You Can Now Use Your Android Phone as a 2FA Security Key for Google Accounts (venturebeat.com)

Google said today it will now enable Android users to use their smartphones as a Fast Identity Online (FIDO) security key (for two-step authentication) for their Google accounts, thereby addressing one of the biggest challenges that has slowed the adoption of this security measure: convenience. A report adds: You can thus use your Android phone to protect your personal Google account, and your G Suite, Cloud Identity, and Google Cloud Platform work accounts. (Android tablets aren't supported -- Google specifically limited the functionality since users are more likely to have phones with them.) This means Android phones can move from two-step verification (2SV) to two-factor authentication (2FA). 2SV is a method of confirming a user's identity using something they know (password) and a second thing they know (a code sent via text message). 2FA is a method of confirming a user's identity by using a combination of two different factors: something they know (password), something they have (security key), or something they are (fingerprint). The feature is coming only to Android devices versions 7 and up.

Comments

Re:When did we lose the 2FA ?

[swillden]

Yeah, "The feature is coming only to Android devices versions 7 and up" is confusing for those of us already using 2FA. I've been using 2FA via Google Authenicator for some google accounts since Android 5. 2SV is not the only option, we already have a 2FA option. Or did we lose that 2FA option in recent history and now its returning? I am only using 2FA on a somewhat "old" account.

This is a new 2FA option. A pretty nice one, actually.

Google Authenticator requires you to unlock your phone, open the app, read the number, type it into the browser window and click a submit button. Oh, and you have to do it relatively quickly because the number is only valid for a short period of time.

With this new approach, which builds on Android's ability to act as a FIDO token (which itself is built on top of Android Keystore authentication -- which, BTW, I designed and built :-) ), your browser communicates via bluetooth with your phone to get a cryptographic authentication token. So from the user perspective, when you get to the 2FA request screen, you just unlock your phone and tap "okay".

If you have a nano security key that just lives in the USB port all of the time, then that's still the most convenient 2FA approach, IMO. But there's a valid (though not strong, for most users) argument that leaving the security key in the USB port all of the time is a bad idea. In addition, to use a security key you have to buy a security key, which you probably don't already have.

Of course the 2SV option (SMS code) still exists, but it's significantly weaker from a security perspective.

Security is context-dependent, so you can't really place these things on a continuum, but if I make a bunch of simplifying assumptions about common user scenarios, I'd say that Android-as-FIDO is the strongest second factor auth option currently offered. Security keys generally use certified hardware which is arguably more secure than the relevant hardware in a phone, but Android-as-FIDO also requires user authentication (usually biometric; so it's arguably three factor), while security keys do not. The Authenticator app is a little weaker because a root compromise of the phone can extract the relevant long-lived secret.

This new feature is good stuff. It's quite secure, and also very user-friendly, which encourages people who might otherwise not use 2FA to turn it on.

Re:Only second factor if password isn't stored

[AmiMoJo]

That isn't the threat model they are using.

This protects against the biggest security threat currently out there: your password is re-used on another site and leaked by that other site, along with your Gmail address, and someone uses it to compromise your Google account. Since they don't have your phone that is no longer possible.

It also against similar attacks, like shoulder surfing and keyloggers, where your password is compromised.

If your phone is stolen you can only rely on whatever kind of lock screen you have set.

If you log in via your phone's browser then at least even if your phone is compromised it would take multiple exploits to bother get your password and trigger the secure authentication mechanism without user interaction.

I'm not entirely sure what your threat model is... Someone steals your unlocked phone? It's probably already logged in to your Google account anyway.