Follow Slashdot stories on Twitter

 


Forgot your password?
Close
typodupeerror
×
Google Privacy Security IT

You Can Now Use Your Android Phone as a 2FA Security Key for Google Accounts (venturebeat.com) 83

Posted by msmash from the better-security dept.
Google said today it will now enable Android users to use their smartphones as a Fast Identity Online (FIDO) security key (for two-step authentication) for their Google accounts, thereby addressing one of the biggest challenges that has slowed the adoption of this security measure: convenience. A report adds: You can thus use your Android phone to protect your personal Google account, and your G Suite, Cloud Identity, and Google Cloud Platform work accounts. (Android tablets aren't supported -- Google specifically limited the functionality since users are more likely to have phones with them.) This means Android phones can move from two-step verification (2SV) to two-factor authentication (2FA). 2SV is a method of confirming a user's identity using something they know (password) and a second thing they know (a code sent via text message). 2FA is a method of confirming a user's identity by using a combination of two different factors: something they know (password), something they have (security key), or something they are (fingerprint). The feature is coming only to Android devices versions 7 and up.
This discussion has been archived. No new comments can be posted.

You Can Now Use Your Android Phone as a 2FA Security Key for Google Accounts More

You Can Now Use Your Android Phone as a 2FA Security Key for Google Accounts

Comments Filter:

  • I'm using Google Authenticator for some applications. Maybe I'm confused (like a lot of things) but how does this help me move to 2FA?

    • Yeah, "The feature is coming only to Android devices versions 7 and up" is confusing for those of us already using 2FA. I've been using 2FA via Google Authenicator for some google accounts since Android 5. 2SV is not the only option, we already have a 2FA option. Or did we lose that 2FA option in recent history and now its returning? I am only using 2FA on a somewhat "old" account.

      • Re:When did we lose the 2FA ? (Score:5, Informative)

        by swillden ( 191260 ) <shawn-ds@willden.org> on Wednesday April 10, 2019 @12:02PM (#58415988) Journal

        Yeah, "The feature is coming only to Android devices versions 7 and up" is confusing for those of us already using 2FA. I've been using 2FA via Google Authenicator for some google accounts since Android 5. 2SV is not the only option, we already have a 2FA option. Or did we lose that 2FA option in recent history and now its returning? I am only using 2FA on a somewhat "old" account.

        This is a new 2FA option. A pretty nice one, actually.

        Google Authenticator requires you to unlock your phone, open the app, read the number, type it into the browser window and click a submit button. Oh, and you have to do it relatively quickly because the number is only valid for a short period of time.

        With this new approach, which builds on Android's ability to act as a FIDO token (which itself is built on top of Android Keystore authentication -- which, BTW, I designed and built :-) ), your browser communicates via bluetooth with your phone to get a cryptographic authentication token. So from the user perspective, when you get to the 2FA request screen, you just unlock your phone and tap "okay".

        If you have a nano security key that just lives in the USB port all of the time, then that's still the most convenient 2FA approach, IMO. But there's a valid (though not strong, for most users) argument that leaving the security key in the USB port all of the time is a bad idea. In addition, to use a security key you have to buy a security key, which you probably don't already have.

        Of course the 2SV option (SMS code) still exists, but it's significantly weaker from a security perspective.

        Security is context-dependent, so you can't really place these things on a continuum, but if I make a bunch of simplifying assumptions about common user scenarios, I'd say that Android-as-FIDO is the strongest second factor auth option currently offered. Security keys generally use certified hardware which is arguably more secure than the relevant hardware in a phone, but Android-as-FIDO also requires user authentication (usually biometric; so it's arguably three factor), while security keys do not. The Authenticator app is a little weaker because a root compromise of the phone can extract the relevant long-lived secret.

        This new feature is good stuff. It's quite secure, and also very user-friendly, which encourages people who might otherwise not use 2FA to turn it on.

        • Re: (Score:2)

          by jimbo ( 1370 )

          Thank you for the detailed explanation. I seem to be using another option from the ones described; I initiate Google login on my PC and enter password, my phone bleeps so I unlock it and press "yes it is me" - no code just the prompt. On iPhone it requires the Google Home app, not Authenticator, on Android as well I think.

          The FIDO approach seems more secure and supports more than just Google accounts, but requires a local/PAN BT connection?
          What are the fallback options if, say, borrowing a PC without BT? E

        • your browser communicates via bluetooth with your phone

          Hard pass.

