What happened to me is that I went to reset my password one day, and they required I confirm my backup email which I no longer had access to.
Even though I had access to read messages sent to the gmail account itself, and I had access to the phone number connected to my gmail account, without my backup email as well, I could not get anywhere. The recovery procedure that asks you questions didn't get me anywhere either, because I couldn't possibly answer things like exactly when I started using gmail due to using it for too long. And I even had an archive of a few years of my email, that ought to have enabled me to answer the other questions, but it didn't work and there is no feedback nor escalation procedure.
I may well still be logged in due to a certain buggy/obsolete device I have; I think it's probably been five years, but I don't believe I will ever be able to log in or reset my password again.
It didn't have a great deal of impact on my life in the sense that I was able to simply switch to a new email account, but I feel a certain sense of loss at not being able to use the one and only address that was my full name. More significantly, it indelibly engraved in my mind, the kafkaesque, diabolical nature of Google, the ingrained lack of customer service, the way in which, while they may mostly be geniuses, when they screw up, they won't admit it and there's no appeal.
The thing that I object to on an emotional and logical level, is that adding a backup authentication method removed the ability to use the primary authentication methods. If I just never added the backup email I'd be fine! I can't accept that makes sense, that it adds security. Something the user does to make them safer should not make them less safe.
Around the same time my old phone broke and i had to change the password.
I must have mistyped the password while changing it in both fields and since then have never managed to re-access the account. I have old passwords, backup email, previous contacts, phone, ... But i cant restore the password because i hadnt yet set up authenticator on my new phone.
My fault? Probably. But that there's no way out, no option beyond the horrible restore wizard - that's Google's irresponsibility. How many millions must have lost access to their gmail accounts by now?
If someone hacks your phone they have access to all your email, whether you have 2fa set up or not. If someone hacks your computer in this case then they also get access to all your email.
The thing that 2fa is good at is preventing hackers from logging in if they guess or find out your password. If your device is compromised then everything you do on it is vulnerable, no matter how many factors you have.
It prevents from someone, somewhere, having your password but not your 2nd factor.
It's incorrect to take these measures as giving perfect security. They're efforts to greatly increase the cost for attackers. It's a pretty good improvement to increase effort from "having a password" to "having remote access to your computer."
AndOTP has some support for SteamGuard (though not everything), which I can't use since I refuse any proprietary app on my phone.
I wish websites supported PAKE, Fido U2F, Webauthn, TOTP and Client certs across the board, but that's probably a pipe dream :)
Maybe try again. :)
One thing to note is that I was unable to access an old account for so long that it no longer has any old email in it.
I don't think my earliest emails are available at all, I may well have deleted them, but even if they were, the device that remained logged in is over a decade old, uses POP or IMAP or something and barely functions. Not the gmail web interface, that's out of reach.
I wonder if signing up for Google One, which apparently comes with support, would possibly get access to a real person who could resolve the issue?
Also, anyone who still can should print out Google backup codes and store them somewhere safe. Google Authenticator is not enough, because phones break eventually. A Yubikey is not enough, because they can break too.
The 2fa set up process for many websites (and iirc Google too) do not make this a priority. They should clearly emphasize the importance of saving the backup codes, and make you check a box that says you printed them. The 2fa should not be enabled until that is done.
- The inconsistent, chaotic patchwork of ID systems is more resilient than a monoculture, and definitely more resilient than a centralized solution.
- The gaps provide necessary cover for people who need to hide.
- Doubt usually plays in the little guy's favor. The bank eats the loss when it can't prove the debt is yours. Copyright lawsuit fails when it could have been anyone at that IP address.
- The difficulty of strong ID verification is what keeps it from being used gratuitously. A PKI or SSO provider that's too good will soon be required for every little thing.
- Customer identity is something a business should own, not rent.
This can be done in a decentralized manner where people host their identity. For example, for email you can buy a domain name and set the DNS MX record to point to whichever email server you want to receive email at. For identity you could have a DNS record with a public key, and then use your private key to generate random signed identities for every website. Obviously that's a bit out of reach of normal people, but it can be implimented without too much complexity. And inevitably it'll get pretty centralized for 90% of people, just like 90% of people use a @gmail.com email address, but the option will still be there for those who need it.
