Disabling Google 2FA doesn't need 2FA if you're already logged in

Re:Disabling Google 2FA doesn't need 2FA if you're already l... by kogir on Friday July 10, 2020 @12:27PM (#23793179)

To be fair, remote access to the user’s account on the machine is game over, regardless.

Knowing the password and having access to a trusted (don’t ask again for 30 days checkbox) device is possession of two factors.

Google offers stricter validation in the form of advanced protection, which isn’t so easily disabled.

https://landing.google.com/advancedprotection/

[ Parent | on HN ]

Re:Disabling Google 2FA doesn't need 2FA if you're already l... by frei on Friday July 10, 2020 @12:39PM (#23793318)

I just enrolled in advanced protection, and was then able to unenroll without 2FA re-auth....

I agree that requiring 2FA re-auth on trusted devices to disable 2FA would be a terrible default for users with only one method, but Advanced Protection should do more.

[ Parent | on HN ]

Re:Disabling Google 2FA doesn't need 2FA if you're already l... by ec109685 on Friday July 10, 2020 @09:30PM (#23798602)

Yeah, why wouldn’t the hacker wait until the user logged into their 1Password manager start stealing passwords that way?

[ Parent | on HN ]

Re:Disabling Google 2FA doesn't need 2FA if you're already l... by lordlimecat on Saturday July 11, 2020 @08:25AM (#23801655)

It is easier to trick the user into starting a remote session Than it is to convince them to unlock their vault.

It's somewhat like getting someone to invite you into their home VS convincing them to open their fire safe in front of you. One of those sets off alarm bells.

[ Parent | on HN ]

Re:Disabling Google 2FA doesn't need 2FA if you're already l... by lordlimecat on Saturday July 11, 2020 @08:28AM (#23801684)

Remote, unprivileged access is not game over and its ridiculous to make that claim in the world of cloud tenants.

[ Parent | on HN ]