          • your browser communicates via bluetooth with your phone

            Hard pass.

            Why? This is very good for security. Uses a separate, non-Internet and inherently local (in the absence of sophisticated relay attacks), channel significantly increases security. Do you have a problem with bluetooth in particular, or some other aspect?

            • Re: (Score:3)

              by Etcetera ( 14711 )

              your browser communicates via bluetooth with your phone

              Hard pass.

              Why? This is very good for security. Uses a separate, non-Internet and inherently local (in the absence of sophisticated relay attacks), channel significantly increases security. Do you have a problem with bluetooth in particular, or some other aspect?

              I generally don't have bluetooth enabled on any computer I control, for security reasons. If or when I enable it, I certainly wouldn't give my browser access to local bluetooth functionality! Websites don't need to be poking around there.

              I appreciate that Google is thinking in terms of local connectivity, but running everything through a Google(tm) browser is about the least attractive way to do it.

            • Re: (Score:2)

              by msk ( 6205 )

              In addition to the other issues noted in this part of the thread, power consumption, having to have Bluetooth enabled before starting the session that depends on the auth, remembering to disable Bluetooth after it's done.

              I'd rather type a six-digit code. And, frankly, I'd rather have a physical token for the most-used applications. I do not like having to find my phone, hope it's charged, unlock it, navigate to the app or notification, then do whatever else is needed to finish the process.

              For someone with s

        • Re: (Score:2)

          by AmiMoJo ( 196126 )

          So this is similar to the existing system where when you log in to your Google account a screen pops up on your phone asking you to confirm it's you, but extended so that it works on all sites that support U2F?

        • OK. It was a bad slashdot article title. Its not you can now use 2FA, its you now have a second way to use 2FA. Thanks for clarifying things.

        • First of all, thank you for designing Android Keystore. This is something that all operating systems need to have, and it is a very useful security feature.

          My take is that even if there might be vulnerabilities with 2FA on Android, or any phone OS for that matter... getting people to use 2FA is worth it, because most security compromises are mitigated by 2FA, even more so with physical tokens that one presses (like YubiKeys). 2FA goes a long way in ensuring that a keylogger doesn't cause a complete and ut

        • Re: (Score:2)

          by jrumney ( 197329 )
          Bluetooth? I guess it is more secure than the old GCM based authorization that they pulled some time back, but are people really letting their Browsers directly access hardware now? Or if you are using Chrome you don't have a choice?
    • Geez, why would anyone want to voluntarily GIVE google your phone number?

      I mean....i know they have tons on everyone, but I try not to voluntarily give them any info I don't have to, especially don't like to confirm my phone number to them.

      • Geez, why would anyone want to voluntarily GIVE google your phone number?

        I mean....i know they have tons on everyone, but I try not to voluntarily give them any info I don't have to, especially don't like to confirm my phone number to them.

        When the college servers require Google Authentication to be used to sign in, concessions are made to complete a degree with significant money already sunk in. Plus, it is an Android phone, I think Google had the ability to get the number if they wanted the second I registered it.

      • Re:Move to 2FA (Score:4, Interesting)

        by swillden ( 191260 ) <shawn-ds@willden.org> on Wednesday April 10, 2019 @12:04PM (#58416006) Journal

        Geez, why would anyone want to voluntarily GIVE google your phone number?

        This 2FA option does not require giving Google your phone number, unlike the much-weaker SMS-based 2SV option.

    • Re: (Score:2)

      by b0bby ( 201198 )

      This is different in that it's talking to your PC over Bluetooth, and you just hit a button on your phone rather than type in the code from Authenticator.

  • Google, Google, everywhere (Score:3)

    by DogDude ( 805747 ) on Wednesday April 10, 2019 @11:35AM (#58415740)
    At this point, Google knows where you are, physically, every second of every day. They also know exactly what you do on the web, what you do via email, and what you do on your phone. Is everybody really OK with this? One company knowing literally everything they can possibly know about you, in exchange for a bit of convenience? That seems insane to me.

    • "Is everybody really OK with this?"

      NO ONE is okay with this. If people were to vote on the question - "who wants every detail of your life snooped by an evil megacorp 24/7/365 with no warrant, no suspicion, and no recourse?" - the overwhelming majority would vote "fuck no".

      The only reason the iron boot of the police state hasn't already stomped Google is... that Google is de facto part of that police state.

      Big Brother Google is always watching.

