Forgot your password?
typodupeerror
Google Security Technology

Google Apps Gets Two-Factor Security 118

Posted by CmdrTaco
from the third-factor-requires-blood-sample dept.
judgecorp writes "Passwords alone are not enough to secure access. Many organisations require two-factor authentication with a token. Google just added free two-factor verification to Google Apps, sending a one-off token to the user's mobile phone. It's good to have this for free, and it backs up Google's assertion that cloud apps are more secure — but it doesn't answer how it helps if an intruder is getting into Apps through a lost or stolen phone."
This discussion has been archived. No new comments can be posted.

Google Apps Gets Two-Factor Security

Comments Filter:
  • by Anonymous Coward

    Or you know, a Google (or any other cloud service) employee [slashdot.org] access all your data because they own it then... No, cloud services are not more secure. Especially free ones who's business model is to make money off your private information.

    • Re: (Score:2, Insightful)

      by Anonymous Coward

      I'm not sure that necessarily makes your data less secure. An administrator always has access to your data, whether that admin works for your company or another company doesn't necessarily change the likelihood that the admin will abuse their power.

    • Re: (Score:3, Insightful)

      by Pojut (1027544)

      Agreed. I fail to see how sensitive information being sent over the Internet could be more secure than keeping sensitive information stored on a computer that doesn't even have a network card installed.

      • by ibsteve2u (1184603) on Monday September 20, 2010 @09:13AM (#33634718)
        The most interesting inference to me is that some third-party vendor who is serving up cloud apps has employees who are inherently more trustworthy than the ones you handpicked are.
        • Re: (Score:3, Interesting)

          by numbsafari (139135)

          I know where the employees who work for me live. I know what car they drive. I know where they like to go to lunch. I have their social security number and a copy of their driver's license.

          I also know a guy named Tony. Tony likes to break things. And ever since some pencil-neck computer nerd posted pictures of Tony's girlfriend on-line, Tony really likes to break computer nerds.

          With Google, these things are much less transparent.

          • With Google, these things are much less transparent.

            Oh...so you don't think the results harvested from "Google would like to know your location." are going into a massive database linking every IP address - and, by extension, IPs in the same subnet - to a physical location?

            I.e., Google's "Tony" knows where you work AND live...and he's got your data.

      • Re: (Score:2, Insightful)

        by Anonymous Coward

        It appears Google's argument is "it's safer/easier/cheaper to use Google Docs than emailing your file as an attachment, or letting employees put it on laptops and USB keys which they then loose."

        If you have information which can only be transmitted between a computer monitor and the user's eyeballs, I don't think Google has any thing to peddle to your corporation, unless they start selling Faraday Cages to guard against Van Eck phreaking.

      • by IndustrialComplex (975015) on Monday September 20, 2010 @09:55AM (#33635086)

        Agreed. I fail to see how sensitive information being sent over the Internet could be more secure than keeping sensitive information stored on a computer that doesn't even have a network card installed.

        Security and Availability go hand in hand. Security isn't just, NO ONE EVER GETS TO LOOK AT MY DATA. Security is also making sure that your data remains undamaged (integrity) and available to the people that you want to see it.

        • by xtracto (837672)

          Agreed. I fail to see how sensitive information being sent over the Internet could be more secure than keeping sensitive information stored on a computer that doesn't even have a network card installed.

          Security and Availability go hand in hand. Security isn't just, NO ONE EVER GETS TO LOOK AT MY DATA. Security is also making sure that your data remains undamaged (integrity) and available to the people that you want to see it.

          Uhhh, me thinks you are confusing privacy with security.

          Data privacy is the one about

          NO ONE EVER GETS TO LOOK AT MY DATA.

          While data security is about

          making sure that your data remains undamaged (integrity) and available to the people that you want to see it


          • Uhhh, me thinks you are confusing privacy with security.

            Data privacy is the one about

            While data security is about

            For reference: http://en.wikipedia.org/wiki/Information_security [wikipedia.org]

            Integrity
            Availability
            Confidentiality

            It isn't that they are all one and the same and in equal measure, it is that they all are aspects of designing a secure system. For a given system, confidentiality (a more comprehensive term than privacy) is an aspect that you evaluate and your requirements are derived from your need.

