1

I was reading this response on SE about 2FA:

Well, I hate to break this to you, but Google Authenticator plus password isn't really two-factor authentication. Proper 2FA is two separate items out of traditionally the triad "something you have" (physical item, which may itself hold a secret), "something you know" (secret), and "something you are" (often biometrics).

The user goes onto imply that 2FA based on Google Authenticator is not really 2FA because if an attacker were to break into your phone or tablet using "a variety of radio interfaces running arbitrary, potentially hostile, software" they could potentially extract the secret that enables them to generate the same temporary passwords on another device.

However, it seems to me that even without the above argument, Google Authenticator is not really 2FA.

I always understood that 2FA was based on the idea that a potential hacker would have to 1) compromise your password and 2) gain physical access to your phone in order to compromise your account.

However, today it is possible to generate 2FA code using your phone, an app installed on your computer or an extension in Chrome (which only requires you to be logged into your gmail account to activate). An attacker would only have to compromise a user's gmail account to have sufficient capability to generate 2FA password.

Is 2FA based on Google Authenticator (or any other system that allows you to generate a pass code simply by knowing the user's email) considered real 2FA?

Improve this question

1 Answer 1

Reset to default
2

That depends on the user. If the user is foolish enough to store their "second factor" secret somewhere that is available with only a single factor (e.g. their non-2FA Google account), then yeah, that's not proper 2FA. On the other hand, if logging into that Google account requires a hardware token (e.g. Yubikey) plus a password, then it might actually be more secure to store the TOTP (Google Authenticator) secret there than in a less-secure device (assuming you fully trust Google and your browser security, which are somewhat questionable decisions). Similarly, if you write down a 2FA account recovery code and your password in the same place, then that's obviously not 2FA because the attacker only needs to steal one thing to get both secrets. However, that doesn't mean recovery codes (or passwords) aren't viable and distinct authentication factors; one is expected to be kept in a secure location and the other in your head, and the fact that the user violated that expectation makes the user, but not the system, less secure.

Improve this answer
3
  • But presumably, most users do not enable 2FA to login to Gmail. In fact, I just Googled "what percentage of users use 2FA with Gmail" and the result? "Only 10 Percent of Gmail Accounts Use 2-Step Verification". So calling Google Authenticator 2FA when it is clear that only a tiny fraction of Gmail users even bother securing their account with a second factor doesn't make much sense to me.
    – Bradford Griggs
    Commented Sep 2, 2021 at 0:16
  • 1
    I would be surprised if even 10% of Google users put their Authenticator key into an extension like you mention, though. Heck, I hadn't even heard of it until today (though Chrome isn't my main browser so maybe I wouldn't). You seem to be operating under the assumption that Google Authenticator (or TOTP authenticator apps in general) and a third-party browser extension are somehow the same thing. I've never seen a 2FA setup page suggest installing an extension, only a mobile app. Also, at some level, you can't stop users from shooting themselves in the foot.
    – CBHacking
    Commented Sep 2, 2021 at 1:04
  • There's also Authy, which is a "user-friendly" mobile app that "helpfully" saves your OTP secrets to the cloud where they can be compromised... err, I mean, downloaded to your new phone automatically.
    – Kevin
    Commented Oct 2, 2021 at 4:25

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .