Slashdot Mirror
You Can Now Use Your Android Phone as a 2FA Security Key for Google Accounts (venturebeat.com)
Google said today it will now enable Android users to use their smartphones as a Fast Identity Online (FIDO) security key (for two-step authentication) for their Google accounts, thereby addressing one of the biggest challenges that has slowed the adoption of this security measure: convenience. A report adds: You can thus use your Android phone to protect your personal Google account, and your G Suite, Cloud Identity, and Google Cloud Platform work accounts. (Android tablets aren't supported -- Google specifically limited the functionality since users are more likely to have phones with them.) This means Android phones can move from two-step verification (2SV) to two-factor authentication (2FA). 2SV is a method of confirming a user's identity using something they know (password) and a second thing they know (a code sent via text message). 2FA is a method of confirming a user's identity by using a combination of two different factors: something they know (password), something they have (security key), or something they are (fingerprint). The feature is coming only to Android devices versions 7 and up.
I'm using Google Authenticator for some applications. Maybe I'm confused (like a lot of things) but how does this help me move to 2FA?
At this point, Google knows where you are, physically, every second of every day. They also know exactly what you do on the web, what you do via email, and what you do on your phone. Is everybody really OK with this? One company knowing literally everything they can possibly know about you, in exchange for a bit of convenience? That seems insane to me.
I don't respond to AC's.
Yeah, "The feature is coming only to Android devices versions 7 and up" is confusing for those of us already using 2FA. I've been using 2FA via Google Authenicator for some google accounts since Android 5. 2SV is not the only option, we already have a 2FA option. Or did we lose that 2FA option in recent history and now its returning? I am only using 2FA on a somewhat "old" account.
So don't use the products? You're complaining and the fact of the matter is that 90% of Google's target audience doesn't hold the same values you do. In Googleland you're the product, not the customer. It's parasitic symbiosis, if such a thing can exist. They will do what they can to keep you engaged so that they can collect the data and sell it so they make their profit. The benefit you get is that usefulness of products and an engaging enough experience. But yes, you throw away privacy. If you want Google to do what Apple does you're gonna need to pay $1500/phone + support contract and at some point you'll be forced to upgrade. Don't like it? Don't use the products.
Next will be 3FA, then 4, and at some point they will wear you down and you will be assimilated.
So now the phone becomes the only factor, right? So we're back to 1FA. Don't lose that phone.
"Growth" and "consumption" were historical names for serious illnesses. Stability should be prioritized over growth, and Europe is doing that well.
If you save your password on the phone (so that it gets entered automatically on an app or website), then you are not really adding a second factor by proving that you have the device. For the password to be the "something you know" factor, the something needs to be something in your brain, not something stored the same device that is the "something you have" factor. Does this new setup ensure that passwords can not be saved?
If you want Google to do what Apple does you're gonna need to pay $1500/phone + support contract and at some point you'll be forced to upgrade.
Or, you could just not use a "smart" phone.
Or you could do what I do: use a Windows Phone when I need a "smart" phone.
I don't respond to AC's.
Next will be 3FA, then 4, and at some point they will wear you down and you will be assimilated.
Arguably, if your phone has a fingerprint scanner, this is three-factor. You have to unlock your phone to authorize it to send the cryptographic second-factor message to your computer via bluetooth. And, of course, this is after you entered your password. So... something you know (your password), something you have (your phone) and something you are (your fingerprint, to unlock the phone).
It's "arguable" not "fact", because some definitions of 3FA would require that the backend verify the third authenticator as well, where in this case that's done on the phone (the something-you-have). In practice, secure remote biometric verification is, er, hard.
Note to ACs: I usually delete AC replies without reading them. If you want to talk to me, log in.
I don't WANT there to be any tie in between my user account and my device. I want my accounts to both secure AND as anonymous as possible. I don't want Google's repeated efforts of tieing a specific human to a specific user account.
Google has no interest in tying a specific human to a user account, outside of some groups within Google that fight abuse (a common abuse tactic is to great huge numbers of accounts, and spread the abuse across them), and even they don't care about tying specific people to accounts, they just want to make bulk account creation hard. Besides that, Google doesn't care if you have several accounts or few of them, and doesn't really care if the names, etc. on them are real.
