The real problem with passwords has never been on the user side. The problem with passwords is on the monitoring side. No bouncer would ever let you try the wrong password a thousand times in a row.

Security is about way more than checking credentials. It's about discerning whether or not the person standing in-front of you is likely to have those credentials in the first place.

No. I'm not giving you a donation to the fire fighters children fund of america. I don't care what you call your company. I don't care about your helmet, your shiny badge, nor your clipboard. You don't look like a fire fighter to me. And I don't see you driving a fire truck.

So unfair for Nigerian Princes.

[Anonymous Coward]

Sad.

ancient

[Anonymous Coward]

So - using the same tech as we did 15+ years ago. Google, always on the cutting edge.

But how many thousands of hours were lost?

[greenwow]

We started requiring a YubiKey USB key, and hours worked by people from home dropped over 20%! YubiKey claims to be FIPS compliant which is what our SSAE 16 requirements require. Security is important, but blocking people working extra hours is a huge cost.

Re:But how many thousands of hours were lost?

[Anonymous Coward]

But one positive for the YubiKey is that there's no shroud around the key. We've bought Dell Precision laptops for the past six years, and all of them have either the motherboard or the hole in the case offset by so much that you can't plug in a USB cable or a key that has a shroud. Most of our users can plug the Yubico key by forcing it. Of course that doesn't really help since they leave those keys plugged in since they're so hard to insert so if they lose their laptop or it's stolen, then the thief will have the key.

Re:But how many thousands of hours were lost?

[Anonymous Coward]

We buy Dell's top level of support TechSupport Pro, and even then they don't dispatch to repair USB ports that don't work since they don't line-up. We had to stop using USB keys because of that. Even for USB cables and keys that don't have the outside shield, it's still hard to get them to connect.

Re: But how many thousands of hours were lost?

[Anonymous Coward]

Our Dell laptops donâ(TM)t have working plugs due to low quality. No way the average company could require a key to be plugged in.

Re:But how many thousands of hours were lost?

[Anonymous Coward]

> Dell Precision laptops

Twice we've had TSA confiscate laptops since they couldn't plugin the power connector or a USB cable. They were understandable suspicious about that.

I had my older Dell Latitude E6440 confiscated by TSA since I couldn't get it to show the power on screen. I showed them the receipt where I had bought it less than two weeks before for a little over $2k. They understandably didn't understand why someone would by such garbage that couldn't even show a booting screen. The choice they gave me was to either let them have the laptop or not board for >$2k flight home. I assume our lawyer could get the laptop back. I was wrong. The TSA doesn't care about the fact that Dell laptops are such garbage. They assume a new and expensive laptop should at least boot. That isn't true of the Dell garbage.

Re:But how many thousands of hours were lost?

[Anonymous Coward]

But does Google use such garbage laptops like Dell Precisions? We buy Precision 5520 laptops,. and their terrible. Most don't boot new out of the box and take months to get Dell to maybe fix them. The TSA is right to be suspicious of anyone that pays money for such garbage.

Re:But how many thousands of hours were lost?

[mdm-adph]

Blocking people working extra hours? I'd call that a feature, not a bug.

Is this a physical physical 2fa or potential softt

[AbRASiON]

I use authy (Google authenticator, improved edition) and just load all my soft tokens in there. Very good program.

I have even followed a very frustrating process to load in my PayPal authenticator in to it.

https://medium.com/@dubistkomi... (really recommend that for PayPal users)

Screw SMS authentication.

Re: U2F for cheap (if you can come up with 4 frien

[Anonymous Coward]

Hey that's great! Here, take one of mine. It has my personal open source on it.

Yubico was talking about this-BT

[Anonymous Coward]

Unfortunately their mobile version only works on NFC phones. No Bluetooth version for cheaper phones.

Re:Yubico was talking about this-BT

[Anonymous Coward]

NFC is extremely low power AND it can actually power the device it's connecting to wirelessly. Yubikeys have no battery. When you hold it up to the NFC sensor it gets power from the phone, does some quick math, and spits out some data. Bluetooth can't do this.

If you phone doesn't have NFC you can use a USB C yubikey or use a regular one with USB2Go.

2FA finally-smart-cards.

[Anonymous Coward]

Doesn't sound much different that what people use to do with Sun-rays and the smart-card one used with them. Heck mine doubled as key-card for getting into certain sections of the building.

Is this an improvement?

[kiminator]

The physical security system for security keys is definitely superior in terms of security from a technical standpoint compared against security codes, but how many successful phishing attacks did they witness before this rollout?

I do hope that security keys find wider adoption (they're genuinely convenient and offer strong security), but we would need more information to know if this is actually a significant improvement in real security over more basic forms of two-factor authentication.

Smart cards redux

[WaffleMonster]

Smart cards are 1/4 the cost of YubiKey, readily available from multiple vendors, standards based and have been in production use for well over a decade. Nice to see companies like Google rediscovering and adopting poor implementations of old existing technology.

Direct USB interface is far inferior from a security POV for smart card application because an unguarded USB dongle can exploit the attack surface of an elephant standing on a giant turtle standing on a 747.

Covert replacement of USB devices is a massive and very much unnecessary attack vector for total system compromise vs smart card. Exposing USB ports to end users in a secure environment is a completely idiotic idea.

Everyone in our shop has used client certs for years and we are only a little shit operation with a few dozen people. It costs nothing to implement and offers substantially the same "phishing" protections.

