Hacker News Reader

Comment by Matt_Cutts | Hacker News Reader

The key part of the blog post for me is this: "To mitigate the risk, Google recently launched two-factor authentication, a mechanism that requires you to input, on top of your password, a code generated by an application installed on your phone (iPhone, Android and maybe some others). I have activated this today."

Anyone savvy enough to hang out on HN probably has a fair amount of valuable info in their Gmail account (domain registration info, passwords/access to shopping sites, etc.) and should activate two-factor authentication: http://googleblog.blogspot.com/2011/02/advanced-sign-in-secu...

Is it a little more hassle? A bit. But when someone else tries to log in from a new IP address in the Ivory Coast, or China, or wherever--they'll be prompted for a PIN and won't be able to log in.

I activated two-factor authentication as soon as I could on my Gmail. I think everyone reading this comment should too.

View on HN

I'll take the opportunity to address some of the complaints I've seen in many comments through this page.

Q: It's too much of a hassle to generate and write a PIN with every login I do!

A: Not so. Google can 'remember' an authorized device for 30 days, so assuming you mostly use the same few devices all the time, the added hassle is very little compared to what you're construing it to be.

Q: But I use many browsers on many devices! (AKA: "But I'm a webdesigner!")

A: Google lets you create limited access, easily revokable, device-specific passwords. You may consider creating one of these for each device that you actually own, but then you're reducing your security so somewhere between 1 and 2-factors.

When making that choice, keep in mind that on a worst case scenario, access to your email = access to all of your other online accounts.

Q: I don't always have access to my mobile!

A: No worries! When you set up 2-factor auth, Google makes you print a little piece of paper with 25 one-time disposable passwords for just such cases.

This is all true and correct, but I ran into a paradox when I had 2-factor auth turned on about a month ago. To save you all the long story, I was forced to use the backup disposable one-time passwords after I couldn't access my phone (signed out of the Authenticator app) and the backup number was a Google Voice number (stupid, I know) which required signing into the account...

For some bizarre reason, none of the one-time use passwords were working at all. This was shocking and I realized in an emergency, this would not do. As soon as I got net access and into the backup email address, I turned off 2-factor auth. I'm sure for others who didn't have this edge case paradox issue brought on by stupid me and actually working backup one-time-use passwords, 2-factor is a great choice. And I wish it were for me as well, but it isn't right now.

I ran into this as well (Google Voice handles my texts and I couldn't read them without being logged in) but they provide an option to call as well (even though I didn't choose this as my preference) and Google Voice still rang my phone without me being logged in. So disaster was averted.

Hmm, I only got a txt message option to backup number (gvoice) iirc. My memory is a little hazy though.

Here, let me grab a screen for you:

http://imm.io/6QLM

Notice the 'Get a verification code with a voice call' link. Hopefully you live in a country where they speak your own language, because here in Brazil, whether you get the call in English or (either) Portuguese is completely unclear.

Here's what happens when you click the 'other ways' link:

http://imm.io/6QM6

The first option works as usual, the second accepts only the latest seems to have had unexpected behaviour with you, and the third will take you to a 2-step—specific last-chance recovery form.

I would really like to activate two-factor auth for my GMail account, but I just don't trust my phone that much. The battery life is terrible, and I'd be afraid of losing access to my account if the phone breaks. Or what happens if I lose my phone? Or if someone steals it?

Presumably there's a way to handle that case, but it still bothers me. On the plus side, I'm using a Google Apps account with a domain I control, so I could quickly switch to a backup mail provider, but it's of course a huge hassle, and I keep a lot of email in my GMail account.

How do you deal with these kinds of issues? I really do want to use two-factor auth, but this stuff scares me about as much as the possibility of getting hacked.

They provide a list of backup codes which you're meant to print and put in your wallet.

I actually had the same concerns, but after going through it they give you two ways to solve that:

One is you can set a backup phone to use to get into the account, it can even be the same phone you have the authenticator on, so as long as you have the same number, you can access it. The backup phone option can also work with landlines through voice.

They also allow you to print out a set of numbers you can use in case you lose the authenticator to get back into the account.

[edit] Added voice backup note.

Note that besides sending codes via SMS, Google's two-factor authentication also supports time-based one-time passcodes (TOTP) that can be generated from a mobile device. They also support a list of one-time printable codes. I kept a couple of copies of these in my wallet and at home.

TOTP is an open standard and the mobile app is open source:

http://tools.ietf.org/html/draft-mraihi-totp-timebased-03

http://code.google.com/p/google-authenticator/

(Disclaimer: I worked on this.)

Looking at your links and the authenticator, is it the case that any third party web app can use the google authenticator "merely" by providing a key and account name?

