Hacker News Reader

Hacker News

Comment by raldi | Hacker News Reader

Parent Full thread

raldi

What I really want is for the second factor to kick on only in suspicious situations, e.g.:

* I'm logging in from a computer that I've never logged in from before

* I'm searching my mail history for terms like "password"

* I'm opening an email that appears to contain a password-reset link

* I'm messing with my mail-forwarding options

* I'm accessing messages in bulk

But I do not want to have to do second factor just because it's been 31 days since the last time I've done it.

View on HN

Increase security/authentication as the risk factor increases based on context awareness. A number of vendors (notably CA), have been working hard to get this right. Essentially it requires a classification service that can derive context out of the content, and rate the level of risk and present the user with an additional authentication prompt (e.g.: 2-factor for exactly the scenarios you describe).

Since you're at Google, I hope you've been able to suggest this to gmail team. Even better if it's being worked on, especially the first item.

Typing a six digit number every 31 days is too much work to add a significant layer of security to a very important account?

Typing 6 digits every 31 does not add a significant layer of security. 2 factor auth does. And that's different.

If one of your devices is stolen, you go reset the pass. As simple as that.

Plus, 31 days is a long time for the hacker, so it's not adding all that much security.

> Plus, 31 days is a long time for the hacker, so it's not adding all that much security.

No, but it might well be for the guy who fishes your old harddrive out of a bin.

Times two accounts, times four devices, multiple browsers... pretty soon it's a once-a-week frustration.

I have three accounts and five computers and I don't find the once-a-month 6-digit number to be a big deal. PayPal does annoy me with their policy of requring an OTP seemingly every time you visit a page, but it's worth it because I know that I don't have to have a super-amazing password to stay safe. Ultimately, the work required to recover from a compromised account is much higher than it is to type a 6-digit number every month, so I consider it a good trade-off.

In my case, the number always seems to expire when my token is far away. So another way of alleviating this would be to have a three day grace period where you're prompted with the option of refreshing your credentials, but you don't have to.

Theoretically, the printed numbers you keep in your wallet can be used until you get your phone back.

I'm thinking more like, I wake up and want to check my mail from bed, but -- surprise! -- it's expiration day, and my OTP token is downstairs. And using a single recovery code immeditalely invalidates your electronic token, logging you out everywhere and forcing you to go through the activation process all over again before you can log back in.

Use it as a mental improvement exercise to help improve your short term memory.

It would be nice to choose the level of security you think you can afford on the security-inconvenience tradeoff curve. Especially since it is likely to increase the takeup rate.

Typing a six digit number once adds a significant layer of security to a very important account.

Having to type it every 31 days (per browser, per device, per account) adds very little marginal security. In fact, in my case it actively hampers security, because it keeps me from using two-factor altogether.

It's extra work.

Does this expiration after 31 days add any extra protection?

Yeah, if you are logged in somewhere and forget to log out.

... for 31 days.

You should clear those cookies quite often. Just saying

Reply on news.ycombinator.com