Hacker News Reader

Comment by ______- | Hacker News Reader

This is dangerous. I specifically don't want 2FA on one of my Google accounts because I only have one phone number tied to one device, and this decision by Google to enforce 2FA is going to lock out millions of accounts since some people like to have two Google accounts for compartmentalization reasons (one account for work and another one for play is a common thing to see). So now I need a second phone to get 2FA prompts on the account where I don't want 2FA turned on.

View on HN

SMS is not the only – or preferred – 2FA mechanism for Google accounts. You can use any TOTP authenticator application, Google mobile applications like Gmail, physical security keys, or backup codes. Having a single phone number is not a problem for dealing with multiple 2FA-enabled Google accounts.

> or preferred

I just made a new Google account a couple hours ago, and it definitely looks like the preferred mechanism.

- There's one stage in the signup flow you can't bypass without SMS (granted, it doesn't automatically save that number to the account if you opt out, so that's nice).

- When setting up 2FA you're given giant messaging encouraging you to use a phone number. There's tiny text for other 2FA options.

- Those other 2FA options don't actually include TOTP. To enable TOTP you have to enable a "primary" 2FA solution (SMS, hardware key, or push notification), then enable a "secondary" 2FA solution (which can include TOTP), and if you're concerned about the shitty security SMS provides you then need to remove that as a 2FA option.

Edit: Mind you, it's probably reasonable given the state of the rest of their ecosystem to not have TOTP as the 2FA for your Google account (like if you have a chicken and egg problem trying to get into an android device with a TOTP app), but TOTP doesn't seem to be anywhere near as preferred as SMS.

That, and they do support hardware tokens out of the box (even if the UI doesn't make that super clear), so that's a step in the right direction.

Even though TOTP is provably safer than SMS, it looks like the reason why they want SMS/push as a "primary" is so that they can suck in more phone numbers, since hardware keys have an additional cost that most people won't have. Phone numbers will let them do better ad targeting.

That is Silicon Valley's reason for 2FA in a nutshell. Phone numbers can only be obtained with identification in many countries. It is a privacy nightmare.

It may be safer but it is way less user friendly. If you lose your phone with Google Authenticator (or any competitor), you will lose access to your accounts. You'll need to find your backup codes or go through the process to reset your accounts, which can be very cumbersome. Once someone has to go through this process they won't want to use 2FA anymore, I've seen it happen to many people.

But if you break or lose your cell phone you can just get a new one, and you have access to your 2FA token again immediately. It's much easier for people to work with. Yes it's less secure technically, but that sacrifice is worth it for a lot of people.

There are authenticators out there that can run on multiple devices and have multiple backup and restore options (with SIM Swap prevention) like saas pass.

You can backup your 2FA TOTP qrcodes to physical cold storage, and you can keep backups. Most non-technical people understand the process of "keep this print out safe + secure"

However you can lose control of your SMS phone number any number of ways that are beyond your control.

It's frustrating that so many providers push SMS as the only 2FA, when there are so many problems with it, and TOTP is provably better, privacy preserving, and much easier to work with.

I don't know if you ever worked with tech-illiterate people, but there is no way that they would print out or write down a list of codes or keep something in cold storage. Hell, even if they know how to. It's too much effort for something like email, and yet they wouldn't realize the importance until it's too late. I personally had to deal with an aging woman who had her online banking password set to her name followed by the year she was born in, and was unwilling to use the USB security key that the bank started providing. There was more than a million in her account. She couldn't be fucked to secure that kind of money with a free-of-charge easy to use key. It was not a case of an elderly woman struggling to remember her password or not understanding how to use it. In her mind she deserved the access to her account just on the merit of it being "hers", and she saw the security as an unnecessary ritual that the bank used as a barrier between her and her money and nothing could convince her otherwise.

That is a fair assessment in some cases, but I have also assisted tech-illiterate elderly folks with bank accounts in non-US banks. Keeping a printed list of codes (one time passwords) was in-scope for accessing the bank online, as well as other silly tricks as an on-screen keypad with rearranged numbers.

I think there is too much emphasis on catering to the lowest denominator to the point of sacrificing privacy and autonomy , rather than raising awareness and education.

> Even though TOTP is provably safer than SMS

This seems like it would depend heavily on your threat model, especially keeping in mind that we're talking about second factors here.

For example, one threat is that bad guys gain access to the authentication data of the Relying Party. For example, maybe they find the daily backups are in backups.tgz on the web server for convenient downloading. Or maybe you never changed the password on the MySQL server. This is of course one way bad guys might have everybody's passwords, the first factor...

For TOTP the stored credentials include a "seed" value used to generate those six digit codes, and so by the relying party to confirm your code is correct. So for that credential access threat, the bad guys also have your TOTP codes and you're no better off with TOTP.

Whereas for SMS the stored credentials just include a phone number to send the one use codes to, bad guys having that isn't great news necessarily, but it doesn't actually give them the codes. Even if the one-use codes are stored in the same place as permanent credentials (which they may not be) and thus accessible to bad guys, the bad guys can't necessarily arrange to see them before you use them, and in any case can't arrange for you not to wonder why you're getting all these one-use SMS codes suddenly.

In contrast notably Security Keys don't end up with the Relying Party having any secrets at all, and so bad guys do not learn how to impersonate your users even if they somehow have access to the same means you use to authenticate those users.

Read more about HOTP and TOTP here:

https://en.wikipedia.org/wiki/HMAC-based_One-Time_Password

https://en.wikipedia.org/wiki/Time-based_One-Time_Password

Implementations vary, but TOTP was developed on top of HOTP and presents a standardized method to expire OTP codes.

It's because people lose access to their phone number rarely. It would be pretty much expected for somebody to not realize their Google Authenticator codes aren't backed up before losing/selling their phone or losing their Yubikey before backing up the private key off it. As somebody who doesn't use SMS 2FA, I still think it's a great middle ground for the average user.

Untrue. Particularly in emerging economies where prepaid is much more common, it’s quite normal for people whose phone becomes unavailable to just buy a new one with an entirely new number and just tell everyone their number has changed.

emerging economies don't have number porting?

They do, but a lot of people don’t bother and just get a new number along with the new phone.

Then they wouldn't use their temporary number for 2FA. But for a lot of people they have their number for decades and are not going to suddenly lose it as easily as you can drop your phone into the ocean.

They finally updated Google Authenticator to enable backups and transfers between devices in December last year.[1] Also, there are other 2FA apps like Authy that are more user friendly and have been transferrable for years now.

However, I think you do have a point. The attacks that rely on intercepting SMS messages are cumbersome and are really feasible only for high value targets.

[1] https://www.androidpolice.com/2020/05/07/google-authenticato...

> The attacks that rely on intercepting SMS messages are cumbersome and are really feasible only for high value targets.

Depends on your definition of cumbersome, but it can be done fairly trivially[1] if you know what you’re doing.

[1] https://www.vice.com/en/article/y3g8wb/hacker-got-my-texts-1...

The recommended alternative to Google’s proprietary authenticator is MIT-licensed andOTP. The app is also available on F-Droid: https://f-droid.org/en/packages/org.shadowice.flocke.andotp/

> There's one stage in the signup flow you can't bypass without SMS

Which impedes the ability to sign up if one does not own a smartphone. I’m sure many people who are unhoused and rely on dumb phones need access to email to apply for jobs. Granted, I’m selecting a niche of a niche, but it’s a prime example of how badly the system is stacked against people trying to claw their way out of poverty.

Feature phones are perfectly capable of sms.

I didn't test this very much with the current Google flow. I know FB and whatnot require a post-paid cell plan (i.e., with your name attached) at that portion of their sign-up flow, and that precludes a lot of the cheaper phone options.

1) Type of plan as no baring on feature vs smart phone.

2) Maybe pre-paid plans are contract based.

> There's one stage in the signup flow you can't bypass without SMS

You used to be able to make gmail accounts without a phone by using an Android TV device. I wonder if that still works.

Except that you might need to first setup phone/sms 2FA to then be able to setup any other 2FA auth, without being able to fully disable phone/sms based 2FA auth.

I'm not sure if it's still that way, but when I setup 2FA I could not directly setup non phone/sms 2FA (e.g. Yubikey, non google authenticator apps).

Worse even through I then explicitly disabled phone/sms based 2FA google at some point just switched it back one.

Worse there had been multiple times where having the 2nd factor but not the first (password) was enough to combine it with social engineering to completely take over an account. Some security researcher go hacked by this. Again I'm not sure it's still that way, but I don't trust Google anymore to not accidentally but a 2FA related vulnerability which makes the account less secure into their authentication flow. They either don't care (likely) or don't have the competency to handle this (unlikely). Well it's one of the reasons I'm slowly moving away from Google.

