News for hackers. Stuff that matters.
Re:Adding a security key to Gmail by orbitingpluto on Thursday April 13, 2017 @02:45AM (#14104676)
Didn't it change the web page on your computer browser after you successfully added it into Google Authenticator?

I suppose you could always take a photo of the QR code and then rescan that. Text seems simpler.

edit: Anyone else remember this behavior? Old version? Browser specific?

Re:Adding a security key to Gmail by hdhzy on Thursday April 13, 2017 @02:53AM (#14104718)
It changes when you input current code. You can scan it multiple times, print it, and then input the code from one of your devices.
Re:Adding a security key to Gmail by captn3m0 on Thursday April 13, 2017 @04:13AM (#14105093)
Also, if you have a rooted device, you can get the original secret from the SQLite database of the authenticator app.
Re:Adding a security key to Gmail by garethadams on Thursday April 13, 2017 @05:57AM (#14105513)
"can get the original secret" is a phrase which should worry a security-conscious person
Re:Adding a security key to Gmail by lorenzhs on Thursday April 13, 2017 @07:14AM (#14105833)
rooting their phone is not something a security-conscious person would do, either.

Edit: maybe I should have explained my position. There are a few security issues with rooting a phone, e.g.:

- rooting usually requires unlocking the bootloader. Once it's unlocked, anyone can flash or boot a custom recovery and modify your system partition. Enrolling your own keys in the recovery and re-locking the bootloader, while possible, is an undocumented and complex process that just about nobody uses, see https://mjg59.dreamwidth.org/31765.html . You're also screwed if a system update replaces the recovery. Once the bootloader is unlocked, anyone with physical access to your phone can mess with your system in malicious ways.

- it circumvents the system's permission model. A malicious app that tricks the user into granting it root rights (maybe for a legitimate reason) could access information it shouldn't have, install a keylogger, etc.

Re:Adding a security key to Gmail by tokenizerrr on Thursday April 13, 2017 @06:21AM (#14105616)
Even without root. Just run a backup and extract it from that. You can do it with just adb or helium.
Re:Adding a security key to Gmail by jeffreyparker on Thursday April 13, 2017 @09:54AM (#14106872)
That doesn't work for Google Authenticator. Apps can opt-out of being able to be backed up, which even prevents adb/helium backups (unless you're rooted).