- SSN is great and works well for everything.
It turns out that you can completely centralize ID and authentication, provided you have a government which is mercilessly willing to violate your privacy...
It's a very US-Centric view of the world.
otpauth://totp/Domain%3Ayour%40email.com?secret=HXDMVJECJJWSRB3H&issuer=Domain
That "secret" field is the only thing that TOTP actually cares about, and any app that supports TOTP will happily ingest the secret and provide 2FA codes.
I grab all my QR codes or secrets, but I store them in 1Password so they're strongly encrypted in my backups.
(Just so I'm not misunderstanding something.)
Qubes OS maybe a good idea here -- isolated VMs. (One VM for the pwd manager)
Additionally it has support for Steam and Blizzard TOTP secrets. Though they aren't straightforward to use, its nice having them on one app.
This also helps if you want to use YubiKey TOTP support. Grab the keys, and then set them up on multiple sticks. If you lose a stick, you need to rotate, but if you say accidently snap one in half (yes, I've don't this).
Fido2 is better, but for sites that don't support it, I use this to make TOTP sites almost as secure.
How do you download and decode?
Any Linux software tips?
And how do you verify and double check you did it right? (Saved the exact correct code)
Verifying that I did it right: I manually enter the secret into a tool that can produce TOTP codes and verify that Google Authenticator and my backup are producing the same one-time passwords.
Agreed. The worst part, in my opinion, is the penchant of sites/providers to demand a phone number any phone number as an identity mechanism.
Which is to say, there is no way to tie this number I have just entered to my personal identity in any way, or to verify that it has any relationship with me ... but as long as I successfully enter any mobile number I pass with flying colors.
In the beginning it was just a password. Then it was a username + password. Then an email address was tacked on to support "forgot my password". Then phone number was added to support SMS-based 2FA (or, hopefully, out of band contact).
The problem is that only government IDs have a high enough assurance to reduce fraud, and our {companies, employees, consumers} seem to avoid wanting the government to be involved in internet-based identity/authentication. Having a chip used to sign encrypted messages in our government ID cards would both assure authentication and reduce all of the frictions added after the fact.
The sad part is that USA government institutions are woefully underprepared to support internet scale of adoption and the legacy services (like DMV and county/state government offices) aren't exactly known for their swift customer service (which would be required if you lose access to your government ID).
That type of "assurance" is really quite irrelevant to most authentication. Google doesn't need to know the name on your driver's license or your street address, only that you're the owner of this gmail account.
> Having a chip used to sign encrypted messages in our government ID cards would both assure authentication and reduce all of the frictions added after the fact.
Or you could have the same chip in a YubiKey and get the same result without the centralization or the privacy violation of having everything tied to the same identity without your consent.
> The sad part is that USA government institutions are woefully underprepared to support internet scale of adoption and the legacy services (like DMV and county/state government offices) aren't exactly known for their swift customer service (which would be required if you lose access to your government ID).
This is just more reason why it makes no sense to have the government involved.
It's not actually that hard to get a state-issued ID in someone else's name, especially for criminals who are willing to do things like pay off government employees, but even just for someone willing to forge documents.
The government can't use good cryptographic solutions to authenticate you in order to give you the card with the good cryptographic solutions because it's chicken and egg. But without that the security will always be weak.
Starting with a card which isn't associated with any "identity" to begin with and making the service you're using it to authenticate against your "identity" doesn't have that problem, because it isn't necessary to prove "identity" when you're opening the account to begin with (the account is then empty and contains nothing to compromise) and thereafter you can use the authentication method(s) configured when you opened your account.
But then the government wouldn't be doing anything but selling blank cards you could use to create identities with various services, and any private business could do that as well.
To hijack accounts at bulk, you also need to procure phone numbers in similar quantities. The cost of a phone number is low, but so is the value of the average hijacked account.
If you go post something on craigslist and show your phone number as a contact method, I guarantee you that you will soon get spammed by google 2FA notifications. Around me they seem to be primarily set to a Vietnamese language.
I live in the same city as the AT&T headquarters.
