7 ms·

Google's 2FA is very frustrating to say the least. The forced use of a mobile device with a Google app installed as my primary 2FA device is nothing if not anno

by spsful 5y ago

Google's 2FA is very frustrating to say the least. The forced use of a mobile device with a Google app installed as my primary 2FA device is nothing if not annoying-- I already have 1Password set up in the browser to autofill 2FA codes. Google doesn't seem to like this because after sign in I always have to wait for the prompt saying "open the google app on your phone", then scroll down and click "try a different way" and THEN click a selection to enter a 2FA code. Very very frustrating.

omegalulw 5y ago
> I already have 1Password set up in the browser to autofill 2FA codes The whole point of 2FA is to have "2" independent pieces of data to verify logins. Gating 2FA behind a single password defeats the point.
- andrewaylett 5y ago
  My password manager requires a hardware token to log in. So now the second factor is "has a device I've logged into my password manager with, or the hardware token for the password manager".
  - seoulmetro 5y ago
    Which isn't something you have. It's something you know, gated behind something you have.
- TacticalCoder 5y ago
  > The whole point of 2FA is to have "2" independent pieces of data to verify logins. Gating 2FA behind a single password defeats the point. Indeed. It's also why I think U2F should be mandatory in way more places/sites/companies (it is in some, thankfully): you then need to physically have a Yubikey or similar and it's not possible anymore to trade security for convenience. It doesn't solve all security issues, but it's already a great step forward. When you let people the choice, they'll pick the lazy, insecure, way.
- fragmede 5y ago
  Two passwords - a master password, and a secret key. That secret key comprises the phone or laptop with 1password configured being the "something you have" for MFA because it's basically the same as the TOTP seed value/QR code - that secret key is only used by the user when setting up a new device - similar to when a new TOTP MFA is set up.
  - seoulmetro 5y ago
    That's not how MFA works. Chaining just increases vulnerability.
dannyw 5y ago
That sounds like design decisions for optimising the 2FA experience for the vast majority of users, who don't want to mess with Google Authenticator or their password manager _is_ Google (Chrome).
cageface 5y ago
My parents are low tech and don’t have cellphones. I guess they’re going to have to get a call on their landline now every time they have to 2fa?
- wstrange 5y ago
  My Dad is in the same boat. What about a Titan/yubikey? They are fairly easy to use - although you might have to help your parents with enrollement.
- 14 5y ago
  I am curious about this as well parents in the same position. What happens now?
- throw63738 5y ago
  low tech, but with google account?
  - cageface 5y ago
    Yeah they can barely manage email. I've taught them how to forward email a dozen times but that's a bridge too far for them.
- fragmede 5y ago
  Others have mentioned a desktop app, but how often do your parents have to 2fa? It's not every time they log in (unless they're buying a new burner laptop every time they log in. If they are, there may be other issues to discuss first.)
  - cageface 5y ago
    I've found Google asks for 2fa at pretty random times. I do travel a lot but still it happens at least once a month.
- closetohome 5y ago
  Google discontinued the "read you a number over a landline" feature a little while back and only supports texting now.
k8sToGo 5y ago
Security often comes at the cost of convenience.
- DoingIsLearning 5y ago
  False dichotomy, these issues would be gone if google provided any meaningful customer service for edge cases. You can fill forms and feedback but I have never heard of free users ever getting as much as a reply back.
seoulmetro 5y ago
1Password isn't really multi factor authentication though. Google doing it properly should not upset you this much.
cletus 5y ago
I use a password manager myself (as IMHO everyone should). It's not ideal because if your master password gets compromised it's potentially catastrophic in away that any individual getting compromised isn't. The problem with 1Password 2FA is, I believe, that the 2FA itself is still gated behind your master password, in that if that gets compromised so does your supposed 2FA. The central idea of 2FA is it's something you know and something you have. If that 1Password master password is the only thing needed to gain access then you don't really have 2FA. Again, I don't use this feature of 1Paswword so this might not be exactly how it works. But if so, I'm sympathetic to Google not treating it as 2FA because, well, it isn't.
- fsflover 5y ago
  > It's not ideal because if your master password gets compromised it's potentially catastrophic in away that any individual getting compromised isn't. If you care about this, consider security through compartmentalization provided by Qubes OS. I store my passwords in plain text in an offline VM (with hardware virtualization).
  - jfrunyon 5y ago
    There are vulnerabilities disclosed in VMs and containers almost weekly.
    - fsflover 5y ago
      None of which affect VT-d hardware virtualization in a meaningful way [0]. [0] https://www.qubes-os.org/security/xsa/ https://www.qubes-os.org/security/xsa/
      - deleted 5y ago
        [deleted]
- joshstrange 5y ago
