Hacker News Reader

Hacker News

Comment by damncabbage | Hacker News Reader

Full thread

damncabbage

I think there are two lessons:

1) Use Incognito when using other machines, or

2) Don't trust Google with precious things.

View on HN

3) Don't let friends log into your laptop on your account. That's why guest accounts exist.

Use Incognito is definetely the way to go when you borrow someone else computer

I'm always paranoid that they'll have keyloggers/malware installed. I only log in to things from my phone, otherwise I don't log in.

nothing beats a good old paranoia

Two factor authentication can easily solve that problem. I used to feel uneasy about logging in on other systems, but now I don't mind using incognito and google authenticator.

That's true, I have two-factor auth enabled, but I still don't like how other computers can easily steal my password. Besides, between my laptop and phone, I haven't had to log in on another computer in a long time.

My biggest concern is not that they will get your email credentials, but the fact that they may have your email and a password to start tinkering with on banking sites, social media, etc.

How does it solve anything when there's a checkbox right there to permanently authorize the computer to not need the second factor?

s/permanently/trust for 30 days/

Still not great, but it's not permanent.

You can also log out other sessions in google apps, not sure if that resets the dont-do-2factor-auth bit though.

You have to reenter the password in thirty days but you never need the second factor ever again (at least in some cases, which in security terms might as well be all cases). The important part is in fact permanent. I'm rather skeptical on the security offered.

Edit: I'm still looking for some kind of documentation for it, but I know this firsthand. I set up two factor authentication several months ago and chrome has not asked for anything other than the password since. I can even go into the two factor settings with only my password, which gives me complete control to make unlimited single-use codes, or authenticate a different phone, or turn the whole thing off.

There is no way for you to read the one time passwords. You can only disable them from dashboard or make new ones. The parent comment was about keyloggers, and the don't-require-two-factor-auth checkbox is for browser cookie session only. So there is no way for a keylogger to exploit the checkbox. The attacker can only know your email and password, not your browser's cookie data.

I was not talking about application-specific passwords. I was talking about the ability to make 'backup verification codes' which can be used anywhere a second factor is needed. Once they have your first login they have a permanent all-powerful backdoor to your account unless you go in and hit the button that resets all logins.

But more importantly, your threat model is rather urealistic. Why would you trust an infected and keylogged computer to not be able to steal something as unprotected as cookies? You're right that in some kind of situation with a 'pure' keylogger you're safe, but you could get the same level of safety by doing something silly like log in with an on-screen keyboard. I think such a narrow threat model is misleading.

2 Step Authentication is your friend!

http://www.google.com/landing/2step/

Thanks, but I already have that. Still paranoid :P

Also, LOG OUT.

If you're using incognito mode, your session is gone when you close the window anyway.

Reply on news.ycombinator.com