Google Is Finally Making Two-Step Verification Less Annoying (theguardian.com) 136
Google, which first introduced two-factor authentication about five years ago, is now making it a little easier to utilize this security measure. Instead of users having to manually enter a code that they received in a text message, they will now see a prompt message that only requires them to tap on the phone to approve login requests. The feature will be available on Android as well as iOS soon. The Guardian reports: You do have to turn this service on even if you already use two-step. To turn it on you need to first login to Google and then go to My Account > Sign-in & security > Signing in to Google > 2-step Verification. There you will have options to turn on two-step verification, add Google prompt as an extra form of authentication or replace your existing two-step method. Google isn't the first to use notifications as a method of login verification, both Twitter and Facebook allow users to confirm logins using notifications from their respective smartphone apps. But even they require entering the app, viewing the alert and tapping confirm. Google's one-tap confirm is much faster.
Why would I want 2 step (Score:2, Insightful)
And why on God's green earth would I want to give Google my telephone number?
Re:Why would I want 2 step (Score:5, Insightful)
You really think they don't have it already?
That's... cute.
Re: Why would I want 2 step (Score:4, Insightful)
Perhaps so, but do consider this : if you have say a hundred friends (a fair percentage of whom will be using android ) who have you in their contacts, ( not them in yours which ofcourse is under your control) , it would be trivial for Google to know your contact number with a high level of certainty
Re: (Score:1)
Call logs are the real problem though. Every call Google Play Equipped phones make, every call that comes in, Google also has a record of that.
That, combined with other people's address book, gives them all they need.
Not that they'll ever get my phone number Willingly either.
Re: (Score:2)
nope, they do not transfer call logs to their servers. If they do, it would be rather new and a reason to sue them.
Re: (Score:2)
Ok...how about this... Do you do business with any companies that have your name and number? Have you ever had to hire some sort of service provider for a utility or home infrastructure (ie plumbing, electrical, HVAC, etc)? Have you ever placed an order for some part or device that was not kept on-site that you were required to provide a contact number for?
No one has 100 real friends. Just about everyone in modern society has at least 100 people that maintain you on their contact list. Out of those 100
Nobody has a hundred friends? (Score:5, Insightful)
Re: (Score:2)
So you don't know anyone then? I know with 100% certainty that Google knows the phone number of every contact I've ever put in my phone and it's attached to their name and their most common email address, and all with zero option to opt in or out on their behalf.
That is a feature of Android as it is the feature of any messaging app, contacts organisers (gmail), or social media apps Google has ever released.
They know your number. Get over it.
Re: (Score:2)
if you are on android they do....
How could they? (Score:2)
I have no phone!
Re: (Score:2)
Re: (Score:2)
No sim card... Or do you mean I should get a hangouts phone number and get SMS that way? That kinda puts me in a weird authentication loop
Re: (Score:2)
Re: (Score:2)
Oh :) Thanks never looked into it, I will now! Hope that will stop them asking me to enter a phone number about every 10 times I log into the web client
Re:Why would I want 2 step (Score:4, Informative)
Re: (Score:2)
Right. And when I get a new phone then I no longer have what I had and I can't log into Google anymore. I never turned on this feature anyway because for a very long time I explicitly disabled texts. Is there an equivalent to password resets, a "I lost my dongle" button to click?
Re: (Score:2)
And when I get a new phone then I no longer have what I had and I can't log into Google anymore.
Get a new phone, change your set up. Shouldn't be an impossible situation. Unless, of course, you have a problem with change.
I never turned on this feature anyway because for a very long time I explicitly disabled texts.
I was the same way until I got a data plan that provided unlimited texts.
Re: (Score:2)
There are emergency codes you print out and keep in a safe place in case you lose your phone. Or you can keep one of the fido tokens before as a spare, in case you lost your phone.
And two-factor runs completely without text messages if you use an app to generate the otp. It's a standard algorithm and it can work completely offline.
Re: (Score:2)
"What you have" in the case of a text message is your cellphone number, which we've seen companies port over to the hacker's phone with enough social engineering.
I stick to google authenticator, and avoid using the phone for browsing the web and getting it hacked.
Google Authenticator is what the article is talking about.
Re:Why would I want 2 step (Score:4, Informative)
And how exactly does it work if I do not have a cellphone?
Google recommends these security tokens in the US as an alternative.
https://support.google.com/accounts/answer/6103523?hl=en [google.com]
https://www.amazon.com/s/?field-keywords=%22FIDO%20U2F%20Security%20Key%22 [amazon.com]
Re: (Score:2)
Google recommends [FIDO] security tokens in the US as an alternative.
The page on support.google.com says this won't work with a web browser other than Chrome, such as if I'm testing my website's "Sign in with Google" functionality on other browsers (especially Firefox, Edge, and IE 11).