  I know 2FA is often described in this way but it's not the way I really use it or how your average person wants to use it IMHO. It's just a second piece of data that is needed to login, which does add significant security. Maybe I just don't oversee anything important enough but I don't actually want my digital security to be dependent on a single piece of hardware ever. Yes, I know about backup codes but where are you going to store those if not 1Password/alternative-manager? So for me I'm perfectly happy to keep my 2FA alongside my password in 1Password. As for "If that 1Password master password is the only thing needed to gain access then you don't really have 2FA." it's not, unless they get access to a device you have logged into 1Password on in the past (and thus entered your secret key [0]). For me this stays true enough to "something I have". If someone has my phone/computer AND can guess my 1Password master password then things are already pretty bleak and they already have access to whatever other 2FA app I was using (Authy/GA). Lastly 2FA falls apart if you share an account with a significant other (or a team). In 1Password I can just move that login to a shared vault or share that login individually and everyone can log in and use 2FA. I'm not sure what the alternative would be. Sure, if a product supports multiple accounts or even multiple 2FA's (I don't think I've ever seen the latter, at least in non-enterprise settings) there is a way to do this but most apps/SaaS/etc there isn't an alternative (other than disabling 2FA). [0] https://support.1password.com/secret-key/ https://support.1password.com/secret-key/
ABS 5y ago
FWIW I've been using Authy for all my 2FA for years, including Google's, without any issues
- dazc 5y ago
  And authy has a desktop app too, which makes it much more convenient.
  - PikachuEXE 5y ago
    Authy desktop app doesn't show some entries for me though. Dunno why
  - EVa5I7bHFq9mnYK 5y ago
    The whole point of 2FA is that 2 devices need to be compromised - your phone AND your computer. With desktop Authy only one device - your computer - needs to be compromised.
    - dazc 5y ago
      This is correct but, in the vast majority of cases, attacks are carried out remotely. I would agree that where third parties have access to your machine, it would be not be a good solution.
      - EVa5I7bHFq9mnYK 5y ago
        If someone controls your computer remotely, it's the same as if she controlled it physically, no difference from pownership point of view.
ramesh31 5y ago
You can always use SMS 2FA
- latchkey 5y ago
  Please, no. https://en.wikipedia.org/wiki/SIM_swap_scam https://en.wikipedia.org/wiki/SIM_swap_scam
  - bduerst 5y ago
    There are services that have safeguards in place against sim swapping, coincidentally one of them is Fi: https://support.google.com/fi/answer/9834243?hl=en https://support.google.com/fi/answer/9834243?hl=en
    - zrm 5y ago
      Apparently the safeguards consist of using a non-SMS method of 2FA. Maybe just do that in the other case too.
    - latchkey 5y ago
      While I'm sure that Fi and Google Voice are better than almost any other carrier based SMS security, this does nothing to convince me to ever use SMS 2FA. "Your Fi number is tied to your Google Account." -- I'm sure you've seen cases of people's google accounts being randomly locked for no reason. Now you lose access to make a call too! The last thing I'd ever trust security to is SMS. Lots of good technical details here: https://lucky225.medium.com/its-time-to-stop-using-sms-for-anything-203c41361c80 https://lucky225.medium.com/its-time-to-stop-using-sms-for-a...
      - bduerst 5y ago
        No matter what cellular service you use, you run a risk of being flagged as a false positive for fraud locks (irrespective of SIM swaps). If a SIM swap scam is happening and your account is locked, it is incredibly unlikely they'll be able to swap it out.
  - 5y ago
psanford 5y ago
Huh. My google account shows Security Keys as the default 2fa option. When I login it goes straight to the security key prompt.
mattmcknight 5y ago
If you are working in facility where you can't have a mobile phone nearby, it is incredibly frustrating. Sure, just print out a long list of codes every week.
bradfa 5y ago
I've used a U2F dongle for my 2FA with Google for a few years. I've been enrolled in the Google Advanced Protection program for a while. I don't have any issues around Google logins, just plug in my U2F dongle and press the button or hold the dongle near my phone for NFC to do its magic. Another benefit is that I'm much less likely to lose my U2F dongle as it's on my physical keychain (and has been, for years, without damage) than I am to need to replace or wipe my phone (although a password manager with 2FA codes in it also avoids this).
- bradfa 5y ago
  For anyone who says, "But what if $WORKPLACE doesn't allow you to plug in USB dongles or use NFC!?!" my counter is then maybe you shouldn't be logging into your personal Google account on that PC. And you probably have an IT department who already have a solution for 2FA that you're required to use.
  - CogitoCogito 5y ago
    This is quite a flippant response. These requirements are being put in place against (some) users' will. Simple changing email providers isn't exactly easy and maybe they need to access that account. Maybe Google should allow users to turn this off?
  - tialaramex 5y ago
    Also, just because you aren't allowed to plug in "USB dongles" such as flash drives, does not mean FIDO authenticators [the things needed to make WebAuthn or its predecessor U2F work] won't work. A FIDO authenticator is actually a USB HID class device, like a keyboard‡. So, if your $WORKPLACE doesn't allow you to plug in keyboards then, OK, I guess maybe a FIDO dongle isn't worth trying, but few people are in that situation. If your employer has a policy of specifically issuing and authorising only particular devices (e.g. you can pick from a list of 3 Dell branded keyboards and 2 Logitech keyboards and anything else needs HR director override) then seems like it's time for them to authorise and issue a nice high quality FIDO authenticator. Yubico make some eye-wateringly expensive models, maybe they should pick those. ‡ "Like" a keyboard but it isn't a keyboard. The FIDO protocols don't involve keypresses, the device is just HID class because well, it's a Human Interface Device, seems legit. It sets protocol to 0xFF custom, and needs dedicated software to use that, which is fine.
shoto_io 5y ago
FWIW, you could use a different app, other than Google's. For example, you could use an app called Authy or the Microsoft authenticator app. Then AT LEAST, the app is outside the Google network.
junon 5y ago
One alternative (though it's absurd it has to be this way) is to use two separate google accounts - one for your phone, one for everything else. It actually solves a few invasive/dark patterns Google employs.