Is anyone doing that?

I really like using the authenticator on my phone and would love to see other web applications support it.

But I am curious, why isn't the authenticator itself password protected?

Also, fyi, while I understand how to use application specific passwords, I have no good understanding of what they do, how they work, why they are safe or why I only have to enter them once. So they are confusing to me.

Application Specific passwords are designed to solve the case where an application requires you to enter your Google username and password rather than passing you to Google themselves to do the authentication.

The obvious risk of this model is what happens if an untrusted client steals that password.

Since you haven't given it your actual Google password It can still access your data, but it can't change your password (you have to enter your main Google password to do that) or change other critical settings, and if the application is misbehaving all you have to do is click revoke, and its gone.

You only have to enter them once because most clients nowadays provide a 'Remember my Password' functionality. Google assumes you will use this, so only need to enter your password once. If the password is forgotten you just generate a new one.

Thanks for the explanation, and sorry, I still am lacking a good model for what is going on.

You only have to enter them once because most clients nowadays provide a 'Remember my Password' functionality. Google assumes you will use this, so only need to enter your password once

Is this really true? Because the documentation for the one time auth doesn't indicate anything like that.

So I am confused as to what is happening in the background on Google's side.

My pseudo-model is that their password acceptance library looks for a correctly identified two factor authentication OR a one time password out of the user's one time password table.

But then I don't understand why these one time auths are one time! If someone finds my phone, or accesses one of my other net accounts that was authorized by my one time auth, they completely win until I can get back to google's page to revoke them.

And related, I don't understand why the authenticator can't generate these one time passwords -- MANY TIMES THAT WOULD BE A LOT MORE CONVENIENT than having to go to the specific page on the web.

And also related: why is there no pin or password for the authenticator?

These are just questions I have -- I'd love to read a page or two that discusses these issues -- I think having a good model of how and why it works as it does would help me secure my data.

The reasons why the authenticator cannot generate Application Specific passwords and why it does not need a PIN lock are the same: the entire point of 2-factor authentication is that the authenticator by itself is not enough to gain access to your account. You must separately provide both a code from the authenticator and your real password every time you log in.

There's no such thing as a "one time password". There are "Application Specific passwords" which work exactly like your regular password except that they limit access to critical account settings and can be created/disabled at will. If someone obtains one of your Application Specific passwords then they can use it to log in and access your data until you revoke that password but they cannot change your real password and deny you access to your own account.

"If someone obtains one of your Application Specific passwords then they can use it to log in and access your data until you revoke that password but they cannot change your real password and deny you access to your own account."

Ah. I think this is the key I hadn't understood till now. Thank you.

>There's no such thing as a "one time password".

Some people call the code generated by the authenticator a one-time password, because it can't be reused.

Yes any application can use it. I currently use it as a requirement to log into my server via SSH.

However, you are using a PAM module that was developed by Google. I'm not sure if Google's Authenticator program has enough of an API to allow any program to implement 2-factor authentication using their program yet, but it could be possible.

If the program uses the same algorithm I don't see why not. Here is a module for Drupal that uses Google Authenticator: http://drupal.org/project/ga_login This seems to be the implementation it's using: http://code.google.com/p/ga4php/source/browse/trunk/lib/ga4p...

Edit: of course, this is just another implementation of the TOTP method. It does not use Google's infrastructure to send you SMS / voice calls containing the code.

Python code to validate via Google authenticator (sorry, self link): http://www.brool.com/index.php/using-google-authenticator-fo...

Cool. I hadn't taken a look at the PAM module personally, so I didn't know if the code was as tightly nit to that implementation as some other crypto code (I'm looking at you, scrypt).

Good to see it can be implemented outside of Google products.

I know this is way off topic, but "time-based one-time passcodes" mapping to the acronym "TOTP" bugs the heck out me. Why are the hyphenated terms not treated equally by the mapping? Argg... I'm going to be thinking about this for hours!

It's only weird if you think about it.

Here is an idea: if security matters to you, get a better phone. They sell them in shops.

"I would really like to activate two-factor auth for my GMail account, but I just don't trust my phone that much."

I also don't trust my phone enough. But the bigger reason I don't do this is that I don't trust Google enough.

My phone number is private and none of their business. I don't want to give them yet another way to track me.

Does gmail make you enter the 2factor auth code to /remove/ the feature as well? If it doesnt, it should.

That way, even if a users computer gets owned with a trojan, the attacker couldnt change the gmail password or remove the 2 way auth tool without first having access to the phone.