AT&T and Google could also have systems to help prevent these scams, for instance I could specify the languages I speak and if SMS messages arrive in a different language, they could allow me an SMS command to flag a sender as the trigger-er of the phishing attempt.
However, AT&T could also make a phone app for billing that loads menus in less than 30 seconds to a minute, and considering they've done neither I suppose I'll take the billing app first since it gets more use than craigslist does. After all, we only pay them 60 dollars a month for a phone and another 60-100 dollars a month for DSL for quite literally decades, so I wouldn't want to strain them by requesting too much in the way of a basic level of service.
It’s just not well-known enough on enough sites and services yet, but it exists and WebAuthN makes it easy.
Outside of the browser, it has OpenSSH support but not git or pgp/gpg support. GPG (and by extension git) don’t support very many security technologies... Windows Hello and CryptoKit are solutions but rarely implemented yet. Perhaps this will change over the next decade as hardware-based security authentication supplements or replaces soft- or password-based authentication....
Touch ID on phone apps can show how it’s done...
The best article I’ve found to explain USB security keys has so far been https://paulstamatiou.com/getting-started-with-security-keys... but it’s ... very long.
Just to point out how a billion dollar company also has issues here.
The whole API design incorporates this thinking. The API call to tell a browser "Hey I want to enrol a Security Key" navigator.credentials.create() takes an array as a parameter with IDs for keys you don't want to enrol because they enrolled already.
The call for "Hey, prove you still have that second factor" navigator.credentials.get() needs among many things an array again, this time for IDs for keys that you'd accept, and one reason that's needed is that other keys needn't bother doing anything as they can't help.
That probably came across like speculation based on AWS's reputation, but it's also my actual experience after going on a U2F spree. Out of maybe 7 or 8 accounts, AWS was the only one that didn't support a backup key. Point is: I don't think it spells doom for U2F. Wasn't it just a few days ago that AWS was allowing password resets that couldn't be used for login because of validation? I don't remember the service, just that I saw it on HN.
It hit a huge maturity milestone last year when the last major browser/OS combination got support for USB keys by default. Now the user story is "insert key, boop button." It's intuitive enough for my parents to understand, it's easy enough to habitually use, and the security is a big step up.
It's worse than you're even alluding to. I recently purchased a Yubikey with the intention of securing as many accounts as I could with FIDO2 and U2F. Literally the only service I could secure fully with the key was Google.
Google was the ONLY service that supports FIDO2 on both the desktop and mobile (using the Yubikey 5Ci with the lightning connector). Everything else was a hodgepodge mess of two factor options:
Twitter: FIDO2 on desktop only, needs TOTP fallback for mobile. Recovery keys for backup. Facebook: FIDO2 on desktop only, need TOTP fallback for mobile. Recovery keys for backup. LastPass: TOTP or YubiOTP only, email to recover. ProtonMail: TOTP only, recovery keys as backup. US Bank 1: TOTP via their app only, email and SMS as backup. Recovery by customer service US Bank 2: Email only, recovery by customer service. DE Bank: PhotoTAN only, recovery by customer service & postal mail. US Investment Firm 1: Symantec VIP only, email as backup US Investment Firm 2: Email only Reddit: TOTP only, recovery codes as backup. Amazon: TOTP only, SMS as backup Duo: FIDO2 on desktop and mobile, but lack of support for embedded browsers means I need to have HTOP or push as a fallback for some applications on both platforms.
For the services that have recovery keys, I have them in an envelope I keep in my gun safe as well as a PGP-encrypted text file on my computer. I didn't store the TOTP secrets separately, although I probably will next time I re-enroll everything because my Yubikey physically fell apart a month after using it (a common thing with the first batch of 5Cis from what I gather) and I had to move everything back over to TOTP codes.
It's not just the standard for 2FA, it's everything from the bottom up. The 2FA tool, how backups work, how recovery works. It's a complete hodge-podge mess and and, like you mentioned, if it's this big of a pain in the ass for an experienced tech guy, how am I supposed to, in good conscience, recommend this stuff to my non-techie friends?