by spsful 5y ago

omegalulw 5y ago

> I already have 1Password set up in the browser to autofill 2FA codes The whole point of 2FA is to have "2" independent pieces of data to verify logins. Gating 2FA behind a single password defeats the point.

andrewaylett 5y ago
My password manager requires a hardware token to log in. So now the second factor is "has a device I've logged into my password manager with, or the hardware token for the password manager".
- seoulmetro 5y ago
  Which isn't something you have. It's something you know, gated behind something you have.
TacticalCoder 5y ago
> The whole point of 2FA is to have "2" independent pieces of data to verify logins. Gating 2FA behind a single password defeats the point. Indeed. It's also why I think U2F should be mandatory in way more places/sites/companies (it is in some, thankfully): you then need to physically have a Yubikey or similar and it's not possible anymore to trade security for convenience. It doesn't solve all security issues, but it's already a great step forward. When you let people the choice, they'll pick the lazy, insecure, way.
fragmede 5y ago
Two passwords - a master password, and a secret key. That secret key comprises the phone or laptop with 1password configured being the "something you have" for MFA because it's basically the same as the TOTP seed value/QR code - that secret key is only used by the user when setting up a new device - similar to when a new TOTP MFA is set up.
- seoulmetro 5y ago
  That's not how MFA works. Chaining just increases vulnerability.

dannyw 5y ago

That sounds like design decisions for optimising the 2FA experience for the vast majority of users, who don't want to mess with Google Authenticator or their password manager _is_ Google (Chrome).

cageface 5y ago

My parents are low tech and don’t have cellphones. I guess they’re going to have to get a call on their landline now every time they have to 2fa?

