Hacker News Reader

Comment by rickmb | Hacker News Reader

One thing that worries me about iCloud is that it puts a lot of data and services behind one single password.

Said password is therefor used a lot, with a lot of chances for interception. But most of all, it's used for trivial matters in which password typing is a nuisance (installing a cheap iPhone app), which pretty much invites people to use a weak, easy to type password.

iCloud should have multiple, completely separate forms of authentication for services like Find My Mac, instead of using the same login for wiping all your Apple hardware as you use to download Angry Birds...

View on HN

Same reason why I worry about Google Accounts.

Your email, contacts, calendar, location, phone security, documents, files, music, videos, games, apps, credit card details, merchant account, search history, web app hosting, etc., all on one account.

Turn on 2-factor auth.

I thought about it and worried about it and thought about it some more, and finally did it.

And I had no problems at all - it works really well.

Dedicated attackers routinely bypass two-factor auth. If your second factor is your phone, then they simply attack via the phone carrier first.

Indeed:

http://williamedwardscoder.tumblr.com/post/24949768311/i-kno...

whilst this might be true - I get the feeling this is more of a "targeted attacked" - rather than a target of opportunity. 2factor is surely one of the best options we currently have to secure ourselves?

I agree. I think there was deliberate focus on the victim based on everything they accomplished.

Don't use texts for the two factor auth, use the Google's app https://play.google.com/store/apps/details?id=com.google.and... and print out the one time codes when prompted (for when your phone is unavailable for whatever reason).

As a bonus, you can also use it for when logging in over ssh with password http://askubuntu.com/questions/159727/how-can-i-use-a-passco...

Anything can be hacked but it's a really solid system, even against a targeted attack and motivated attacker.

Thanks for the link, but could you explain why texts are non-optimal?

Phone companies are often quite stupid about letting phone numbers (with their texts) get redirected. Like you don't have to know any private information, just have a good story stupid.

My phone is a pay-as-you-go Motorola Razr from 2006. How could they hack that to gain access to my two-factor auth SMS code?

Other than stealing the phone, that is.

They trick your carrier into redirecting your messages

I'd hardly say people routinely bypass Google's two factor authentication (using the smartphone application), which is what I'm suggesting here.

I'm aware of one incident (the Cloudflare hack), but that seemed to be more a vulnerability in the password reset functionality than the authentication mechanism.

SMS verification is less than ideal, though.

Doesn't Google fall back on SMS or a phone call if you no longer have access to the authenticator app?

I know I have a printed sheet of one-time codes, but I think if an attacker compromises the phone number on my account, I'm screwed.

You can disable that, so that the one-time codes are your only backup method.

Yes. My facebook account got hacked by a someone who pretended to be me, stuck in a foreign country; they asked my friends for money.

After that I turned on 2FA for gmail and facebook.

Sure, it's not perfect - but no security is. But is is definitely better than using passwords alone.

But what if your phone gets stolen? Sure, I've it configured to be erased after 3 failed pin code attempts.

Or, what if my iCloud gets hacked and my iPhone is remotely erased, can I still access my Gmail and Facebook enough to remove my phone from them?

Remote erase is a minor problem — you have recovery codes printed out.

How many recovery codes can you print out, and how many can you use? My cell provider (Avea, in Turkey) doesn't seem to pass automated SMS messages on, which has stopped me from using two-factor.

lolwut. and you still keep on using their services? Dude, get to Turkcell or Vodafone and use two-factor if you value your data.

edit: downgrade if you want to but it will be the day of my death when I let a provider dictate my needs and wants with its stupid rules and regulations. I pay for their services and barring unreasonable ones they have to provide what I need. And passing automated smsses are something that is not unreasonable.

My guess is you're being downvoted based on style ("lolwut", seriously?) and not because of content.

You can print out ten one-use codes at a time, and generate a new list of ten at any point.

You can use the two factor phone app. I installed this when we had a phone outage here. Available for Android not sure about iOS.