You don't need the TOTP fallback for Facebook on mobile browser (though annoyingly they'll still always send you the code via SMS, if you haven't disabled). I suppose it's possible that their app has issues with FIDO2, and maybe that's why you had to fallback to TOTP.
But yeah, 4 services (including Google), out of all the ones that I use... The track record for supporting FIDO2 is underwhelming. It's especially annoying that you cannot set up backup FIDO2 keys in AWS, which means that I won't rely on it.
Unless it was changed, GA is one of the few apps that doesn't sync with Google nor require a Google account to use.
I'm much happier doing this than risking having a phone number hijack due to a $cellCarrier employee maliciously or negligently transferring my phone number to a malicious user, but it's not easy for me to remember to do all of these security steps, let alone someone who doesn't work in the cybersecurity industry. There's no way in hell my parents could do this.
The previous answer made me think a bit more seriously about those reset codes that are lying around (maybe?) my computer.
I’m a digital native and digital lives are still so hard even for me; no wonder regular people just nope out of it.
And with regards to your fear from Google: Short from full-on identify theft I have a controversial solution: E-Mail is something one should pay for.
E-Mail is essential ; the one thing you can use to pretty much sign up for everything, the one thing to use to reset passwords ; the one form of communication which is open, readily accessible to almost everyone, crosses borders, doesn't ask for fees, doesn't need a specific app, et cetera
I once lost my complete password database (if you sense irony here, it was a long time ago, and I was being stupid), including my E-Mail password, no 2FA set up, nothing. I was completely locked out, but: since I paid for the service: I could open a ticket, I could get a human(!) within a short time frame who actively assisted and I could proof my identify via easy means.
I was greeted with empathy, we could work with whatever I knew about the account and related information. There was no ridiculous meaningless questionnaire, no support ticket answered by some volunteer moderators. I was dealing with someone from staff who knew what they were doing, and we worked it out quickly.
Not saying it would have been impossible to restore access to a Gmail Account, but at the very least it would have been incredibly more painful, I am sure of that much.
Google Authenticator is not tied to your account. Unless you lose your phone at the same time (or have remote wipe enabled and someone who gets your Google account wipes it), your Gmail account is not tied to access to Authenticator.
You should also backup authenticator codes on paper in a safe place.
> What we need is a single way to do login, MFA and security across every single site.
This. U2F could be it, but even the vendors that implement it often implement it poorly (e.g. not allowing multiple tokens).
The way to do that is to use a client-side certificate in combination with a username/password for authentication.
When I create an account on a website, these are the steps I should have to follow:
1. Choose a username and password
2. Upload a CSR
3. Get the client-side certificate
4. Add it to my local certificate store
When I log in, I should have to follow these steps
1. My client automatically chooses the correct client certificate to send based on the server certificate
2. If I need a passphrase to decrypt my private key, I enter it at a prompt
3. The server verifies the certificate the client sent against whatever CA they use
4. I enter my username/password
5. My credentials are verified and I'm logged in.
I shouldn't have to provide my phone number or email address as a second factor because those factors aren't under my control. The private key associated with the client certificate is under my control.
This is the main problem any such solution has to solve (IMO) to be better than the hodgepodge of 2FA methods that we currently have. Humans are fallible and will likely not maintain proper backups and such.
If you don't do that and lose the certificate and private key, then you lose access to the account. You should not be able to log into the account without both the client certificate and the username/password.
The procedure I described earlier would be for accounts like HN or reddit. If this was an account with a government agency, bank, or credit card company, then the part where you generate a CSR and get a certificate would be done at an office where they verify your identity (drivers license, passport, etc). In the latter case, if you lose your certificate, then you need to go back and repeat the procedure to get a new one.
> Humans are fallible and will likely not maintain proper backups and such.
While that's true, we really ought to sacrifice some convenience for better security. If a user fails to maintain proper backups or register multiple devices for an account, then the inconvenience of losing their account and going to the arduous process of creating a new one is on them. They shouldn't put the lack of security burden on us by having companies engage in security theater like MFA (i.e., SMS or email based second factor) because they want convenience over actual security.
That said, those users could opt out of MFA and just rely on their username/password for authentication. Those of us who want MFA could use the client-side TLS certificate in combination with the username/password and keep our account secure.