>a single phone number is not a problem for dealing with multiple 2FA-enabled Google accounts.

It increases the risk that a ban on an account will bring all of them down since you link them with same phone number identity.

Google makes using a different TOTP authenticator very difficult.

First, I need to register a phone number as 2FA. Only then can I choose an alternate method, get codes, and have to select Google Authenticator to use my Open Source authenticator, Aegis.

Does not say Google Auth or any TOTP; specifically only says Google Auth. I was worried Aegis would not work until I tried it.

Why not show choices on the sign up screen? Why do I need to register a phone number first? It is very insecure in the USA. Data collection? Hold out from when a phone number was the only real 2FA and a TOTP was under additional options? If the latter, that needs to change if 2FA is going to be mandatory.

This is doubly silly because the Google Authenticator team created the otpauth:// URI scheme which every authenticator application supports. I integrated it in pass-otp, for example.

>Why do I need to register a phone number first?

It's an anti spam/anti abuse feature. Getting access to new phone numbers that aren't recognized as virtual is pretty hard.

I think you're jumping to conclusions. It's unclear what "provided their accounts are appropriately configured" means, but a Google account that's not associated with any phone number or device probably isn't "appropriately configured" and I would guess that nothing will change.

But the original blog post was so opaque that I completely misunderstood what they were going to do until pointed out in this article. It's bizarre how badly written some Google blog posts are these days.

Then use a TOTP authenticator, which isn't tied to a phone number.

As an aside, this is the second comment, now, that is confusing general 2FA with SMS-based 2FA specifically. Given the audience of HN this is honestly surprising to me and makes me wonder how common this confusion is.

That alone makes me glad Google is doing this as maybe it'll drive more folks to be educated about 2FA.

Last time I checked and tried to have good 2fa on a Google account with only that,

TOTP is only allowed as an "additional" means of 2fa and to enable it you already need to have the Google Android promt authentication/phone? 2fa configured (Maybe not exactly like that, but basically you cant just add TOTP without having something worse already added).

I do not have SMS 2fa on my google account, but I do have TOTP and now U2F. At one point I definitely had only TOTP. At one point, I also had only U2F.

What I don't remember is whether or not I had SMS 2fa before and removed it, or never had it at all.

They allowed TOTP as primary method for 2FA before they put the Google app prompt in there as an option. So it was possible to set it up that way before 2016-2017-ish, I guess.

okay that would make sense, since I've had 2fa set up for it basically since they allowed it as an option

sucks to hear that you can't set it up that way initially anymore, if that's the case.

This is not accurate.

I just checked because I thought I was crazy: my account has SMS-based 2FA specifically disabled. The only enabled options are the Android prompt, Google Authenticator, and a set of backup codes.

Your comment is not accurate in the sense that it is currently not possible to enable 2FA on an account without it without a phone with either SMS verification or with a Google app prompt. If you have set it up in the past, before this, it will look different to you. If you set it up right now, you can remove the phone number later but somewhere in the bowels of Google the number will probably still remain to tie it to your dossier.

Dangerous? For the users maybe. What are they going to do?

For Google? They get to clean up (only keep "real" users) and reduce datacenter costs.

And maybe slow down account creation used for online harassment?

A phone number is already needed to create a Google account, completely independently of 2FA and a backup phone number

Last week I created a gmail account. No phone number was required. I fully expected it to require one, but it didn’t.

It looks like if you create it through the Gmail app that is a workaround to not needing a phone number

It's possible to set up a Yubikey (or compatible) as the primary 2FA and Google Authenticator (I use Authy but it works the same) as a backup.

Once you've done that, you can remove SMS as 2FA. At least you could several years ago when I did it this.

I could not remove SMS first, I had to have 3 methods and then I was able to remove it.

This is intentional. They only want you to have one account.

You can use the same phone number for more than one account.

AFAIK, you can use one phone or key for multiple accounts.

Why would you need a second phone? This is one of the more ridiculous things I've read on HN.

It is very common to arrange your life so that you are able to 'hand in' all work devices and walk away. Its a seperation of work and home life that is very healthy, and a reasonable self-protective measure.

Such assumptions are the root of all evil.

I don't understand what you're saying here. What's wrong with wanting to keep work stuff out of my personal machines?

No, that's perfectly fine. But where it goes wrong is in the assumption that it is 'common'. It isn't common at all to see the opposite either (not everybody wants to carry two phones around, not all phones are dual SIM).