Just checked: Google DOESN'T require 2-factor auth to remove the feature, OR to change your password for that matter, if you're accessing the account settings from an authorized "don't ask again for 30 days" device (which is a trojan scenario).

Which makes the system essentially moot. That seems like a substantial screw-up.

Maybe now that it has been pointed out, they will fix it.

Not really. When the guy had regained control of the account he could have signed out all other sessions, requiring all sessions to do 2-factor auth again.

But if the person re-authenticating has a trojan on their computer (as may have been the case here) there is _nothing_ that can be done to prevent a third party from accessing their stuff.

The point was that the 2-factor would have already been turned off by the hacker at that point.

What if you lose your phone, though?

You get 10 one-time use backup access codes for that case (which YOU need to keep secure).

They have you print out a bunch of one-time passwords which can be used to access the account should you lose your phone.

I'm going to look into it when I get the time, but I hope you can add a second device. One of the not-inconsequential benefits to being married is the additional redundancy.

If I can't remember a password, my wife might.

Hopefully I can set this up with her phone as a fallback.

When you're setting up 2 factor auth, they ask you for a back up phone number.

The setup forces you to go through two backup steps.

First it gives you a list of 10 codes that you should print and keep save. Looks like a TAN list. You can only move on if you check 'I printed these items and will protect them like my first born' or something like that.

After clicking next you are able to set up a phone number that is used as another fallback. Testing if you entered the number correctly is optional here, but worked like a charm.

Google gives you backup codes that you have to write down or print out and you have to give them your telephone number so they can text you other codes or call you with an automated message.

It doesn't really matter that much. The value of hacking your account is accessing the stuff that is in the account. Changing passwords should be less interesting.

If they have a trojan on your computer, they can still access everything in your account. 2-factor auth doesn't help. Very little does help if you have a trojan on your computer.

I admit in the scenario played out here - hacker tries to scam your friends - changing the password might help the hackers a little bit. Presumably they want to mail back and forth with your friends (first a plea for help, then sending a bank account number).

Still, that is only a minor danger compared to major damage of accessing your account, which the trojan does anyway.

For example even without a password the scammers could just claim that they have a new email address.

Perhaps a happy medium (between security and practicality) would be to have the option to only apply two-factor lock-down to "admin" type functions(i.e. to change cell phone, change secondary email, etc). This would allow a hacker to perhaps gain access to your email, however would not be able to completely hi-jack your account.

Exactly right. I have been saying for ages that services like Google, Twitter, Facebook should offer two factor. Now some finally do, it is a shame not to take advantage of it: http://www.rakkhis.com/2010/08/why-dont-facebook-twitter-and...

One of the main reasons I had some piece of mind when my account got hacked at MTGOX is that I had two factor on my Gmail: http://www.rakkhis.com/2011/06/i-was-hacked-mtgox-bitcoin-3-...

After this and another incident with a colleagues wife, I have made a note to set it up for my wife's account also tonight.

I would really, really love to activate two-factor authentication for my Gmail account, but Google requires me to have a phone number as a backup in case I lose my phone, and I don't live in one of the countries supported by Google for the backup phone numbers.

I hope they expand the list of allowed countries for backup phone numbers soon, including support for the "less important" countries like mine. Or else allow activation of two-factor auth for people who agree to have only the list of printed one-time codes for entry and no backup phone number. Preferably the former.

I used Skype-In for this.

I live in the UK, but only own a mobile nowadays. So I used a local Skype number for things like this.

Just never let that number expire. And now your Skype account needs a phonemenally complex password too.

I just turned it on on my account now, and I was able to skip the phone number step.

Matt, What about someone who travels for most part of the year , in my case working out of asia for larger part of the year, but US being my home base. I could put my US cell phone (which is deactivated for most part of the year - like this year my cell will be deactivated for the whole year except for 2 months). I don't carry a permanent cell phone in Asia.

How could the 2 step authentication help me - say I register with my US cell phone and I am out of the country for most part of the year?

You don't actually need to have cell service- there's an iPhone app (and presumably apps for other platforms) that lets you just generate new codes at will. You only need internet access to set it up initially, and you can do that with wifi.

won't help you if you have no phone at all but you can generate one-time-use passwords at will, so you could just stock up I guess.

Actually, it looks like you can only have 10 active one-time passwords at once.

On the page that lists the current ones and lets you regenerate them it says, "Be sure to throw away any previous versions. Only the latest set of backup verification codes will work."

Google voice. It was a little "Inception"-like to set up but has worked flawlessly for me. As long as you take a mobile device with you that is authenticated and you have wifi access you're golden.

What evan_ said: you're using the phone as a pocket computer, not as a phone. You don't need phone service at all--the authentication program will run on your phone even if you don't have service or you're in a foreign country.