In any case, this new 2FA feature has nothing to do with that, and, actually, does nothing to make your goal of using Google services anonymously any harder.
This feature is all about preventing account hijacking and theft. Passwords alone have not been secure for quite some time, and are getting worse all the time. Something more is needed. The "security questions" approach is laughably bad. Worse than the passwords it's trying to cover for. SMS-based two-step verification is better, but SMS hijacking can defeat it. Plus, people like you don't want to add a phone number to your Google account, and SMS 2SV obviously requires that.
This new 2FA option allows your phone to act as a cryptographic second factor for logging you on. It does not use your phone number to do this, and doesn't in any way tie you as a human to the Google account... it involves creating a new (random!) cryptographic key on your phone and then associating that with your account.
Note to ACs: I usually delete AC replies without reading them. If you want to talk to me, log in.
I don't trust Google with this, as it is clear that the end goal is making having Android device mandatory to authenticate online. This is not unlike Microsoft and its early efforts with Office software -in the end they succeeded with MS Office becoming defacto standard.
OR an Android phone that will likely be hacked several times a year
This.
Reading the article it appears that when your phone is paired it will send a notification, that you choose yes/no to to verify you intend to login. So a message sent over open air waves? That seems like a bad idea. Its not clear if this is their FIDO implementation or 2FA. This seems to be the case though as they claim it will stop sites that prompt for a username/password/token because without connecting to a valid google account it won't trigger the message on your phone. So something has to be pushed to your phone.
Even if the device generates a token like YubiKeys, having that on your phone seems like a bad idea as your phone can be hacked and that key can be extracted. I had an employer install Semantic Security tokens the same way on our machines, while the idea is nice, there is no assurance that it can't be hacked. The something you carry part of 2FA should not be something that can connect to the internet directly/indirectly as when the device is hacked, so is your key. A USB dongle, or standalone bluetooth token keychain is way more secure, not perfect, but better than sending a message than can be viewed.
I mean in general, confirming logins on a phone. Anyone can see the SMS who has it. Logging in on a PC and typing in the SMS from the phone is okay, since it is two different device and someone on the internet will not have my phone.
Except like Microsoft has dumped all support of it.
I've been doing this for two years with Google Authenticator.
https://play.google.com/store/...
Absolutely not. I didn't mention the fact that I screwed up and tried out Google Fi. It FORCE tied my phone to my google account. There is no way to untie it now. I have been all the way to the developer level and they said that is by design. So since I used a Google fi account tied to my gmail account, I can no longer part with my phone. If I carry my companies loaner phone and try to check my personal email while on a work visit to another area, there is no way I can do it without also carrying my cell phone to get the authentication text. Their stated goal is tie one to the other and that goal is slowly creeping into other services they offer.
Digital is, by definition, imperfect. Analog is the way to go.
Absolutely not. I didn't mention the fact that I screwed up and tried out Google Fi. It FORCE tied my phone to my google account. There is no way to untie it now. I have been all the way to the developer level and they said that is by design.
I don't think so. If you really can't remove the phone number associated with your account (and you're not on Fi any more) please email me and I'll file a bug. My slashdot username @google.com.
Note to ACs: I usually delete AC replies without reading them. If you want to talk to me, log in.
That's why it makes such a great phone to use: nobody's tracking it, including Microsoft.
I don't respond to AC's.
Good thing I don't have an android phone.
-- Tigger warning: This post may contain tiggers! --
OK. It was a bad slashdot article title. Its not you can now use 2FA, its you now have a second way to use 2FA. Thanks for clarifying things.
From an end user experience, I'm not sure why choice of language is a critical issue, so I assume you are talking about using "java garbage" for development.
Have you tried Visual Studio for Android Development? It has an Android Emulator and the Xamarin stack included now does provide a passable cross platform development environment. While it is better supported for C#, you can develop for Android using C++ in Visual Studio as well.
Greed is the root of all evil.
I hope this is optional! Apple FORCES me to use my iPhone or my Mac for 2FA and I don't have them with me all the time. Sorry, I'm not an apple person. My iPhone is a test device only.
Laws are rules for the court, but merely a bottom bar to hit for life. Think beyond laws in your actions always.
All that matters is where people are happiest.
Laws are rules for the court, but merely a bottom bar to hit for life. Think beyond laws in your actions always.