      • NO ONE is okay with this. If people were to vote on the question - "who wants every detail of your life snooped by an evil megacorp 24/7/365 with no warrant, no suspicion, and no recourse?" - the overwhelming majority would vote "fuck no".

        That's because it's an irrelevant question which doesn't apply here. Remove your own personal biases by replacing evil megacorp with the word "google" allowing people to make an assessment of trustworthyness, and then list in the questions the benefits they have received in exchange and the question becomes and overwhelming "fuck yes" with a bit of "meh" from the more privacy conscious.

        Would you let me punch you in the face?
        Would you let me punch you in the face if you knew I was weak as piss and I offered

    • Is everybody really OK with this?

      Yes, because what people know is just a part of a complicated equation which also includes other factors such as what they do with the data, how much you trust them, and that latter one is inherently based on past performance as an indicator of perceived future performance.

      So let me ask you a question: Can you point to actual tangible negative impacts that people have experienced as a result of Google knowing this data? Because fundamentally that makes up the trust component. People have a high trust becaus

  • No (Score:1)

    by rtkluttz ( 244325 )

    I don't WANT there to be any tie in between my user account and my device. I want my accounts to both secure AND as anonymous as possible. I don't want Google's repeated efforts of tieing a specific human to a specific user account. That is not for them to know and I trust them even less than malware creators.

    • So don't use the products? You're complaining and the fact of the matter is that 90% of Google's target audience doesn't hold the same values you do. In Googleland you're the product, not the customer. It's parasitic symbiosis, if such a thing can exist. They will do what they can to keep you engaged so that they can collect the data and sell it so they make their profit. The benefit you get is that usefulness of products and an engaging enough experience. But yes, you throw away privacy. If you want Google

      • Re: (Score:2)

        by DogDude ( 805747 )
        If you want Google to do what Apple does you're gonna need to pay $1500/phone + support contract and at some point you'll be forced to upgrade.

        Or, you could just not use a "smart" phone.

        Or you could do what I do: use a Windows Phone when I need a "smart" phone.

    • Re: (Score:2)

      by bobby ( 109046 )

      Next will be 3FA, then 4, and at some point they will wear you down and you will be assimilated.

      • Next will be 3FA, then 4, and at some point they will wear you down and you will be assimilated.

        Arguably, if your phone has a fingerprint scanner, this is three-factor. You have to unlock your phone to authorize it to send the cryptographic second-factor message to your computer via bluetooth. And, of course, this is after you entered your password. So... something you know (your password), something you have (your phone) and something you are (your fingerprint, to unlock the phone).

        It's "arguable" not "fact", because some definitions of 3FA would require that the backend verify the third authent

    • I don't WANT there to be any tie in between my user account and my device. I want my accounts to both secure AND as anonymous as possible. I don't want Google's repeated efforts of tieing a specific human to a specific user account.

      Google has no interest in tying a specific human to a user account, outside of some groups within Google that fight abuse (a common abuse tactic is to great huge numbers of accounts, and spread the abuse across them), and even they don't care about tying specific people to accounts, they just want to make bulk account creation hard. Besides that, Google doesn't care if you have several accounts or few of them, and doesn't really care if the names, etc. on them are real.

      In any case, this new 2FA feature ha

      • Absolutely not. I didn't mention the fact that I screwed up and tried out Google Fi. It FORCE tied my phone to my google account. There is no way to untie it now. I have been all the way to the developer level and they said that is by design. So since I used a Google fi account tied to my gmail account, I can no longer part with my phone. If I carry my companies loaner phone and try to check my personal email while on a work visit to another area, there is no way I can do it without also carrying my cell ph

        • Absolutely not. I didn't mention the fact that I screwed up and tried out Google Fi. It FORCE tied my phone to my google account. There is no way to untie it now. I have been all the way to the developer level and they said that is by design.

          I don't think so. If you really can't remove the phone number associated with your account (and you're not on Fi any more) please email me and I'll file a bug. My slashdot username @google.com.

  • So now the phone becomes the only factor, right? So we're back to 1FA. Don't lose that phone.

  • Only second factor if password isn't stored (Score:3)

    by Nkwe ( 604125 ) on Wednesday April 10, 2019 @11:56AM (#58415922)
    If you save your password on the phone (so that it gets entered automatically on an app or website), then you are not really adding a second factor by proving that you have the device. For the password to be the "something you know" factor, the something needs to be something in your brain, not something stored the same device that is the "something you have" factor. Does this new setup ensure that passwords can not be saved?