Enough people have asked these (very reasonable) questions that maybe I should do a video about two-factor authentication.

This video made by Google is pretty good and covers many of the concerns people have: http://www.youtube.com/watch?v=zMabEyrtPRg

Nice--you're right, that video covers pretty much everything!

Re: "Anyone savvy enough to hang out on HN probably has a fair amount of valuable info in their Gmail account"

Even if somebody else does get access to my (non gmail) email account, all they're going to see is PGP encrypted emails:

https://grepular.com/Automatically_Encrypting_all_Incoming_E...

Of course, you have to be running your own mail server to implement this.

I also noticed that, in Germany, currently, the codes take several minutes to arrive by SMS, which is a bit of a downer when trying to check email.

I'm in the USA. Here they arrive within seconds.

Sure but you only need to authenticate a browser once every 30 days (assuming you allow the cookie to stick around). Assuming that you are only accessing your account from a few (preferably only one or two) trusted machines, it's really not that much of an imposition.

Now, if you are checking your account from random PC's at internet cafes all over Europe, and making yourself vulnerable to keylogger attacks, you are pretty much screwed anyway. Even if you use two-factor authentication, and remember to clear out the cookie before you leave, an attacker can still steal the cookie and use it to take over your account (or at least steal all sorts of secrets from your gmail account).

Two-factor authentication will definitely help, but it doesn't protect you against carelessness.

Disagree strongly. Anyone savvy enough ... has probably no password in his/her gmail at all. Btw, domain reg info can be searched anyway.

Also, if you got a strong and unique password, and do not login from untrusted devices that may be keylogged, you're quite safe already.

There's also the case of resetting your password for various other services. If someone can get access to your email account, it might not matter whether your actual webhost or domain registrar password is in your Gmail. The bad guy can force a new password or password-reset link to be sent to your email account, then intercept and use that link.

I already use a strong/unique password for Gmail, and I do my best not to login from untrusted devices, but adding two-factor authentication reduces the potential attack surface that much more.

For online accounts (including email), you're much more likely to get phished than have someone brute-force your password. While keylogging malware is an issue, it's generally less prevalent than successful phishing attacks. There's also the threat of compromised password databases from unrelated web sites (see http://twitter.com/lulzsec) being leaked, and if you share the same credentials, that can affect your email account as well.

2-factor auth gives you a considerable security advantage over "a strong and unique password" and not logging in from untrusted devices - I'd recommend you try it.

(I work at facebook, and we offer a similar thing called "login approvals" - go to "security" under https://www.facebook.com/editaccount.php to turn it on).

Matt, I'd love to if I could. My issue is not from living in an unsupported country, but that Google Authenticator requires Android 2.01. However everywhere mentioned on the 2-step authentication site "Android 1.5" is blared at me.

As a 1.5 user there is nothing that hacks me off more than getting my hopes up at an app my phone can actually use (a rare occasion these days) and then having it snatched away. I don't blame Google for supporting 2.x and up, but lies are unacceptable.

You don't need any specific software to be able to use two-factor authentication, it works nicely for me in any Linux distro I've tried and also Windows Mobile 6.1 (yes I know)

The software might make it easier than receiving an sms which needs typing in, but all your mobile applications can still use the system - you just generate a new pasword for each application (as you would for a Google Talk client on your desktop).

My laptop has encrypted hard disks so is set to remember Google passwords for 30 days. I can login from other devices using my pasword and an sms validation code which expires as soon as I log out.

Their tool is quite nice on android, all accounts will be shown in one screen, very convenient. I have all my gmail accounts (even spam ones) registered to ensure people don't get spam from my accounts (which were compromised). I also changed the spam accounts' passwords to a generated 32 char password to be on the safe side (I only use them for once in a while access).

I'd be happy to use two-step verification if I could. I've been regularly attempting to enable it since it was announced. Gmail refuses to accept any of my phone numbers because the country where I live (Kazakhstan) is not supported. Tried three major mobile operators to no avail.

All well and good, except 2 factor authentication does not work for google apps gmail accounts yet :(

It does work, you just need to enable it for the domain: http://www.google.com/support/a/bin/answer.py?hl=en&answ...

It'd be nice if I could turn on two-factor auth in case i notice something fishy with my account. Basically, an emergency function that would sign out all sessions and raise the bar to get in once a user feels their account might be compromised.

Is the last chance form still active when you use two-factor auth?

With two-factor authentication, what happens if your phone (with Gmail logged in) is stolen?

I am using Thunderbird everywhere. Any one knows how it works with two-factor authorization?

Reply on news.ycombinator.com