Hacker News Reader

Comment by avodonosov | Hacker News Reader

How annoying, in particular that service providers expect me to have a mobile phone and that the phone represents me (can not be lost, etc)

View on HN

They don't think the phone represents you. But the combination of proving you know the password and that you have physical access to a trusted device increases the confidence that it's you by a lot.

Depending on the form of second factor you use, it can stop phishing attacks (and don't say you'll never fall for one, anyone can make a mistake). The "send a notification" option for 2FA gives you information about where the login request is coming from, which is a chance to check that someone isn't sitting in the middle of login process. And something like WebAuthn makes phishing impossible outside of a browser exploit since the domains won't match.

You don't have to use a mobile phone/SMS for Google 2FA. You can use:

- Hardware key (fido u2f).

- TOTP or HOTP generator (on any platform, PC, Mac, iOS, Android, whatever).

- Trusted Device.

In all those cases the user needs a device for auth

You also need a device for logging into a Google Account at all. These can be the same device.

With password I can login from any device (guest session on a friend's laptop, etc). So I am independent of a specific device.

The second factor ties me to a specific device.

TOTP does not. Plus Google supports multiple concurrent 2FA tokens anyway.

Multiple still tie user to specific devices. It will not work on a friends machine (unless user memorises the shared secret used for hashes).

TOTP is essentially a glorified password (which is the shared secret), only so long that the user presumably does not remember it, so it is taken as a representation of a trusted device access. TOTP / HOTP are close to manual CHAP.

I don't feel two passwords (the real password and TOTP shared secret) are better than one.

How do I set up TOTP with Google? As far as I can tell, you first have to give them a mobile phone number and configure 2FA with that. Once it is configured, you can then change it to TOTP and remove your phone number. But I don't want to give Google my phone number in the first place.

In my account I either see the option with "push notifications on your phone", usb dongle or SMS (security nightmare).

I'm not against RFC'd TOTP , but is it possible with google?

You don't need a mobile phone for TOTP -- you can do it from a shell script and openssl. Many security keys support storing TOTP built in, and Google also supports the various security key protocols (FIDO2 I think is the current version?)

I should point out that FIDO2 allows sites to require that visitors use a device from a specific whitelist of devices.[0] Google has already tightened the requirements by mandating 2FA, so don't be surprised when they start blocking "insecure" factors like shell scripts.

It probably wouldn't go down well if Google required an Android device to provide the second factor, but I could definitely see them requiring a device which does biometric verification of the user. That's a pretty good way of connecting online activity to a specific human (assuming the attacker can gain physical access to your authentication device, and has a model of your fingerprint/face, which governments increasingly do have).

[0] https://developers.yubico.com/WebAuthn/WebAuthn_Developer_Gu...

You can lose the phone, just use your backup codes. Bitwarden supports otp and you can use that from any browser.

I'm a technical person and I have no idea what your post means... and I also need to figure this out and explain it to the rest of my (extended) family.

Google Accounts are the new printers, familial-y speaking.

One common 2FA method is TOTP (time-based, one time password). Bitwarden [0] is a password/secrets manager that you can host yourself. It supports TOTP so you can just use that instead of a separate app like Google Authenticator or Authy. I would not recommend this personally as if you expose your master password for bitwarden, you've also made it possible for the attacker to sign in via 2FA... which normally would require access to your phone or backup keys. But it is more convenient.

Basically, people should be using password managers by this point. I recommend bitwarden because you can host it yourself, it's good for storing other secrets, and it has browser plugins/apps.

[0]: https://bitwarden.com/

Thanks for the explanation.

Follow-up question: I downloaded Authy on my phone and my desktop, and the first thing it wants is a phone number. I'm trying to solve for not having a phone -- can Bitwarden's TOTP be used without a phone number being provided?

Thanks in advance.

Bitwarden does not require a phone, but it sadly TOTP support is only in the paid version. What I do is keep TOTP in an app called Aegis, which supports backing up the seeds. This way, I can always use the seed file to setup Aegis on a new device.

TOTP support is free if you selfhost it, e.g. with Vaultwarden [0].

0: https://github.com/dani-garcia/vaultwarden

To be fair, the paid version of Bitwarden is only 10$ per YEAR and you get lots of extra features besides TOTP support with that too:

https://bitwarden.com/pricing/

While I agree with your general point about the pressure to link accounts to phone numbers...

The post specifically states that there are other forms of 2FA, including token based.

Google doesn't, they still allow you to use TOTP 2FA.

This is only rolling out to people who already have devices attached to Google services.

Reply on news.ycombinator.com