            Privacy, as

      • by ronocdh (906309)

        I fail to see how sensitive information being sent over the Internet could be more secure than keeping sensitive information stored on a computer that doesn't even have a network card installed.

        While I acknowledge your penchant for information security, I fail to see how information on a non-networked computer is useful. If we're tearing out our network cards in 2010 (note that the very notion of non-embedded networking hardware is rather old-hat), let's just go back to poking at clay tablets with sticks! All this new-fangled technology is for the birds, right?

        TFA is about ensuring that computer security improves to meet new challenges. That is both harder and more noble than throwing the baby out

        • by mlts (1038732) *

          There are times when having something non-networked is useful. Offline key signing for example where one takes a USB flash drive full of items to be signed to an offline HSM in a physically secure location where only a few people have access to it.

          What I see that might happen as a compromise between completely air-gapping versus complete connectivity are private backbones. Think NIPRNet, except for businesses. I can see banks coming out with a backbone, "BIPRnet" which connects businesses either on their

        • by hedwards (940851)
          Indeed, apart from DoD and intelligence work with sensitive documents, I don't think it's terribly useful to have a non-networked computer in this day and age. Perhaps you could make it really secure and super glue the cup holder shut, and perhaps do the same to the USB ports and network jack, but at some point you're going to need to actually use the computer at which point security becomes rather moot. After all there's little point in securing a computer with no data on it.
      • All it took was a blank CD that pretended to be Lady Gaga music to allow a traitor to leak 80000 classified docs to WikiLeaks.

        Inside jobs, carelessness, apathy, weak passwords etc account for most of the data loss. Packet snooping on https connections is not the main source of security breaches.

    • Or you know, a Google (or any other cloud service) employee access all your data because they own it then... No, cloud services are not more secure. Especially free ones who's business model is to make money off your private information.

      Oh shush. Google fans value freedom.

  • There's a price. (Score:5, Insightful)

    by Anonymous Coward on Monday September 20, 2010 @09:02AM (#33634626)

    For the low low price of your mobile phone number we will give you some extra security!

    • by jopsen (885607)
      Okay... I admit I could find anything in their privacy policy... I seriously doubt that is their motive...
      In fact I wouldn't be surprised if they promised not to use your phone number for anything else... Google does appear to be quite serious about cloud based apps...
  • by OneMadMuppet (1329291) on Monday September 20, 2010 @09:04AM (#33634644) Homepage
    ...which means if someone gets one factor (your phone), they still don't have the other (your password).
    • by chill (34294) on Monday September 20, 2010 @09:09AM (#33634686) Journal

      Allow me to introduce you to Google's "I lost my password, send me a code to my mobile phone to reset it" feature...

      • Re: (Score:3, Insightful)

        by MBGMorden (803437)

        I believe that's via email, which can be tied to your phone, but not necessarily.

        The reality though is that the only completely secure system is one that NO ONE can access. If you want it to be useful, the system HAS to have some way to unlock itself. Saying that a person can access the system if they have all of your credentials isn't really a flaw - it's the way the system has to work.

        Put bluntly, there has to be SOME point when the user steps up and starts becoming responsible for keeping track of thei

        • by vlm (69642)

          Saying that a person can access the system if they have all of your credentials isn't really a flaw - it's the way the system has to work.

          Not "has to work" at all. Not even remotely. First example off the top of my head in the first few seconds:

          Some other gmail user whom you have sent email in the past (lets say, one year) has to log into gmail and acknowledge that yes indeed you are requesting a new password for yourself. That second factor would have to be via a voice telephone call or in person request or whatever.

          In that two (or more) factor authentication, an attacker would not only have to take over all of your credentials, but also

          • by hedwards (940851)
            That's not even remotely realistic. Besides being overly cumbersome, it just changes the strategy needed to break into the account. And ultimately it doesn't solve the problem of having all the credentials anyways, because that doesn't evencome into play until you've lost them.

            Unless you're seriously suggesting that they randomly contact somebody that you may or may not know for approval. Which is far, far more likely to end up in shenanigans than just trusting Google.
      • Allow me to introduce you to Google's "I lost my password and my mobile, just log me in anyway" feature...

        • by chill (34294)

          As opposed to the "some of the Google engineers have already read your mail. There isn't anything you need to see right now, anyway." Service? :-)

          • by rhsanborn (773855)
            That would be an excellent service. Google can pre-filter email accounts and only pull out the accounts likely to be owned by a person with significant disposable income or high credit rating. It would save the phishers from having to try hundreds of dead-ends!
      • Then put a pin or password on your phone and/or install an application that allows you to perform a remote wipe if you lose it.

    • by Anonymous Coward

      Would someone tell me how this happened? We were the fucking vanguard of security in this country. The password needing numbers was the password to own. Then the other guy came out with a need for numbers. Were we scared? Hell, no. Because we hit back with a little thing called the case sensitive and symbols. That's needing to remember your capitals and lowercases. For complexity. But you know what happened next? Shut up, I'm telling you what happened—the bastards went to 2 factor. Now we're standing

    • Unless you have your phone store your password, but who's users would be stupid enough to do that? As you say, though, even in that worst case scenario they've reduced the problem down to attackers who have both the phone and the password. I fail to see any way that increasing security is a bad thing, even if there's still a hole (there's always a hole).

    • by wvmarle (1070040)

      Indeed making it no more or less secure than other two-factor systems that require some USB token or so.

      As a matter of fact today when I came back from lunch I found such a USB token, in this case to access an e-banking web site. Someone from the neighbouring office dropped it while opening their gate or so, it was in the middle of the corridor. Not smart. I just rang their door bell and returned it to them.

      I happen to know which bank it belongs to (I have a similar token), it wouldn't have given me acces

  • by sjpadbury (169729) on Monday September 20, 2010 @09:05AM (#33634650) Homepage

    Learn to keep track of your damn phone...

    • Re: (Score:3, Insightful)

      by eldavojohn (898314) *

      Learn to keep track of your damn phone...

      And what do I do when I don't have phone service?

      I recently went on vacation to Grand Cayman and didn't have any phone service. What happens then? I had to correctly identify friends from random Facebook pictures in order to log into Facebook the first time (at which point the place I was staying was apparently white listed for me to log into for the rest of the trip).

      Sure, it's probably a small annoyance to pay for better security unless you travel often or have really randomly spotty cell phon

      • That's a great example of why some argue that the "secret questions" approach to "enhanced security" is actually less secure than just a password. How many of your friends do other people know as well as you? That's very guessable compared to your password.
        • That's a great example of why some argue that the "secret questions" approach to "enhanced security" is actually less secure than just a password.

          Bruce Schneier has written about this [schneier.com], twice [schneier.com]. Yet Target.com insists on having credit card holders set five (!) secret questions.

        • by hedwards (940851)
          Worse, or better depending upon your perspective, is when the questions list is limited and one of them is completely useless. There's a fair number of people born in the late 40s, who have no middle name, as in they were named in part after President Truman, leaving you in the position of making up a name you won't remember or having a single letter answer.
      • I had to correctly identify friends from random Facebook pictures in order to log into Facebook the first time

        Apparently that is a very secure way to validate the user. The face recognition part, not necessarily the Facebook part.
        • by vlm (69642)

          Apparently that is a very secure way to validate the user. The face recognition part, not necessarily the Facebook part.

          Unless you are friends / schoolmates / coworkers with people in show business.

      • by wvmarle (1070040)

        You'd have to go for a walk to get your authentication code.

        Only to get timed out by the time you return of course.

  • Does this mean that a misplaced phone will present a serious impediment to being able to access your work on Google Apps?

    • Yes, exactly. Same as misplacing a SecurID token (or anything similar) locks you out of using whatever service the token is tied to. The horror.

  • by NYMeatball (1635689) on Monday September 20, 2010 @09:10AM (#33634690)

    It sort of compromises everything - but that doesn't mean it's a bad form of authentication, does it?

    Once your machine, token, credentials, anything have been physically compromised, it's generally accepted that you're hosed (at least for that one factor).

    Seems like a step in the right direction.

    • Re: (Score:3, Insightful)

      by Jurily (900488)

      Agreed. While it's by no means perfect, it is more secure.

      Most accounts today are not compromised because the attackers specifically target the victim, but because they had the weakest password.

      Also, the act of stealing a physical device makes it a far greater risk and hassle for the attackers.

    • by mjwx (966435)

      It sort of compromises everything

      With 2 factor authentication that is only true if you've got both authentication mechanisms saved on the device.

      This is why, with 2 factor authentication you need to have the password and token separate (of course people tend to put the laptop and token into the same bag all the time but I digress, that's a physical security problem). With my bank (I think this is the same for all Australian banks now) when I transfer money to an account that isn't mine via internet ban

  • by Anonymous Coward

    You mean it's not just Wish-it-was-Two-Factor [thedailywtf.com]? Google never ceases to amaze me. Now, how long must we wait before online banks finally get their security model right?

    • Here in Portugal my bank already send an SMS with a verification code for any operation over X euros, being X configurable.

  • Mobile security (Score:5, Interesting)

    by yakumo.unr (833476) on Monday September 20, 2010 @09:13AM (#33634716) Homepage

    I'm worried because in all the years I've had a Google mail account I haven't had any issues, yet a month after getting an Android 2.1 phone, despite being really careful about only installing high rated applications with tens of thousands of users and mostly keeping an eye on what they're allowed to access, my gmail account was hacked and used to send out a spam email via a mobile device in canada.

    I've never had an email account hacked before, so I'm pretty convinced that some phone app has leaked my account details (as it's the gmail account tethered to my phone).

    Admittedly Google immediately suspended my account due to suspicious activity (access from Mobile Canada (71.17.214.49), I live in the UK), and a token to my mobile phone was how I unlocked it and changed my password, but I'm still rather wary now despite how much I love my Galaxy S mobile.

    I have bought apps I don't want to lose wiping the phone, and I have no real way to tell what it may have been that leaked my data.

      I have droidsecurity antivirus installed now, but wish google could offer some stronger post-install controls on what an app's allowed to do.

    • Re: (Score:3, Interesting)

      by Darkness404 (1287218)
      I agree, really, Google should let -us- decide what an app can do. Want to access the internet, nope, check a box marked deny and that app no longer has access to that. Want to know my location, nope, check a box marked deny and that app no longer can find your location.

      About the only thing is, that might piss off a few developers because ad-blocking becomes rather easy, but I'm sure they will find a way to have it use the internet in a non-annoying way...
      • Re: (Score:1, Informative)

        by Anonymous Coward

        It does this...you see what privileges it has when you install an app.

        • Yes, but you can't pick and choose what privileges you want to give it, can you?

          The problem with the pick and choose model it's the pain it must to program the app filled with conditionals, or make it work at all.

      • Re: (Score:3, Insightful)

        by N1AK (864906)

        I agree, really, Google should let -us- decide what an app can do.

        Google won't, and shouldn't, add that. Google doesn't know what an application needs to function, a lot of users will block internet/phone etc access and break the application. Google and the app developer will then get bombarded by complaints and help requests. Android will need to match or beat iOS in user friendliness, options that offer nothing to most users and cause negative user experiences aren't going to help do that.

        I would like

        • No, I don't think that most users would block it, but it would allow you to have security without a closed ecosystem. For example, why would something like, say, a media player need access to my entire filesystem to play music when I could just limit it to read permissions on my music directory (and sub-directories). These things are what prevent security flaws and let you actually control your phone.

          Plus, it would allow people without unlimited data plans to use an Android phone without wondering what
        • I agree, really, Google should let -us- decide what an app can do.

          Google won't, and shouldn't, add that. Google doesn't know what an application needs to function, (..)

          Yes, google does know... more precisely, your android phone knows. Android apps come with a manifest file that specifies which of over 100 different privileges it requires to function (in fact, at usenix security last year, the chief android security guy was saying that the large number of distinct privileges is a usability pitfall that they are working on improving on). As a user, you are presented with a summary of this list and can then decide whether to install the entire application (and grant it all t

      • by Trufagus (1803250)

        Google has hesitated to do it that way because it is very hard for developers to write their apps like that.

        For the most part, the app has a certain set of requirements - that are clearly stated to the user - and without those requirements being satisfied the app can't run. You can't pick and choose which requirements you want to allow.