wstrange 5y ago
My Dad is in the same boat. What about a Titan/yubikey? They are fairly easy to use - although you might have to help your parents with enrollement.
14 5y ago
I am curious about this as well parents in the same position. What happens now?
throw63738 5y ago
low tech, but with google account?
- cageface 5y ago
  Yeah they can barely manage email. I've taught them how to forward email a dozen times but that's a bridge too far for them.
fragmede 5y ago
Others have mentioned a desktop app, but how often do your parents have to 2fa? It's not every time they log in (unless they're buying a new burner laptop every time they log in. If they are, there may be other issues to discuss first.)
- cageface 5y ago
  I've found Google asks for 2fa at pretty random times. I do travel a lot but still it happens at least once a month.
closetohome 5y ago
Google discontinued the "read you a number over a landline" feature a little while back and only supports texting now.

k8sToGo 5y ago

Security often comes at the cost of convenience.

DoingIsLearning 5y ago
False dichotomy, these issues would be gone if google provided any meaningful customer service for edge cases. You can fill forms and feedback but I have never heard of free users ever getting as much as a reply back.

seoulmetro 5y ago

1Password isn't really multi factor authentication though. Google doing it properly should not upset you this much.

cletus 5y ago

I use a password manager myself (as IMHO everyone should). It's not ideal because if your master password gets compromised it's potentially catastrophic in away that any individual getting compromised isn't. The problem with 1Password 2FA is, I believe, that the 2FA itself is still gated behind your master password, in that if that gets compromised so does your supposed 2FA. The central idea of 2FA is it's something you know and something you have. If that 1Password master password is the only thing needed to gain access then you don't really have 2FA. Again, I don't use this feature of 1Paswword so this might not be exactly how it works. But if so, I'm sympathetic to Google not treating it as 2FA because, well, it isn't.

fsflover 5y ago
> It's not ideal because if your master password gets compromised it's potentially catastrophic in away that any individual getting compromised isn't. If you care about this, consider security through compartmentalization provided by Qubes OS. I store my passwords in plain text in an offline VM (with hardware virtualization).
- jfrunyon 5y ago
  There are vulnerabilities disclosed in VMs and containers almost weekly.
  - fsflover 5y ago
    None of which affect VT-d hardware virtualization in a meaningful way [0]. [0] https://www.qubes-os.org/security/xsa/ https://www.qubes-os.org/security/xsa/
    - deleted 5y ago
      [deleted]
joshstrange 5y ago
I know 2FA is often described in this way but it's not the way I really use it or how your average person wants to use it IMHO. It's just a second piece of data that is needed to login, which does add significant security. Maybe I just don't oversee anything important enough but I don't actually want my digital security to be dependent on a single piece of hardware ever. Yes, I know about backup codes but where are you going to store those if not 1Password/alternative-manager? So for me I'm perfectly happy to keep my 2FA alongside my password in 1Password. As for "If that 1Password master password is the only thing needed to gain access then you don't really have 2FA." it's not, unless they get access to a device you have logged into 1Password on in the past (and thus entered your secret key [0]). For me this stays true enough to "something I have". If someone has my phone/computer AND can guess my 1Password master password then things are already pretty bleak and they already have access to whatever other 2FA app I was using (Authy/GA). Lastly 2FA falls apart if you share an account with a significant other (or a team). In 1Password I can just move that login to a shared vault or share that login individually and everyone can log in and use 2FA. I'm not sure what the alternative would be. Sure, if a product supports multiple accounts or even multiple 2FA's (I don't think I've ever seen the latter, at least in non-enterprise settings) there is a way to do this but most apps/SaaS/etc there isn't an alternative (other than disabling 2FA). [0] https://support.1password.com/secret-key/ https://support.1password.com/secret-key/

ABS 5y ago

FWIW I've been using Authy for all my 2FA for years, including Google's, without any issues

dazc 5y ago
And authy has a desktop app too, which makes it much more convenient.
- PikachuEXE 5y ago
  Authy desktop app doesn't show some entries for me though. Dunno why
- EVa5I7bHFq9mnYK 5y ago
  The whole point of 2FA is that 2 devices need to be compromised - your phone AND your computer. With desktop Authy only one device - your computer - needs to be compromised.
  - dazc 5y ago
    This is correct but, in the vast majority of cases, attacks are carried out remotely. I would agree that where third parties have access to your machine, it would be not be a good solution.
    - EVa5I7bHFq9mnYK 5y ago
      If someone controls your computer remotely, it's the same as if she controlled it physically, no difference from pownership point of view.

