3

When I log into my Google account from my laptop with 2FA enabled, I usually get a prompt on my smartphone in order to confirm the log in. I tap OK and then I am logged in.

However sometimes I am not immediately logged in after that. My laptop then shows a screen like this:

screenshot from laptop


Then on my smartphone I get something like this:

screenshot from smartphone

(It is not always laptop+smartphone. Actually in this particular case I was logging in to Google in a webbrowser from my smartphone, so everything happened on a single device).

I wonder what Google is trying to achieve with choosing a number. What type of attack would be averted by this?

I tried to Google something about that, but I found nearly nothing at all. (One not-helpful twitter post is what I found)

5

I wonder what Google is trying to achieve with choosing a number. What type of attack would be averted by this?

It can protect against two things:

  1. People blindly selecting yes when some attacker has attempts to gain access.
  2. Someone stealing your password and attempts logging in same timeframe as you.

In case #1, it will stop people from just selecting yes to get rid of the request. Or, at least it will fail 2/3 of the time.

In case #2, it will reveal that the login session is not the same as the user is expecting, because the number shown on the users screens will not match. With the previous yes/no prompt, with some information about the session environment, it was more difficult for users to tell what session it asked about.

4
  • People blindly confirming security-critical prompts is a much bigger issue than people realize.
    – MechMK1
    Sep 21 at 11:02
  • 1
    Makes somehow sense... On the other hand... Why two prompts? Why is it not already the first prompt that does the number game?
    – yankee
    Sep 21 at 13:35
  • What two prompts?
    – vidarlo
    Sep 21 at 15:20
  • @vidarlo: First I get the normal prompt "are you trying to sign in" with a simple yes/no button, then after that I get another prompt (the one shown in my question).
    – yankee
    Sep 23 at 5:25

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.