Google Authenticator is available for iOS, Android and BlackBerry, and there are compatible third-party implementations for Windows Phone 7, Windows Mobile, J2ME, PalmOS and webOS. Just search for OATH - it's the open algorithm that Google Authenticator implements.

There is a Google Authenticator app that generates time-specific codes for you, you don't need SMS at all.

Avea does that really? I believe this is the worst thing that Avea could do to it's users. Switch to Turkcell or Vodafone immediately.

One question, does it only block out of country automessages or do they also block 2FA messages of Turkish banks?

I don't have a Turkish bank, so I can't speak to that, and every time I have needed it was an out of country issue.

And not having the bank because I'm still waiting for a residence permit, which means I'm still doing the kontor thing rather than having a plan, something that's much cheaper with AVEA.

But what if your phone gets stolen?

Google 2 factor authentication needs 3 things: your Google username, your password, and the token number generated by the authentication application. Stealing your phone gets one of those things.

Or, what if my iCloud gets hacked and my iPhone is remotely erased, can I still access my Gmail and Facebook enough to remove my phone from them?

You get 10 single-use codes to print out for this situation. You can revoke these code and generate new ones whenever and as often as you like.

Your concerns were all similar to what I had. Another was that I have programs that need programatic access to my Google account and I don't want to rewrite them to use 2-factor authentication. That is solved by generating a revokable application specific password.

I found that turning it on and trying it out answered a lot of concerns I had.

> Stealing your phone gets one of those things.

2 of those things, if you have an android and they're smart enough to go to Settings > Accounts

And they can get your password if you have your browser remember it.

So, potentially, losing your android could mean losing your account.

Not if you have turned on screen lock and encryption.

You can't access your account settings without retyping your password. I think that password entry is excluded from browser auto entry.

In any case, there is a fairly easy solution here: don't let your phone web browser remember your Google account password.

They are gradually adding more options. There are now single use passwords for some services (I have them for Chrome and Android). Plus they support two factor authentication.

Easy, just don't use them.

I have little choice if I want to download Android apps.

You're right, I was trolling a bit.

Personally, I only give as minimum information as possible.

I agree. For years I have believed that "Single Sign On is Single Compromise", but users and auditors love it.

That damn account password kills me. A single password which you have to enter heaps of times on iOS. If having one password meant you only entered it once id cope, but its for email, iCloud, imessage, home sharing music, home sharing video, notes, find my phone, AppStore. It's so slow to set a device up, especially if you have a decent pasword. I wish they would fix it.

You can use a different Apple ID for the App Store that you use for iCloud, on the same device.

I know. But if I could enter it once as some kind of 'log into everything' option it would be great. It's so annoying to do on phone, iPad, laptop, appletv etc that I change my password too rarely as its so painful. Nasty aftershocks too (oh, so I have to find the appletv remote i to enable my account so that I can accept my phone as the remote).

Perhaps it should ask an additional security question or passphrase for 'dangerous' operations like remote wipe.

Two-factor authentication (using say your phone like Google) wouldn't work however because typically it's your phone that is stolen and you are trying to wipe.

You could use something besides a phone for 2-factor authentication--e.g. YubiKey.

Google + Yubikey would be great. Google + 2 step authentication + Yubikey would be a dream (and a bit over-kill?)

It seems to work with some limitations as the yubikey has no time source.

http://binaryelysium.com/blog/2011/12/13/a-reluctant-relatio...

Google + 2 step authentication

Did you mean 2 factor authentication?

Google + 2 step authentication + Yubikey

Is there any reason why you can't do this? It seems like it would work? (I've never used Yubikey so I might be missing something)

Google actually calls it "2-step verification"

source: http://support.google.com/accounts/bin/answer.py?hl=en&a...

That's why google let you use multiple phone numbers to verify.

Lose your main phone? No problem, login to your account using the two factor code from your landline (or partner's phone).

Reply on news.ycombinator.com