Hacker News Reader

Comment by loteck | Hacker News Reader

Google's Adavnced Protection isn't quite as precarious as Maciej makes it sound. APP requires you to have two keys, one to store for backup, so it's hard to lock yourself out.

The recent trouble with their rebranded Feitan keys was kind of troubling, though.

View on HN

The thing is, in a campaign context the backup key is often inaccessible. If you put it in a safe place (like your safe deposit box or home office) and are halfway across the district, it won't help you.

I'm also not exaggerating how fragile the things were when I tested them. The head of the APP program had a broken one on his keychain.

Disclosure: I'm an engineer with the Advanced Protection Program.

Thanks for your work securing campaigns! I forwarded your post to my team because a major goal of ours is to be useful for this purpose.

Advanced Protection has improved a lot since early days. For example it works with Apple's native Mail, Contacts and Calendar apps on iOS.

Advanced Protection doesn't require any specific model of security key. The blue YubiKeys work just fine and even Touch ID is supported (as a U2F key).

Multiple backup keys are supported. And the same key can be used on multiple accounts.

Breaking or losing a key doesn't cause an immediate lockout. A key is required at first sign in on a new device or browser session but not thereafter. I don't even carry a key most of the time.

I'm sure there's more we could do to build great account security for campaigns. Please keep the feedback coming!

I'm glad to hear about all these improvements. I hope you will consider field-testing this with a real campaign, understanding that the biggest adversary APP faces by far in this domain is Google Legal.

>Advanced Protection doesn't require any specific model of security key. The blue YubiKeys work just fine and even Touch ID is supported (as a U2F key).

But it still requires one Wireless key -- why is this? I can't activate it only with my Yubikey NEO and blue Yubikey registered.

Odd, NEO is a NFC key, and I've seen this exact setup working multiple times.

Thanks -- My mistake, it looks like even though my keys were registered already as 2FA keys, I had to re-register them and it does indeed work.

Agreed you could get locked out for the day, but that's a bit different than "throw yourself at the mercy of mythical Google Support and pray".

Splitting hairs here though. Great work and great write up.

Reply on news.ycombinator.com