Personally I don't buy or understand the threat modeling behind Google PR statements.

If Google lacks a trustworthy internal means of communications and employees were previously being suckered into giving an attacker their credentials then certainly an attacker would also be able to get a substantially similar number of users to install malware that could be leveraged to effectively defeat benefits of hardware keys.

Would very much love to see statistics on Google employees being subject of social engineering prior to deployment of 2FA.

Problems can also be avoided by using secure authentication protocols and training users only to enter password into system provided dialogues protecting end users from having their credentials stolen even if they mistakenly attempt to login to an attackers system.

Entering clear text into adhoc web forms is a good example of insecure authentication.

TLS level PAKE such as TLS-SRP is an example of a secure authentication which does not place user credentials at risk of compromise even if the user is being stupid.

Re:Smart cards redux

[Anonymous Coward]

Aren't most smart-card readers themselves USB devices?

Re:Smart cards redux

[WaffleMonster]

Aren't most smart-card readers themselves USB devices?

Plugging a smart card you find on the floor into a USB smart card reader will not compromise your system.

Plugging a USB stick you find on the floor into a USB port can easily compromise your system.

Gotchas

[mnemotronic]

I use a Yubikey for access control for my personal laptop. My experience:
* I bought one spare just in case I lose the main key. This is recommended by Yubi.
* I got another spare just in case either of the two primary keys blows it's cookies. This is recommended by me because I used to do firmware for rotating mass storage devices. Hardware goes bad.
* All three must be configured identically with the Yubi Personalization Tool. Relatively easy.
* Now I've got 3 keys, none of which can fall into enemy hands. This is more work, worry and responsibility than a single key, but I think the pluses outweigh the minuses.

Re: Gotchas

[Anonymous Coward]

If Google's getting kudos after a year, I want a goddamned payout.

Re:U2F for cheap (if you can come up with 4 friend

[c_g_hills]

Does it have a proper hardware key store? I would feel less safe using a key stored in memory which can be read out via software and cloned.

Re:U2F for cheap (if you can come up with 4 friend

[c_g_hills]

They recommend you backup the private key, so it cannot be considered secure like a proper u2f key.

LOL. Foolish

[Anonymous Coward]

No. The article is, " Google is foolish enough to believe that they have not been phished. This mindset is the most dangerous and is a sure fire way of leading to a big cover up when they realize how big a mistake they made. And with big cover ups almost always comes criminal actions and the ruining of good peoples lives that try to expose the truth.

Time will tell. And in my life it tells me that these people will soon be eating a fowl dinner that isn't chicken or turkey.

Speaking of 2FA ....

[King_TJ]

Maybe I'm being totally clueless here, but I'm sure some of you more well versed in system security than I am can provide insight.

What I don't get about 2 factor is, it seems like only the "second step" provides the true security? I mean, considering you already have the additional hassle of having to enter a randomly generated key code, produced on your piece of hardware you're carrying around, why even bother with the first part; the traditional password, anymore?

Passwords are regularly getting hacked or stolen from databases containing them, so they're failing at serving as good security. So why even bother with them anymore? Wouldn't it be just as secure, really, to log in as a user and immediately ask for that randomized, rotating code that the owner's device displays for them to enter?

Re:Speaking of 2FA ....

[Tony Isaac]

That is the whole point. With a hardware key, you no longer type a password.

https://www.yubico.com/start/m...

Re:Speaking of 2FA ....

[Anonymous Coward]

Actully - you do. The passwrod is something you know. The 2FA Token (U2F Dongle) is the something you have. it just happens to be really secure. The password is still required, but is no longer a thirty character thing that you can't remember. You need both. Yes... you can effectively do away with the password. But, then your security chain is based solely on the token. It's not a second factor then, it's just a fairly secure single factor. Something you know. Something you have. Something you are. Pick your version of security, they all have a certain level of risk, be it theft, compromise, duplication, impersonation, smudge attacks, fingerprint dust, image manipulation, etc.

Re:Speaking of 2FA ....

[Anonymous Coward]

Then anyone can pick up the token off the floor and use it.

In some implementations, the first four digits you type are a personal PIN (effectively a password), and then you type the token number. So that's two-factor in one step.

Some organizations require a password in addition to that. The argument is that the password is longer and more complex than the PIN is, and the user may be required to change it more often. Some organizations use an SSL certificate (embedded in an RFID tag) in addition to a PIN. That gives you two factors and a more complex "password" than anyone can remember and type.

You don't say?

[Anonymous Coward]

Challenge accepted.

Braindead email/browser an IT

[knorthern knight]

> AT LEAST one person in EVERY department clicked the link, except
> software development. That was enough. They got in to multiple
> servers and were able to harvest some passwords from memory.

If "clicking a link" results in bad guys getting into multiple servers, there needs to be mass firings in IT.

Re:Braindead email/browser an IT

[Tony Isaac]

Clearly, you've never experienced a REAL penetration test. There is ALWAYS at least one door left open somewhere. Including your company.

Re:U2F for cheap (if you can come up with 4 friend

[rthille]

Well, they recommend that when you build the software, you create and install the key into the software (presumably on a secure, non-networked machine, like you use to create your certs) and so even if the chip is fully secure (it's not) you could still have a backup of the key.

Re:U2F for cheap (if you can come up with 4 friend

[rthille]

No, though you can set flags on the build to disable debug readout of the software/data.
It's no Yubikey, but it's $12 in quantity 5, and it's way safer than no U2F device at all...