    • Re: (Score:2)

      by b0bby ( 201198 )

      This is using the phone for accounts on your PC.

    • If you save your password on the phone (so that it gets entered automatically on an app or website), then you are not really adding a second factor by proving that you have the device. For the password to be the "something you know" factor, the something needs to be something in your brain, not something stored the same device that is the "something you have" factor. Does this new setup ensure that passwords can not be saved?

      This is for logging into a web site on a separate computer. Google doesn't provide any way to save your Google password on your phone and have it automatically sent to your computer, AFAIK.

      • If you save your password on the phone (so that it gets entered automatically on an app or website), then you are not really adding a second factor by proving that you have the device. For the password to be the "something you know" factor, the something needs to be something in your brain, not something stored the same device that is the "something you have" factor. Does this new setup ensure that passwords can not be saved?

        This is for logging into a web site on a separate computer. Google doesn't provide any way to save your Google password on your phone and have it automatically sent to your computer, AFAIK.

        Actually your saved passwords are synced from computer to phone and back again if you are signed in to chrome on both devices. Very convenient but some risk for sure.

        • If you save your password on the phone (so that it gets entered automatically on an app or website), then you are not really adding a second factor by proving that you have the device. For the password to be the "something you know" factor, the something needs to be something in your brain, not something stored the same device that is the "something you have" factor. Does this new setup ensure that passwords can not be saved?

          This is for logging into a web site on a separate computer. Google doesn't provide any way to save your Google password on your phone and have it automatically sent to your computer, AFAIK.

          Actually your saved passwords are synced from computer to phone and back again if you are signed in to chrome on both devices. Very convenient but some risk for sure.

          Not your Google account password.

      • Re: (Score:2)

        by Nkwe ( 604125 )

        If you save your password on the phone (so that it gets entered automatically on an app or website), then you are not really adding a second factor by proving that you have the device. For the password to be the "something you know" factor, the something needs to be something in your brain, not something stored the same device that is the "something you have" factor. Does this new setup ensure that passwords can not be saved?

        This is for logging into a web site on a separate computer. Google doesn't provide any way to save your Google password on your phone and have it automatically sent to your computer, AFAIK.

        Thanks for the clarification. That being said, if you save your password on your computer then your "factor strength" would be two things you have and zero things you know. The strength of "two factor" comes from having two different factor types, not just two different authentication checks.

        • That being said, if you save your password on your computer then your "factor strength" would be two things you have and zero things you know.

          You don't have a master password set for your password manager?

    • Re:Only second factor if password isn't stored (Score:4, Informative)

      by AmiMoJo ( 196126 ) on Wednesday April 10, 2019 @12:41PM (#58416242) Homepage Journal

      That isn't the threat model they are using.

      This protects against the biggest security threat currently out there: your password is re-used on another site and leaked by that other site, along with your Gmail address, and someone uses it to compromise your Google account. Since they don't have your phone that is no longer possible.

      It also against similar attacks, like shoulder surfing and keyloggers, where your password is compromised.

      If your phone is stolen you can only rely on whatever kind of lock screen you have set.

      If you log in via your phone's browser then at least even if your phone is compromised it would take multiple exploits to bother get your password and trigger the secure authentication mechanism without user interaction.

      I'm not entirely sure what your threat model is... Someone steals your unlocked phone? It's probably already logged in to your Google account anyway.

  • I don't trust Google with this, as it is clear that the end goal is making having Android device mandatory to authenticate online. This is not unlike Microsoft and its early efforts with Office software -in the end they succeeded with MS Office becoming defacto standard.
  • I mean in general, confirming logins on a phone. Anyone can see the SMS who has it. Logging in on a PC and typing in the SMS from the phone is okay, since it is two different device and someone on the internet will not have my phone.
    • SMS can be hijacked and rerouted. There have been a lot of real-world examples over the last year or two where attackers have social-engineered the telco to reroute SMS to a device they control, then used the SMS auth to compromise user accounts.

  • I've been doing this for two years with Google Authenticator.

    https://play.google.com/store/... [google.com]

  • Good thing I don't have an android phone.

  • I hope this is optional! Apple FORCES me to use my iPhone or my Mac for 2FA and I don't have them with me all the time. Sorry, I'm not an apple person. My iPhone is a test device only.

Slashdot Top Deals

Marvelous! The super-user's going to boot me! What a finely tuned response to the situation!

Close