4

Google has announced a new option for two factor authentication - a popup message.

Google popup message

How does this improve security?

  • Wonder what happens if an attacker with your password attempts to log in at exactly the same time as you? – SilverlightFox Jun 22 '16 at 9:28
3

It is not you logging in on this phone, it is (presumably) you logging in on another device. You get prompted to authorize the login on the other device.

That's why the prompt also mentions the device.

So now you get a simple yes or no pop-up, rather than a confirmation email, text or setting up a separate security key. In itself it's not more secure, but it's more streamlined, so more people may start using it.

2

Like the previous two-factor auth scheme, this assumes that you are in possession of your cell phone. Unlike the previous scheme, it doesn't require you to enter any numbers (6 digit security key) into to login.

(Keep in mind that since the system hasn't been completely rolled out yet, there could be lots of other information about the security of the system coming out later)

One way this could improve security is that in the old system, you may be carrying around backup security keys away from your phone. This would help you in the event that you lose your phone but need to access your account, but it also increases the risk that someone else gets your keys (say if you kept the keys in your wallet and lost that). There doesn't seem to be any risk of losing keys in this new option, but there was also no mention of an alternate way of accessing your account if you lose your phone.

Another take on this is a bit different. Consider that the new scheme is arguably easier to use than the old one -- you just press a button instead of switching between your phone and computer to copy down the security key. By making two-factor auth easier to use, there's more incentive for users to adopt it; having two-factor auth in this case is going to be more secure than not having it.

  • 1
    This new scheme also allows you to use backup codes. – SilverlightFox Jun 22 '16 at 9:28
1

As @fishy says, Google's first goal is to increase adoption.

Anecdotally, it seems like a majority of people do not require a second factor of authentication for any of their accounts. SMS-based tokens can sometimes introduce too much of a delay, lead to charges for incoming messages and hence is thought to reduce usability of the system. TOTP requires the use of a smartphone, the synchronization process can be daunting for new users (generally you need to download a special app, scan a QR code, validate a long string ...). Clearly the new prompt system is more usable, and also avoids carrier-vulnerability based attacks as in SMS.

Without a good backup scheme (e.g. falling back to one-time use tokens) this new scheme is dangerous, as it ties your authentication too strongly to your device. It also requires an Internet-connection to always be available, which is still rare in most parts of the world.

Finally, the scheme has not yet been evaluated in the wild. By relying on an HTTPS-based second factor, it is possible that attacks may become slightly easier to automate (but this is pure speculation until more information is released).

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.