The biggest barrier to 2fa is the fear of loss of a factor.
I can reset a password with an email account, i can't reset a 2fa with an email account. As long as that will be the case adoption can not go forward.
I would rather have the ability to use real security with the MFA scheme I described above (and in my other post [1]) rather than the security theater we have with email/SMS MFA. If some people aren't able to deal with that and lose access to their account, then the burden is on them. On the other hand, by using email/SMS based MFA and account recovery, the burden is on all of us for the lack of security for everyone. If someone wanted to get into the important accounts, they don't necessarily need to target the user's bank. They could target their cell phone provider or email provider and get access not only to their bank account, but any account using those as factors for authentication.
With a client side TLS certificate, they would actually have to get physical access to the device and brute-force the private key passphrase in addition to the username and password for the account.
You + firefox remembered passwords = more secure then a user on 2fa.
This aint about you bud.
On the contrary, people like me do need it. The status-quo right now is that companies are forcing us to use security theater measures to further secure our accounts. But since those measures are actually weaker than the original password, it actually reduces the actual security around our accounts.
And I never use the remember password feature in my browser because I don't want to inadvertently give someone access to my account if they manage to access my machine.
Of course that would eliminate anonymity, which would be horrible, but maybe ok for Gmail where people use their real names anyway.
But in the event of loss of ID card or identity theft, there is a trusted instance (the government) that can block old ones and issue new ones. This could be used as a reliable way to rotate a 2FA key, because some unique number attached to a citizen won’t change.
I mean how many times have you been left alone in a doctors office with a computer just sitting there with connections/inputs exposed. I am 0% shocked at the large scale retail data theft that gained steam a few years ago.
Oddly for me it seemed like as time went by I had a better chance of recovering old gmail accounts with spurious remembered information, like the algorithm thinks the longer nobody's in it the more likely you're the owner trying to get in. This was ~10 years ago though.
Microsoft is starting to push passwordless features for Windows and online accounts.
YubiKeys and OTP apps are pretty common (hopefully there will be more standardization and less fracturing of those features).
OAUTH2 is mature and Google/Facebook/GitHub/etc all work decently as providers.
Although I wish a single government entity would replace those OAUTH providers. I can't get banned by my state like I can get banned by Google for ToS violations, so I'm wary of creating a federated auth account unless I'm certain I can't lose access to the root account without necessarily losing access to the subservient accounts. The obvious downside is that dissidents and criminals are easily identified, but that's an offline problem as well as an online.
Clonable, backupable, encrypted on disk and in cloud sync.
I have it on my phone, laptop, and desktop.
I've been in tech for 25+ years. I'm very familiar with security, and I have the internal endurance to sit patiently and work through IT-related issues.
However, at this point, there are just too many broken ways and I'm at the point of giving up. I use LastPass and if that somehow gets hacked or phished, I lose absolutely everything. I'm waiting for the next virus or phishing attempt to steal my LastPass password.
I use multi-factor authentication on some accounts, but if they use SMS like many sites do, I can get my phone number stolen from me and then I lose access.
I use Gmail and Google Authenticator, but if I somehow do something to piss off Google, I can lose my gmail account and access to Google Authenticator and then I'm really fucked. I've lost some gmail accounts because they will ask me for security questions when I log in with the correct password, and I don't remember them so my account gets locked, so they're gone forever.
What we need is a single way to do login, MFA and security across every single site. We can't have every company incorporating their own methods. We need standardized customer support, where Tier 1 customer support can't give you access to things like credit card numbers, last 4 digits of SSN, or change passwords. Changing passwords needs to be a higher level, better trained customer support.
There needs to be an ISO standard that is well thought out and implemented by all the vendors, or at least all the big vendors. If there's a standard way of doing security but also a standard way of doing customer support and what data is exposed to various levels of customer support, then social hackers can't take partial info from sites A and B, and use that to social engineer site C.
This has to be simplified because it's absolutely unwieldy even for a veteran like me. There are too many ways I can get hacked and we are all just sitting ducks. The only thing protecting us is that we aren't high-value targets.