News for hackers. Stuff that matters.

A comment on Listen to a SIM-Jacking, Account-Stealing Ransom. Parent comment

Re:Listen to a SIM-Jacking, Account-Stealing Ransom by chris_mc on Thursday October 11, 2018 @02:41PM (#18195991)
Google has a new account setting called Advanced Protection. All it accepts is two hardware U2F keys (primary and backup) and your password. It supposedly makes your Google account pretty hardened. The only issue is that you can only use Chrome with U2F keys right now because Firefox U2F isn't fully baked yet.

I'm using it with the Titan keys (they're not my favorite, but work) and it works pretty well. I can't do as much 3rd party stuff, but I only keep my Google account (right now) for my old email address that's already forwarded to my new email address, Google Music, and Google Pay, so that doesn't affect me much. If you use a lot of 3rd party apps or get your mail via IMAP and the like, it's going to be more difficult.

A weird thing is that Google doesn't seem to allow for U2F key use without Advanced Protection turned on, which is puzzling to me.

[ Parent | on HN ]
Re:Listen to a SIM-Jacking, Account-Stealing Ransom by cmg on Thursday October 11, 2018 @06:11PM (#18197439)
For what it's worth, I use a U2F key regularly with Firefox. Just enable the security.webauth.u2f flag under about:config. I realize that's not a good solution for everyone, but if you're just looking to do it for yourself it works.
[ Parent | on HN ]
Re:Listen to a SIM-Jacking, Account-Stealing Ransom by chris_mc on Thursday October 11, 2018 @08:57PM (#18198292)
You know, I figured out what the problem was and it works now. I had setup FF Sync on a PC that didn't have U2F turned on yet.
[ Parent | on HN ]
Re:Listen to a SIM-Jacking, Account-Stealing Ransom by crazysim on Thursday October 11, 2018 @04:46PM (#18196908)
Weird, I have U2F keys in my non-Advanced Protection account.
[ Parent | on HN ]
Re:Listen to a SIM-Jacking, Account-Stealing Ransom by chris_mc on Thursday October 11, 2018 @08:54PM (#18198278)
Maybe I was looking in the wrong place, good to know, thanks.
[ Parent | on HN ]