        The most important requirements are access to personal data. If an app that has no business reading your e-mail lists shows this as a requirement then don't install it. Ho

      • Re: (Score:2, Interesting)

        I love to see comments like this, because that is what my research is designed to do. Make it easy for end users (or admin) to specify what an application is supposed to do, and the program is restricted to the behaviour that is needed to do those things. For example, so you can say "this program is a web browser and an email client". Then, if you like, you can give some app-specific details such as "I download stuff to this directory", or "I only want access to these hosts". Then the program cannot do anyt
    • Re: (Score:3, Insightful)

      by Mr_Silver (213637)

      I've never had an email account hacked before, so I'm pretty convinced that some phone app has leaked my account details (as it's the gmail account tethered to my phone).

      The problem is that when you install an application, Android gives you a big long list of things that the app wants to do. Whilst it sounds like a great idea, it gives no context as to why it needs those features and you only have two choices - accept that the application can do everything or don't install it. It's far too easy to sneak som

      • In the future, the OS should prompt the user that an application wants to do something (eg. accessing your address book) at the point it wants to do it and let the use decide whether or not to allow it - with an option to say "Always do this for [blah]" where [blah] could be "accessing contacts".

        Is it just me or doesn't that sound an awful lot like Vista? And we know how popular Vista was...

        • by Miseph (979059)

          Yeah, and popular or not, that was one of the things Vista did right. That was an obvious thing people didn't like, so it was ripe for mockery, but at the end of the day Vista sucked because it screwed up a bunch of other, unrelated, things.

      • by TheLink (130905)

        The problem is that when you install an application, Android gives you a big long list of things that the app wants to do.

        This is not a problem. This is a good thing. Google should perhaps group some of the more common lists and call them by friendlier names.

        I have proposed a similar thing for ubuntu and other linux distros: https://bugs.launchpad.net/ubuntu/+bug/156693 [launchpad.net]

        In the future, the OS should prompt the user that an application wants to do something (eg. accessing your address book) at the point it wants to do it

        This would be annoying, and normal users are likely to still not make the right decisions.

        For people who can't be bothered to read and understand the big long list of things that an app wants to do, what Google or whoever should do is to allow 3rd parties to au

      • by SuperQ (431) *

        The problem is the Android core has no way to magically know the context for why the app needs access to specific APIs. "Why would this barcode app need access to my contact?" For one you can include contact information in a barcode and it makes it easy to add contacts.

        The real problem is that the API access controls are not fine grained enough. The barcode reader app should only have WRITE access to your contacts, not READ.

        Users (like me) do NOT want to be continuously prompted for stupid "ARE YOU SURE!

    • Re:Mobile security (Score:4, Interesting)

      by ptbarnett (159784) on Monday September 20, 2010 @09:30AM (#33634896)

      I've never had an email account hacked before, so I'm pretty convinced that some phone app has leaked my account details (as it's the gmail account tethered to my phone).

      Did you inadvertently reuse your email password somewhere else?

      My wife had her GMail account compromised by a Nigerian IP address. I'm pretty sure it's because she used her email address and password to create a userID at a site publishing historical immigration records.

      She's not reusing passwords anymore.

      • Did you inadvertently reuse your email password somewhere else?

        nope. I'm careful to use letters numbers and extra chars too.

      • by jschottm (317343)

        A suggestion for your wife (and just about everyone) - using a single good password salted with the name of the website's initials will help her remember passwords while greatly increasing security.

        For example, if my core secure password was '^hU@8c#}]2', my password for this site would be '/^hU@8c#}]2.' while my password for Bank of America would be 'B^hU@8c#}]2oA'. This is enough to keep simple password theft from a website with weak security leading to widespread compromise without having to memorize do

    • Slightly off topic I know but.... I have a HTC desire, and I experienced a very similar problem as you. Although I think I tracked down which app it was and got rid of it, wasn't fun having my gmail account spam all the mailing lists I'm a part of, but thankfully google blocked that quickly (and the two times it happened - the first app that I got rid of wasn't the culprit). Anyway, to my point. If you've bought an app in the market place, then wiping your phone doesn't mean you can't have that app anymo
      • I was sure that there would be no repurchasing necessary, it's just a hassle to make a list of what to get again, and the time it takes to reinstall them all. Especially frustrating when having no idea which app was the culprit.

        It's not like you can install one app then sit around and wait a few months to see if anything untoward happens before installing the next one to test.

