News for hackers. Stuff that matters.
Re:Bye, Bye, Google by Bogdanp on Monday February 04, 2019 @05:09AM (#19075151)
I never used Google Authenticator. Instead, I use 1Password's 2FA functionality.
Re:Bye, Bye, Google by tonyedgecombe on Monday February 04, 2019 @05:32AM (#19075230)
Don't you loose the benefit of 2FA then, an adversary only needs to obtain your 1Password password.
Re:Bye, Bye, Google by bubblethink on Monday February 04, 2019 @05:28AM (#19075207)
Not a great idea to combine your first factor and second factor in the same place.
Re:Bye, Bye, Google by ggm on Monday February 04, 2019 @05:41AM (#19075259)
Backup codes and then the protection is against illegal SMS porting which is a social engineering attack hard to otherwise defeat. Your phone is fulfilling a different function and yes it does collapse both factors onto one device but the primary risk wasn't loss of phone, it was weak password and no variant second factor and then porting attacks on SMS.
Re:Bye, Bye, Google by bubblethink on Monday February 04, 2019 @05:52AM (#19075309)
I didn't understand the point your are making. I'm referring to the overall attack surface area of apps like 1password (which I think also have browser extensions ?). TOTP is better than sms, but why put it in the same app as your password ?
Re:Bye, Bye, Google by ggm on Monday February 04, 2019 @02:25PM (#19079745)
You have to ask yourself what's the primary threat. Yes,the point in strong sense of a second factor is a fully independent test. But the actual threat it mostly protects against is credentials threats. Not loss of devices or compromise of a keystore. SMS as second factor is way way worse because of the porting problem. Otp inside 1password is a compromise but it protects against the primary threat.

If you crypt your disk and use a good passphrase or a long pin and passphrase on a phone you are not that badly exposed.

Re:Bye, Bye, Google by howdy-yall on Monday February 04, 2019 @06:55AM (#19075570)
I too replaced Google Authenticator with 1Password, for much the same reasons. The Google Analytics tracker in 1Password is concerning though.