The whole work/personal line is blurring more and more and our devices and thought patterns have not kept up with this. You could probably write one of those 'Things programmers assume about online identity' articles by now.

Oh yes work/personal commingling is definitely common in my circles unfortunately.

This doesn't explain the comment.

If you have a Google account for work you also have a work issued computer at minimum, so install a TOTP authenticator there.

If you also have a work issued phone it's a total non-issue as you can use that for 2FA.

If you access your work Google account from a personal device in circumstances where you don't have access to work equipment, then install an authenticator there.

> If you have a Google account for work you also have a work issued computer at minimum

I have a Google account for work. I don't have a work issued computer.

I think you're assuming too much about how other people might work.

I agree there are enough options that it shouldn't really be a big problem, but it's not surprising that not everyone are aware of the options.

> I have a Google account for work. I don't have a work issued computer.

Which must mean you're using personal equipment and you're not doing what the previous person was talking about, which was:

> It is very common to arrange your life so that you are able to 'hand in' all work devices and walk away.

Context matters. I was arguing a specific point based on a scenario the previous individual was posing. That scenario apparently doesn't apply to you, in which case, go argue with that person, because it wasn't my claim.

Now, if we want to talk about your specific circumstance, if you're using personal equipment to access a work account, stick a TOTP authenticator on your personal device.

I honestly don't understand what's confusing about this.

Doing work on my personal laptop does not mean I can't just hand in the work devices and walk away. My credentials would be disabled. The work data remains on work machines.

> I honestly don't understand what's confusing about this.

I didn't argue it was confusing. I argued against your assumption. And there's no need to use that tone - it comes across as aggressive and condescending. EDIT: I note this is not your only comment in this thread that comes across this way. Looking at your comment history suggests you're just direct, so I'll assume you don't mean anything by it, but it rarely goes over well here.

At a previous position I regularly used a variety of company issued hardware (alongside my standard workstation). The only company device I had consistently was the phone.

In my current position I can be called up for an emergency at any time. I'm not going to cart my desktop or laptop around on my day off, but carrying a phone for use with any reasonably secure machine I can find is a good solution.

People with responsibility for operations systems will find themselves in this kind of situation somewhat regularly. These are also the people most likely to seperate work and personal devices due to usage policies or risk profiles.

Here is a possible suggestion, let me know if there are problems with it. Install Authy on your phone and backup the 2FA secret key in the same password manager that you have the work password stored. That will allow you to effectively share the account (2FA included) and fully relinquish control if you leave. Would that work?

I'm not the person who said they had a problem with it.

Just install Authy on your computer with a master password for the personal account. No second phone needed. Or install Authy on your phone, but I can't tell if you are saying you only have a work phone and no personal phone? Or is it visa versa? I'm having trouble picturing your setup

Edit: If you already have two phones due to your work life separation, then 2FA isn't really causing you to get a second phone is it?

You are replacing one privacy nightmare with another:

https://www.twilio.com/legal/privacy/authy

The only privacy friendly method is no 2FA, just long secure passwords. Which is why 2FA is pushed so hard ...

> The only privacy friendly method is no 2FA, just long secure passwords. Which is why 2FA is pushed so hard ...

This is absolutely ridiculous and so clearly false I can't help but wonder if it's intentional misinformation.

There are numerous open source TOTP authenticators for both the desktop and mobile that require absolutely no data to be stored in the cloud or shared with third parties.

I myself use KeepassXC and Keepass2Android.

Not to mention, like, fido/u2f based systems which don't have any privacy concerns I can think of, even theoretically.

So you store the password and the TOTP in KeePass? Seems that you have 1FA, hacking your KeePass is enough to own you.

No, that would be silly. They're stored in separate databases with different passwords.

If I was really paranoid I'd keep the TOTP database on a separate device but, frankly, I don't anticipate being the target of a motivated attacker so that's more than I feel is necessary given the threat models I'm concerned about, those being untargeted hacks (service breaches, driveby attacks, etc) and social engineering.

I use Authy specifically because of their backup options. That obviously requires collecting my phone number and email address. I have no problem with that because if I'm traveling and somebody steals my laptop, phone, and backup Yubikey I won't be completely shit out of luck.

If you don't want to use Authy then use something else that doesn't backup the 2FA codes for you. But don't say 2FA is inherently a privacy concern. It isn't.

Reply on news.ycombinator.com