    • by Jurily (900488)

      Your phone is too smart to be secure. Buy a $10 Alcatel.

    • Re: (Score:3, Informative)

      Hey,

      I work on the Gmail team. What happened to you is not related to your use or purchase of an Android phone. In fact, the spammer that logged in to your account wasn't using a mobile phone at all. The reason the session shows up as from a mobile device in your recent activity console is that some popular spammer tools identify themselves to our servers as a mobile phone so that it is allowed to use the mobile HTML UI - presumably as it's easier for them to reverse engineer. But it's actually just a progra

      • I'm well aware that correlation != causation, but...

        I use win7 systems with UAC on full, firefox with noscript and adblock, and Microsoft Security Essentials. I install only software I require from trusted sources, tracking it back to the source page.
        I keep a general eye on Task Scheduler, and on currently running things with Sysinternals Process Explorer, and AutoRuns to make sure I'm not running anything I don't wish to.

        If I really want to check out something new and unproven it goes in a VM and gets scan

    • by SuperQ (431) *

      Correlation != Causation.

      The only way for an app to get your gmail credentials out of your phone directly is if it asked for your gmail password.

  • Silly nerds... (Score:4, Insightful)

    by Darkness404 (1287218) on Monday September 20, 2010 @09:13AM (#33634720)

    but it doesn't answer how it helps if an intruder is getting into Apps through a lost or stolen phone

    When you lose your phone, the vast, vast, vast, vast majority of the time they just want to wipe your iPhone and sell it to the local pawn shop. They don't care about your data, your songs, your apps, etc. they simply see that shiny, new hardware = money. Same thing with laptops, they don't care about the data on it, they want to wipe "that funny looking OS" off of it and put a pirated copy of XP on there and sell it on eBay.

    The idea that stolen gadgets are going to be used for something beyond simple hardware really overestimates either your value of data or the intelligence of thieves.

    • Re: (Score:3, Interesting)

      by ibsteve2u (1184603)
      You refer to a time from before the day Google incentivized the stealing of phones by making them [a] key to business espionage.
      • by Nick Ives (317)

        Google is late to that party: Blackberry and iPhone had full Exchange support before Android.

        Anyway, Exchange allows admins to do a remote wipe, does it not?

        • The question, of course, is can a business remotely ascertain if other servers, disks, and magnetic and optical storage (perhaps because of legitimate efforts to protect and back up their data; perhaps for other reasons) hold some or all of their data and wipe them, too?

          The entire theory of "the cloud" is that you surrender the manipulation - and often the storage - of your data and in turn rely upon trust and trust alone to guarantee the security of your data. The reality of the usefulness of "trust" as
    • ... that Paris Hilton lied when she said those pictures were obtained from her stolen phone?
      • I'm suggesting that none of the readers of /. are Paris Hilton.

        Yeah, if you are a celebrity, people are going to look through your cell phone. But I'm not a celebrity, I don't think you are and neither is most of /. (I don't think that the average person cares to look through Linus Torvald's cell phone) and this idea that our data is somehow awesomely valuable to the average person and would be stolen is a bit too much of ego. No one cares about your source code to yet another text editor, no one cares
    • When you lose your phone, the vast, vast, vast, vast majority of the time they just want to wipe your iPhone and sell it to the local pawn shop.

      How did my phone magically become an iPhone?
    • by xtracto (837672)

      Nope...

      When you lose your phone (nowadays), the vast majority of thieves want to look at your pictures and videos to see if you have some interesting (aka pr0n) stuff there.

      Some people are so stupid as to even use the phone (some of them actually buy a new chip!).

      Believe me, I know the nature of these kind of thieves. During my high school I was friend with some of them.

    • by mjwx (966435)

      The idea that stolen gadgets are going to be used for something beyond simple hardware really overestimates either your value of data or the intelligence of thieves.

      Because no thief would check your email or look for credit card details. OK, the moron that knocked over your house whilst you were at the pub wouldn't, he'd just sell it to a pawnbroker (or put it in the free classifieds) but pawnbroker is generally smart enough to check for any obvious money making data. If you've left your CC details anywhe

  • by thethibs (882667) on Monday September 20, 2010 @09:17AM (#33634742) Homepage

    but it doesn't answer how it helps if ...

