Take the 2-minute tour ×
Information Security Stack Exchange is a question and answer site for Information security professionals. It's 100% free, no registration required.

When you enable two step verification for google accounts, you get sent a code by SMS to enter in addition to your username and password the first time you log in with a new device.

How do they detect that you're on a new device? I imagine for security it's probably a serverside generation of a device fingerprint, however surely one iPhone 5 is much like another - how can they be differentiated given the way the service works?

share|improve this question
3  
Thinking about it, I guess it's a cookie –  Oliver Kohll Jun 8 '13 at 10:16
    

2 Answers 2

It uses cookies. Use chrome in normal mode and login with 2FA. Open am incognito session* of Chrome and it will be a "new device". The only difference between the two is that the latter doesn't have any cookies.

In fact, I am under the impression said cookie only lasts for 30 days.

*make sure that if you have any extensions they are ALL allowed in incognito mode, so that you can be sure there is no "browser fingerprinting" as per @David Houde's answer.

share|improve this answer

I am not entirely sure what Google uses, but there are many ways to identify a system, none of which are 100%.

The most common would be using cookies or localstorage to hold a unique identifier.

Another common method is to store User-Agent data, among others like Resolution/Color Depth, Time Zone, Available Fonts, and even Browser Plugins. While these do a good job at adding to the fingerprint, in the event of a targetted attack, this information is more or less public (or at very best relatively easy to aquire), and easy to spoof.

There is some good information at EFF if you are interested in browser fingerprinting.

share|improve this answer

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.