Take the 2-minute tour ×
Information Security Stack Exchange is a question and answer site for Information security professionals. It's 100% free, no registration required.

[Being a LastPass user] recently I moved to Google Authenticator instead of using Grid Authentication as a 2-factor security. For me, finding and filling letters from such a dense matrix is a rather clumsy task.

I have basic understanding how Grid, Google Auth some some other LastPass 2 factor-authentication work (Yubikey/Sesame, ...) In general Yubikey is considered slightly more secure than GoogleAuth, so I'm just wondering the comparision between the Grid and Google Authentication App.

Sample of a 6-digit random number generated by Google Authenticator App: Sample of a 6-digit random number generated by Google Authenticator App

For example: the phone can be lost (it can be stolen or something). In that case, isn't it true that all the pseudo-random numbers being constantly generated by the app are easily exposed to the thief? (If one use the GoogleAuth app extensively, and if he does not protect his phone very seriously - well, doing so slows down our process to open the phone, so normally people just apply some simple pattern)

This is what a LastPass Grid looks like: This is what a sample LastPass Grid looks like

For Grid, the normal choice is to print it out and put it in a wallet. Of course, your wallet can also be lost, but if you do not need the grid very frequently, you can keep it at a safe place at home. Not carrying the grid around reduces the chance someone might get it. This is different from the phone: you always have to carry your phone around.

So paper-based grid may be clumsy, but from some certain perspective (as the example above), it seems better. Now consider the "security" aspect, which one can be considered better secure (theoretically/practically) than the other, and why? Or they are just the same level?

It's not very easy to quickly find the corresponding content of the coordinates: It's not very easy to quickly find the corresponding content of the coordinates

Edit: This guy has made a really good slide about Google authenticator. Well, the case of phone lost is somehow "trivial" but the seed to feed to TOTP is stored in plain-text.

http://www.slideshare.net/zerocool51/google-authenticator-possible-attacks-and-prevention?qid=1a8842ba-45bd-40c4-be0a-dedc19e0a85f&v=qf1&b=&from_search=1

share|improve this question

migrated from superuser.com May 3 at 18:18

This question came from our site for computer enthusiasts and power users.

1  
The grid is noise generated. The google authenticator is based on 3 different values cand if you know all 3 you can generated ANY code at any point in time. By this very fact the grid is more secure. The phone being lost isn't a concern because the authenticator can be restored to any device. –  Ramhound Apr 29 at 12:17
    
@Raystafarian - The standard behind the Microsoft Authenticator and Google Authenticator is the same which is the reason you can use the Google Authenticator with Microsoft's online services. The point of that statement is there isn't any "secret" sauce in these authenticators except the source data ( i.e. serial of the authenticator ). This is the reason I say that that grid is more secure because if you supply a third-party with this serial they (might) have the required information to replicate your authenticator on any device they want. I believe there is a third peice.. –  Ramhound Apr 29 at 12:47
    
slideshare.net/zerocool51/… This is a good technical report on possible ways to attack Google Authenticator :) –  Jim Raynor Apr 29 at 13:40
    
@Ramhound Which "3 different values"? I tought that there is a secret and time. Isn't it more about how secret can you keep your "secret" or "grid" from prying eyes? –  week Apr 29 at 15:03
1  
Don't ask "which is more secure" unless you provide a mechanism to define "more secure". Which girl is more pretty? which cake is more tasty? which book is more interesting? which football team is more skillful? –  Mark C. Wallace Jul 28 at 16:38

2 Answers 2

I personally prefer Google Authenticator which is basically an elegant implementation of Time-Based One-Time Password Algorithm but I would not feel comfortable saying it “is more secure”.

To use one of my favourite buzzwords… it all comes down to Threat Modelling. What exactly are you trying to protect against? Is it a technical attacker who might be able to get malware on your phone? Or one of your mates trying to post dirty things on your Facebook page? I think the most important difference between the two methods is: is the attacker someone who might have physical access?

There are also a huge number of variables, do you encrypt your phone? Does your phone automatically lock? Do you leave your wallet un-attended? It’s impossible to give a finite answer but each has its pro’s and con’s and fairs better in some areas than others. Some interesting points are:

Physical Access

When an attacker has physical access you have lost, but some things hold up better than others.

  • Grid: Someone can take a photo. Takes about 2 seconds.
  • Authenticator: As far as I’m aware you need root access to receive the keys. Without some serous planning you are unlikely to be able to get them in under a few minutes. Many phones have GPS trackers so you can find them if they are stolen.

Remote Access / Malware

  • Grid: I do not know of any malware that infects paper. Enough said.
  • Authenticator: There have been several malicious apps in the play store, genraly they are pulled pretty quickly but it happens. Some can even get root. There are many ways to keep your phone up-to-date and clean it really depends on your practices if you install untrusted apps or you read the manifest for each one etc...

Compromised host

This is an interesting one where I feel Authenticator has a slight edge. There have been several banking trojans that use Man in the Browser attacks. Neither of these will stop that but:

  • Grid: If you’re on a compromised host that’s got a key logger installed after a while it could build up a copy of your grid and then be used by an attacker at a later date. (e.g. work out what U7, M8, I5, and so on are and make your own copy of the grid)
  • Authenticator : Each code should be computationally indistinguishable from random so even if you have the last 5,000 codes that were used, you can’t work out what the next one will be.

Convenience

This is a massive factor that often gets overlooked in security. Even if one was far more secure than the other what is important is making it usable and seamless enough that people will actually use it.

  • Grid: If lots of different sites used this you would need one for each site with two factor. I just don’t think it scales.
  • Authenticator: I always have my phone with me and I have a few sites that use two factor, you just keep adding them, it scales pretty well. Also like you say it's easier to type the 6 digits than searching a grid for the corresponding content. This is very subjective but I find that more convenient.
share|improve this answer

(I worked for Google's Account team, specializing in Usable Security issues just like this one.)

In authentication, there are three basic factors: "has a", "knows a", or "is a". The two systems under discussion are both "has a". In the case of LastPass, the user has a piece of paper. In the case of GAuthenticator, the user has a particular smartphone.

As such, I'd argue they are roughly similar. Perhaps the tradeoffs are that,

  1. Everyone already has a smartphone.
  2. People do not loan their own smartphone to others, not so easily as copying a piece of paper anyway.
  3. Typing in a number is easier than responding to 4 pass lookup table.

They are both still vulnerable to sophisticated active man-in-the-middle attacks, or theft.

share|improve this answer

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.