    Judgecorp should wait until after second coffee to post.

    What happens when an attacker has both factors in a two-factor situation is that security is breached. The same applies for any number of factors.

    The objective is to improve security, nothing can guarantee it. No "answer" is needed.

    (.....)

    • What happens when an attacker has both factors in a two-factor situation is that security is breached. The same applies for any number of factors.

      The objective is to improve security, nothing can guarantee it. No "answer" is needed.

      (.....)

      Most (grown) people are unfamiliar with passwords and all its implications. They re use passwords, they never change their passwords and they make us extremely simple passwords. But most people are aware of the value of the cell phone and they will notice it if they lose it. So to that extent it will help. Of course the validation code from Google should not identify the google account in the text message. Else, anyone who finds your lost cell phone could potentially hijack your account.

    • by leuk_he (194174)

      Go for 3 factor?

      -Something you know. (password)
      -Something you have (phone)
      -Something you are (voice print)

      and make them more secure:
      -Password contain 20 chars
      -A one time pad that generates new password every 10 minutes.
      -Retinal laser scan combined with fingerprint scan.

      By the way, loosing you phone does not loose your account, you will need to loose the password or some other secret as well. And even then you will have to need to trust the maintainers of the server.

      • by xtracto (837672)

        By the way, loosing you phone does not loose your account, you will need to loose the password or some other secret as well. And even then you will have to need to trust the maintainers of the server.

        There's a joke about setting your phone free, liberating your account and relaxing your password around there.

        Other than that I like your idea of your 3 factor password, but ONLY if it could be used to login in to ALL internet services.

        Actually that is something achievable with open source. If setup a "trusted server" server to which you can connect (using your 3 factor) and then that server automatically logs in/redirects you to all the services you use. That might be doable using VNC or the like... I only

    • by zindorsky (710179)

      What happens when an attacker has both factors in a two-factor situation is that security is breached.

      Fuck everything, we're going to 5 factor security.

  • Two factor authentication is the way to go. Sending a code to your phone is a great idea as cell phones / smart phones are very much a commonplace item in a user's inventory. Relying upon passwords alone is incredibly risky and should be augmented by a second form. This comes generally down to a physical special-use hardware token or we can use or better yet, use a cell phone and send the code to it instead. I know that this feature is available to World of Warcraft users (via the iPod / iPhone apps) and ma

    • by rhsanborn (773855)
      I bet many people will sign up for it, and less than 10% will stick with it, because it's inconvenient. About the 4th time they have to dig through their bag to find their phone so they can log in and check their email, they'll disable it. I do like the ability however, perhaps they could even sell it as a service to banks, etc, where people might not be so averse to the extra steps.
  • ...and they don't use Google apps, right?

  • it doesn't answer how it helps if an intruder is getting into Apps through a lost or stolen phone.

    Nor does it handle lost luggage, traffic jams, or slow-pouring ketchup. Yes, we all bow to your cleverness at identifying situations that it doesn't address, but in the 99.9999% of other situations, it's a nice bonus.

  • but it doesn't answer how it helps if an intruder is getting into Apps through a lost or stolen phone.

    Nor does it help if your employees are disclosing your secrets at gunpoint while simultaneously receiving the oral attentions of Halle Berry.

    But what it does do is what it says on the tin: prevents people getting in to your apps by guessing a user's password is "swordfish" (or "joshua" or "kronos" or "peekaboo" or the cat's birthday) or otherwise fishing or sniffing it.

  • I don't think judgecorp can count. The idea of the 2 step authentication is that there are two steps. This means that just having your password is not enough. It also means that just having your mobile phone is not enough either.

    This means that if somebody steals your phone, they still can't get in as they don't have your password.

    Phillip.

  • but it doesn't answer how it helps if an intruder is getting into Apps through a lost or stolen phone

    That would be what the first factor is for. Unless you also store your passwords on your phone in which case you've just intentionally reduced yourself back to one-factor security and well.. don't do that.

    Two-factor security isn't 100% perfect. Its always possible for someone who knows your password to also steal your phone. But the chance is significantly reduced compared to the individual chances of your phone being stolen or your password being keylogged/otherwise compromised. Three-factor security w

Often statistics are used as a drunken man uses lampposts -- for support rather than illumination.

Working...