Re: (Score:2)
In addition to the other suggestions, Google uses a standard two-factor encryption protocol. You should be able to use any device, including a Desktop computer, that can run that code. I know there's a Python library.
Re: (Score:2)
And how exactly does it work if I do not have a cellphone?
You're funny. Someone on /. that doesn't have a cellphone. Yeah, right!
Software alternative: OTP (Score:2)
Another alternative is to use TOTP (Time-derived One-time password):
an ever changing code that is based on a hash, computed out of the current time (hence the ever changing) and a shared secret that only you and google know.
Only someone possessing the shared secret can compute the correct code for that time.
The secret itself is never sent on the wire, only the current-time code derived of the secret is.
You can find apps running on tons of other hardware if you don't own an Android nor an iPhone (or simply d
Re: (Score:1)
If you use Apple or Windows Phone, you probably want to avoid it... in fact, wrap your phone in a tinfoil case, just to be safe. If you use Android..... Google already has you phone number and this just makes 2-factor authentication far easier to use with no loss in security.
Re: (Score:3)
It's a security thing. If someone gets into my gmail account, they can reset the passwords for most of my accounts.
With two step, even if they have the password for my gmail account, they need a random number that google sends to my phone each time I (or someone) tries to log into my account.
My bank does this too.
Re: (Score:2)
I understand the sentiment but do you honestly believe that they don't already have it?
Re: (Score:2)
Re:Why would I want 2 step (Score:5, Insightful)
Re: (Score:3)
Actually, my phone number is one of the things I would most trust Google with. Unlike all that web data Google has on me, there are long established regulations that govern what an entity may and may not do with my phone number.
Don't be naive, Google will violate any "long established regulations", with impunity, whenever they want, to advance their core ADVERTISING business.
[citation needed]
How has Google run afoul of regulations governing mobile or wireline telephony? Right. They haven't. Given that they're Google, if they were going to behave in the manner you fear, they would have done so by now. They have not and they will not because there's nowhere near enough profit in telephony efforts compared to what they are already squeezing out of search, Android, Chrome, etc.
Re: (Score:3)
Re: (Score:1)
It stops people from "hacking" your account and making purchases against you. E.g. Sony do not have two factor authentication, and people regularly find someone guessing their password (or logged by LAN sniffers on compromised MS Windows machines). This account is likely to have payment details stored in Sony's system, just like fleabay, Amazon, Apple et al. Naughty hacker now logs in using your PSN details, "buys" tons of games, loads on to their console, and then reverts to their own account to play them.
Re: (Score:2)
Two step forces an attacker to go from passive harvesting to actively targeting people for attack. A list of brute forced passwords is useless against accounts that use 2FA. Without it, there is a good chance, the attacker will be able to find some accounts with the same or similar passwords.
Re:Why would I want 2 step (Score:4, Insightful)
I take it that a "Telephone Book" is a strange idea where you come from?
Yes, I know they don't usually do them for cell phones, but there isn't a really good reason why the notion should be outrageous or anything....
Re: (Score:2)
Re: (Score:2)
Two words: Password recovery.
Google forums are full of "clever" people who went from
And why on God's green earth would I want to give Google my telephone number?
to "why can't Google just text me a new password to my cell" without any transition....
I am not sur this is an improvement (Score:5, Interesting)
I like the current setup as it does not require my phone to have a data connection. Not everywhere I have a computer connected to the internet do I have wifi available. The app generating a code seems more flexible in my opinion.
Re: (Score:3)
For cases like that, you can get a U2F key. It is a USB dongle so no internet connection required.
Re:I am not sur this is an improvement (Score:5, Informative)
Re: (Score:2)
I would assume that the code entry option remains as a backup should you be unable to get a data connection.
Re: (Score:2)
I like the current setup as it does not require my phone to have a data connection. Not everywhere I have a computer connected to the internet do I have wifi available. The app generating a code seems more flexible in my opinion.
Why do you think the app won't also give you a code if you need it because you are offline? Blizzard, Microsoft (on Android, they use Google Auth or Authy on iOS weirdly enough), and LastPass all have push auth requests but give you the option to manually input the code if you need to. I'm sure Google will as well.
Re: (Score:2)
Re: (Score:2)
I like the current setup as it does not require my phone to have a data connection. Not everywhere I have a computer connected to the internet do I have wifi available. The app generating a code seems more flexible in my opinion.
Google is actually letting you choose from several different methods including " tapping a Security Key, by entering a verification code sent to their phone or, starting today, by approving a prompt like the one below that will pop up on their phone." So they are not requiring a data connection.
Ref: http://googleappsupdates.blogs... [blogspot.co.uk]
Oh joy - more clickthrough. (Score:1)
Let's face it: the IT industry has, intentionally or otherwise, pretty much trained users to just robotically click "Yes" and "I Accept" on eight trillion things they don't understand. And now we will have eight trillion and one, and security will be worse for it.
