0

When I use Google Authenticator two-factor authentication, Google will tell me if I get my password wrong before prompting me for an authentication code.

This goes against at least one intuitive line of reasoning -- it allows an attacker to check whether they have the right password before trying to attack two-factor authentication.

What are the trade-offs that make this a reasonable choice in Google's case, and in general? How should this inform similar questions in other spaces?

This question is about 2FA in general but Google is just a widely used example.

Improve this question
0

2 Answers 2

Reset to default
2

It prevents the attacker from knowing if you implement multifactor authentication, thus reducing the attack surface.

Edit: it also will allow you to be alerted if your password is compromised without allowing someone into your account. This will allow for user's who don't implement the security practice of unique passwords to resolve the issue before a breach occurs elsewhere.

Improve this answer
1

This is a usability versus security issue. Not saying that the password was wrong until after you have authenticated through the app would indeed be slightly more secure. But on the other hand, it would not be a very positive user experience.

The security loss here is quite minimal, since Google is very good at blocking live brute force attempts. The password would need to be very bad, or the attacker would need to have some knowledge about it, for this to work.

So I can understand why Google opted for usability here. They want people to use 2FA, and the best way to convince people to do that is to give them a smooth user experience.

Improve this answer

Not the answer you're looking for? Browse other questions tagged .