Hacker News Reader

Comment by Hamuko | Hacker News Reader

I don't know how I feel about making a device so endlessly hackable a "security key".

All Android devices certified by Google will have a hardware security module which should keep the keys secure. Some cheap non-certified devices (mostly Chinese) might not have hardware backed keystores, but I doubt those devices would be able to run this Google app.

If a Google app is required for this, we've already entered the "can't be trusted" category.

Not doubting you, but were did you find that information? The only thing I see is "it’s built into devices running Android 7.0+" and I found that on multiple pages.

As Android 7.0 is available to install on any device and I don't see anything about "certified android devices", I assume they mean ANY Android 7.0 device? Then again it only works with Google services atm, but I know you can sideload google play services so...

https://support.google.com/accounts/answer/6103523

Android 7 supports key attestation. https://source.android.com/security/keystore/attestation

That's great, but that doesn't actually guarantee that this new feature requires that the phone is using the hardware security module, just that you'd be able to prove if it it was.

Don't get me wrong, it's still better than TOTP in many ways, but having the actual security coprocessor is a big distinction.

There is no practical difference. For people who need the security, this API can guarantee it.

I just said I doubt it, I don't actually know. The combination of the Google web service and the android keystore api probably makes it at least difficult. But if you're running some custom compiled aosp code maybe it could be hacked.

1. This functionality only works on Android devices having passed CDD (try it). 2. Titan M is leveraged on Pixel 3.

>> All Android devices certified by Google will have a hardware security module which should keep the keys secure.

Source? I understood that having a HW-backed key store is still entirely optional for the purpose of Android certification.

On top of that, I noticed some ambiguity on whether a TEE like ARM TrustZone qualifies as a hardware-grade protection mechanism in the same way a discrete and dedicated crypto processor is (I think the two technologies provide very different assurance levels).

Titan M. They have it built into their Pixel devices much like a tiny mobile TPM.

https://www.blog.google/products/pixel/titan-m-makes-pixel-3...

With that said, I cant find mention of this on the page so it's probably not leveraging this.

It is. If you have a pixel you can just use a button press, because the Titan m can directly sense the button state.

Here's the CTS for Android 7.0 https://source.android.com/compatibility/7.0/android-7.0-cdd...

"When the device implementation supports a secure lock screen it MUST back up the keystore implementation with secure hardware and meet following requirements: MUST have hardware backed implementations of RSA, AES, ECDSA and HMAC cryptographic algorithms and MD5, SHA1, SHA-2 Family hash functions to properly support the Android Keystore system's supported algorithms. MUST perform the lock screen authentication in the secure hardware and only when successful allow the authentication-bound keys to be used. The upstream Android Open Source Project provides the Gatekeeper Hardware Abstraction Layer (HAL) that can be used to satisfy this requirement. "

Aren't you already using Authenticator running on an Android device?

That doesn't mean I think it's a good idea.

A phone is better than nothing. A real token would be much better.

I'd argue using Authenticator is better than simply not using 2FA. Which is probably the choice for a lot of people for whom always carrying some dedicated hardware device is not really a realistic option.

absolutely. it’s a second thing to hack. just because it’s _possible_ to hack the second thing doesn’t mean it isn’t helpful.

In what way is carrying a dedicated device not realistic? My second factor lives on my keyring and is only a bit larger than a typical door key. Everyone carries keys.

I don't carry my keys when I'm traveling if I'm not driving my own car. So, no, not everyone carries keys.

ADDED: I do have other 2FA hardware as well. But I assume I'm not guaranteed to have it with me when I need it.

Ah, you have separate keyrings for your home keys and car keys? I'd say that's not usually the case.

No. I have a keypad on my door. So when I take a trip by air (which is common), I just leave my keys at home. But I agree that my scenario may not be super common.

It's common in any situation where you share a car with other people.

Which, in turn, is more common outside of US.

> In what way is carrying a dedicated device not realistic?

For most people, it's so far outside what they're familiar with that it feels alien and incomprehensible. It makes absolutely no sense to them. So they're not going to do it or adopt it quickly.

User education will catch up in time, but that will take quite a long time.

>For most people, it's so far outside what they're familiar with that it feels alien and incomprehensible. It makes absolutely no sense to them.

The Google Titan Key looks like a car keyfob, so I don't really agree with you on this.

It doesn’t add value for most applications for service providers.

TOTP for GMail assures Google that the same person who enrolled the account was given custody of a key.

The physical token only adds value in scenarios where phones aren’t available or you need to assure the identity of the individual.

I don't normally drive a car (I take transit to work) so I don't carry car keys. I have an electronic lock on my door at home, so I don't carry house keys. I don't carry keys of any type.

My phone case has a slot for credit cards, so all I normally carry with me is my phone, a credit card, my work badge, and my transit pass.

Google Authenticator is just Google's front end to an open standard (TOTP). Authy, 1Password, various CLI apps, they all implement this same standard.

Lots of independent websites market this form of 2FA as "Google Authenticator". It's kinda like asking people to enter their gmail address (rather than their email address).

Eitherway, TOTP is a big step away from putting all your 2FA eggs in Google's basket.

Um, yes. Plus it uses "Google Cloud".

A security key device ought not to be remotely writeable.

Reply on news.ycombinator.com