Hacker News Reader

Comment by patmcc | Hacker News Reader

It's a tradeoff. They could let (or require) a password be entered to encrypt/decrypt it on each device, but then people would be ticked off when they forget their password and can't recover their 2FA stuff.

They should have handled it the same way they do Sync in chrome, and I expect they will eventually. But, as always, unless a service advertises that it's full E2EE and you can verify that, assume it's not.

One part of this that's funny to me:

>>>Also, 2FA QR codes typically contain other information such as account name and the name of the service (e.g. Twitter, Amazon, etc). Since Google can see all this data, it knows which online services you use, and could potentially use this information for personalized ads.

I guarantee you, Google knows which online services you use in about 800 other ways, it doesn't need to scrape it from your 2FA accounts.

View on HN

I don't think Google will use those secrets to look into your other accounts, but they can be politely requested by some governments to divulge the secrets, and not tell you about it. Then those governments would have no problems looking into your other accounts. And I'm not talking only about the US government, other governments can have dubious standards for requesting user data, such as failure to parrot the "facts" approved by their ministry of truth (China, Russia, and everyone in their sphere).

Not to mention Google can be hacked.

> I don't think Google will use those secrets to look into your other accounts, but they can be politely requested by some governments to divulge the secrets, and not tell you about it

A lot of companies and institutions use GA for 2FA for their secure systems too. Google doesn't even need to willingly share, as soon as the possibility of extracting the data is there they paint a target on it. External attacks are now extremely low hanging fruit with that unencrypted traffic. And internal attacks like getting an employee with access to that unencrypted data to provide it (knowingly or unknowingly) are relatively low effort and don't require the overhead of any legal proceedings or complex exploits. And if this goes through official/legal channels, Google doesn't have one single shred of protection between that data and what authorities can (shockingly legally) ask for.

Having the data is a liability for Google. Transferring it insecurely is also a liability for the user.

I appreciate this. A lot of people think your tech is between you and the provider, but they forget about the governments that have power over those providers.

Exactly - one of the major reason American BigTech is so invasive today in collecting our personal data is because the US government has shown them how valuable it is for them. Project PRISM has evolved and is huge success ...

The problem is now they know your TOTP secrets, they are only one password away from pretending to be you.

And actually, they serve you emails, so password is moot for most of the sites today.

They always knew your TOTP secrets. The algorithm requires both parties to know the plaintext secret as it’s an input to the HMAC. It’s not a public key operation and they can’t store it as a hashed representation.

It’s possible to have 2FA methods that are verify only (usually using public keys and signing), but TOTP is not one of them.

The website you log into with TOTP has always known the TOTP secret. Now, Google also knows your TOTP secret.

Ah! I misunderstood this being applied to non-Google accounts. Yes that’s scary.

The whole writeup seems like missing the forest for the trees - Google as root access on the Android device where this app runs, so they can certainly see everything if they want ....

Google pushing malicious updates would leave forensic traces, not to mention it'd be difficult to establish a legal framework allowing a government to force Google to do so.

In contrast, subpoena'ing data from the cloud is routine for police in countries all over the world.

This may sound like a naive question, but what stops countries with flexible ethical standards from abusing this power?

For example, in the past I've worked with an AI company with presence in China, where the data of their Chinese clientele must be stored on a separate data centre operated by a local enterprise.

Despite the provider being ISO compliant and holds internationally recognised certs, is there realistically a chance that those data could be accessed without the permission or consent of the users?

Depends on your threat model. Practically, the cloud admin would be able to dump that data in clear during processing even if that data is encrypted at rest and in transit.

So your threat model is a sovereign state able to subpoena cloud data.

Under this model, if Google gets a court order to root-break a specific phone (push malicious update), they will be forced to, and that's all the legal framework necessary, so end-to-end encryption doesn't protect you in this case either.

In the US at least, there’s not a lot of precedent for forcing a company to do something like that. (Yet.) Saying hand over your user’s files is demanding information. Compelling them to write and distribute malware is a lot closer to compelling speech. A 1st amendment problem.

That's a lot more detectable, and has a high risk of coming out, see e.g. Pegasus. Cloud access is nearly invisible.

There is a lot of difference between being as secure as practically possible with password data, and allowing anyone with root access to see all your password data.

But it's the same thing - the threat model described is not safeguarded by end to end encryption when the encryption device itself is compromised.

"secure as practically possible" depends a lot on what practically means, and that is just a function of cost vs threat level. If you believe that Google will access your private data, you should not be using a Google-developed application and OS in the first place.

you are so correct. people don't even question this anymore.

Everyone also might have "google play protect" enabled on their phones which allow google to pack and ship all and every app at regular intervals (no mention anywhere if it include user data) to their servers for threat analysis.

So because things are hard, you just reduce 2fa to 2 of the same factors. And make it worthless.

It’s typically not a disaster if you lose the 2fa keys and if it is, you should carefully save the recovery codes. But the keys get lost all the time so just about every service has a recovery procedure. So there is no need to store the secrets in such a way they can be recovered without the password.

> Google knows

TBF knowing which online service you bothered to activate 2FA on is an information a lot more interesting than which mailing list you forgot to unsubscribe for instance.

Now I don't think they'd use if for ads, I'd assume it would probably be more long term, like knowing which service to buy next, or where the trends are going.

Is decrypting via a password literally not how Authy, BitWarden et al handle it?

> Google know

www.reddit.com/r/degoogle

Reply on news.ycombinator.com