Re: (Score:2)
Re:Oh joy - more clickthrough. (Score:5, Insightful)
But how else am i going to watch tits.avi.scr.js.jpg.exe.com if I don't click Allow?!
BTW, how many more versions of windows will continue to "hide extensions for known file types"?
Re: (Score:3)
BTW, how many more versions of windows will continue to "hide extensions for known file types"?
I don't expect that to change in any future version of Windows. Here's a link to fix your problem.
http://windows.microsoft.com/en-us/windows/show-hide-file-name-extensions [microsoft.com]
Re: (Score:2)
BTW, how many more versions of windows will continue to "hide extensions for known file types"?
Before you complain about this ask yourself:
1) Did people know what a filetype was?
2) Did the rate of success for these attacks change dramatically as a result?
The most common infection vector for these types of files do NOT go through windows explorer. They are downloads complete with box asking if you want to open the file, or email attachments which show the file name in full. People were fooled before, people will continue to be fooled, and hiding or showing the file extension in an operating system doe
Re: (Score:1)
The point of this form of two-step authentication is that you prove that you have physical possession of the cellphone associated with the account in addition to the password for the account. Having to manually enter a code does not provide any additional security over tapping on the phone - you either have the phone or you don't. So you might as well do it in the most convenient way possible.
Re:Oh joy - more clickthrough. (Score:4, Insightful)
While I think this is a good idea... I can kind of understand what he's saying.
Imagine this:
1. Bad guys steal password
2. Bad guys go to gmail.com and enter password
3. Good guy receives notification that approval is needed for a login
4. So used to just clicking Approve for this notification the good guy clicks Approve... and the Bad guys are in.
That scenario couldn't happen with a pin code being sent... because the Bad guys would not receive the pin code and the Good guy wouldn't have anywhere to enter the pin code...
I agree that it's pretty boneheaded... but the point of the parent is that we're all so used to clicking OK/Approve (and we REALLY will be if every website requires this kind of authentication) that many normal people might accidentally click Approve for bad requests...
Re: (Score:3)
Re: (Score:2)
You don't when using Duo at least...
A Google App? (Score:1, Offtopic)
And how long do you think it'll take for the Bad Guys [tm] to invent their own "one-tap app", that will look and act exactly like Google's .. or worse, will be phished or sneaked into your system without your knowing, will act like your phone, and will transmit everything it discovers to its real owners? Lessee, what is today .. Tuesday?
Re:A Google App? (Score:4, Insightful)
Perhaps I'm the only one (Score:5, Insightful)
But I don't find SMS two-factor with to be particularly burdensome. It's simple, it works, and it relies only on a de-facto standard method of communication that pretty much everyone already has access to - no vendor lock-in required.
Re: (Score:2)
My main problem with SMS two factor is that in order to do it, I need to tell them my phone number. This gives the service an unique ID.
I much more prefer a yubikey based solution, where the protocol is open and one can implement whatever one wants on the client side (including an app where you have to tap, or an usb stick you have to put into the computer, etc).
Re: (Score:1)
If you're using android (on a phone) then they have your mobile number. I think you need a phone number to sign up for any google service, don't you?
Re: (Score:3)
Maybe there's something I don't understand here because I grew up in a world where there was such a thing as a phone book which listed everyone's number, but ... do you really think Google doesn't already have your phone number?
Re: (Score:2)
Cost is a problem. SMS is insanely expensive for what it is, and millions of users generating millions of SMS messages a day adds up to a lot of money. It also has issues traversing borders and networks, which can end up costing you a lot of money if you receive texts while roaming abroad.
The rolling code system laid out in the RFC that Google implemented has none of those disadvantages, and the added advantage that it doesn't rely on the mobile network securing your message against eavesdropping. You also
Re: (Score:2)
"You don't have to use Google's app."
Even better, you CAN use Google's app. I'm looking into implementing secure authentication for a small project at work but I wasn't looking forward to having to write an app just for that. A bit of research and it turns out that I can just ask the end users to download Google's authenticator, Authy, or any of a bunch of apps, dongles, etc.
Re: (Score:2)
I wish RDP supported two factor auth.
Re: (Score:2)
Re: (Score:2)
Re: (Score:2)
Re: (Score:2)
Google's authenticator is just a front end for a standard two-factor scheme. It's simple, it works, it relies on an actual standard, and pretty much anyone who has access to a computing device, including a cheap dongle, can use it, on or off line. Plus it doesn't involve your phone company.