ramesh31 5y ago

You can always use SMS 2FA

latchkey 5y ago
Please, no. https://en.wikipedia.org/wiki/SIM_swap_scam https://en.wikipedia.org/wiki/SIM_swap_scam
- bduerst 5y ago
  There are services that have safeguards in place against sim swapping, coincidentally one of them is Fi: https://support.google.com/fi/answer/9834243?hl=en https://support.google.com/fi/answer/9834243?hl=en
  - zrm 5y ago
    Apparently the safeguards consist of using a non-SMS method of 2FA. Maybe just do that in the other case too.
  - latchkey 5y ago
    While I'm sure that Fi and Google Voice are better than almost any other carrier based SMS security, this does nothing to convince me to ever use SMS 2FA. "Your Fi number is tied to your Google Account." -- I'm sure you've seen cases of people's google accounts being randomly locked for no reason. Now you lose access to make a call too! The last thing I'd ever trust security to is SMS. Lots of good technical details here: https://lucky225.medium.com/its-time-to-stop-using-sms-for-anything-203c41361c80 https://lucky225.medium.com/its-time-to-stop-using-sms-for-a...
    - bduerst 5y ago
      No matter what cellular service you use, you run a risk of being flagged as a false positive for fraud locks (irrespective of SIM swaps). If a SIM swap scam is happening and your account is locked, it is incredibly unlikely they'll be able to swap it out.
- 5y ago

psanford 5y ago

Huh. My google account shows Security Keys as the default 2fa option. When I login it goes straight to the security key prompt.

mattmcknight 5y ago

If you are working in facility where you can't have a mobile phone nearby, it is incredibly frustrating. Sure, just print out a long list of codes every week.

bradfa 5y ago

I've used a U2F dongle for my 2FA with Google for a few years. I've been enrolled in the Google Advanced Protection program for a while. I don't have any issues around Google logins, just plug in my U2F dongle and press the button or hold the dongle near my phone for NFC to do its magic. Another benefit is that I'm much less likely to lose my U2F dongle as it's on my physical keychain (and has been, for years, without damage) than I am to need to replace or wipe my phone (although a password manager with 2FA codes in it also avoids this).

bradfa 5y ago
For anyone who says, "But what if $WORKPLACE doesn't allow you to plug in USB dongles or use NFC!?!" my counter is then maybe you shouldn't be logging into your personal Google account on that PC. And you probably have an IT department who already have a solution for 2FA that you're required to use.
- CogitoCogito 5y ago
  This is quite a flippant response. These requirements are being put in place against (some) users' will. Simple changing email providers isn't exactly easy and maybe they need to access that account. Maybe Google should allow users to turn this off?
- tialaramex 5y ago
  Also, just because you aren't allowed to plug in "USB dongles" such as flash drives, does not mean FIDO authenticators [the things needed to make WebAuthn or its predecessor U2F work] won't work. A FIDO authenticator is actually a USB HID class device, like a keyboard‡. So, if your $WORKPLACE doesn't allow you to plug in keyboards then, OK, I guess maybe a FIDO dongle isn't worth trying, but few people are in that situation. If your employer has a policy of specifically issuing and authorising only particular devices (e.g. you can pick from a list of 3 Dell branded keyboards and 2 Logitech keyboards and anything else needs HR director override) then seems like it's time for them to authorise and issue a nice high quality FIDO authenticator. Yubico make some eye-wateringly expensive models, maybe they should pick those. ‡ "Like" a keyboard but it isn't a keyboard. The FIDO protocols don't involve keypresses, the device is just HID class because well, it's a Human Interface Device, seems legit. It sets protocol to 0xFF custom, and needs dedicated software to use that, which is fine.

shoto_io 5y ago

FWIW, you could use a different app, other than Google's. For example, you could use an app called Authy or the Microsoft authenticator app. Then AT LEAST, the app is outside the Google network.

junon 5y ago

One alternative (though it's absurd it has to be this way) is to use two separate google accounts - one for your phone, one for everything else. It actually solves a few invasive/dark patterns Google employs.