The encryption-based second factor is also good because anyone can implement it, for free, from random Slashdotter in his basement on up. Actually, anyone can use Google's authenticator app. Apparently even Microsoft
Re: (Score:2)
Oh, okay, it's not that big a hassle. It's only slightly more convenient, but I still like that. The Microsoft Authenticator already works that way (and is compatible with anything that can use the Google Authenticator), and I've found that it feels much faster and easier, even if the actual difference is pretty minor.
Re: (Score:2)
Re: (Score:2)
> I don't find SMS two-factor with to be particularly burdensome
I do. This year I spent my vacation on a boat. No phone signals. But, at the top of mast was a 4G dongle, so we had fast WiFi on board.
This summer, I'll spend two weeks in another remote location with little/no phone coverage - but plenty of wifi hotspots.
How do I access my email if I have WiFi, but no phone coverage to receive SMS?
At least I'll be able to get into GitHub - they let you use your prefered TOTP software one your own device. No SMS.
You use the authenticator app and use the code it gives you and enter it manually. Jesus this isn't an either/or. Every other push-auth app out there does this.
Re: (Score:2)
^^ this
And Google give you back-up codes to use, you do have them right?
Re: (Score:3)
True, but how often does THAT happen? Just like locks on your door 2 FFA isn't meant to be the holy grail. Its just another layer of security and a very formidable one at that.
Re: (Score:2)
LOL, Microsoft has been doing this for a long time already.
So has Duo Security. I wonder what this move by Google will do to their business model.
Re: (Score:2)
Duo's solution is awesome... even works perfectly with my Apple Watch! When I try to sign on to a website using Duo I get a message on my Watch that allows me to immediately approve the access... without getting out my phone or fumbling for a key-fob.
Can't wait to see this in action in other places! Hopefully Google will add this capability to Authenticator...
Re: (Score:2)
Re: (Score:2)
Simple: get a new email address only used for "important" logins: emails domain names, everything important to you.
Then stash the login credentials for that one away in a safe or something and hope the provider doesn't delete it because you almost don't use it.
Re: (Score:2)
Google Authenticator (Score:2)
Re: (Score:3)
Requires data (Score:4, Interesting)
It's useless if you don't have a data plan on your phone.
Re: (Score:2)
It's useless if you don't have a data plan on your phone.
Google is actually letting you choose from several different methods including " tapping a Security Key, by entering a verification code sent to their phone or, starting today, by approving a prompt like the one below that will pop up on their phone." So they are not requiring a data connection.
Ref: http://googleappsupdates.blogs... [blogspot.co.uk]
Re: (Score:2)
It's useless if you don't have a data plan on your phone.
That depends. I find every situation where I am able to access the internet on a PC I'm usually in range of free WiFi too.
Not to mention that the fallback of SMS still exists.
Worse security (Score:5, Insightful)
This is probably way worse security for the techno-illiterate.
Attacker enters password.
Clueless user gets notification, taps it.
Attacker is let in.
Whereas before it would be:
Attacker enters password.
Clueless user gets a number that they don't know what to do with
Attacker is not let in.
Re: (Score:2)
Obstacle (Score:2)
Ah yes.
That obstacle to logging in, making it impossible to access Google services if you do not carry your phone, lost it, it got stolen, the battery is empty, it crashed, it's out of coverage area.
Not sure how that can be made "less annoying".
Wish this standard were open... (Score:2)
Blizzard has similar functionality where the app will look at queued login attempts and ask for approval. Before that, it was IBM's ZTIC which was one of the first 2FA systems which did this.
I wish this were open source, just like TOTP is right now. I use a third party application that allows me to sync my 2FA codes (encrypted, of course) among my devices, including my Linux boxes, and my NAS machines. Having the ability to just tap "approve" for SSH connections would be nice, but it likely would require
Re: (Score:2)
Aweseome With Smart Watches! (Score:2)
If they implement this properly it will be awesome with smartwatches!
My school uses 2FA through a company called Duo and anytime I go to log in to a school website a notification pops up on my Apple Watch and I just need to touch "Approve" and I'm in. No fumbling for my phone or a key-fob... it's instant and convenient... takes all of the pain out of 2FA.
Re: (Score:2)
This requires your phone to have been recently unlocked, so you can't just steal someones phone. If it hasn't been recently unlocked, it makes you enter your unlock code.
Re: Aweseome With Smart Watches! (Score:2)
Not that I can tell... do you have some documentation stating that?
Do not want (Score:2)
Slashdot is finally hearing about old news (Score:2)
I've been doing this for months. I'm sure the service has been available for much longer.
I want this for servers (Score:2)
But without google.
Something like an android app and some web service coupled with a pam module. The login prompt then displays a number, the app displays the number as well and i can accept the login from the app with a single tap. Fallback to normal google authenticator.
Re: (Score:2)
There are more than just Google's app for authentication. Amazon has similar, and there are a number of third party alternatives, some with dark themes.
Re: (Score:2)