Information Security Stack Exchange is a question and answer site for information security professionals. It only takes a minute to sign up.
Sign up to join this community
So I have enabled 2-factor authentication on Gmail, which means that if I log in on a new machine, it sends a token to my phone.
Now, if I access Gmail from my phone, it seems like I have only one factor left; my phone.
What would be the most secure way to access Gmail from my phone?
I'm thinking an app-specific password is the way to go, since if the phone gets stolen, I can revoke the password and the attacker has just the token.
You've hit on a bit of a sore point; using smart devices as something-you-have type credentials has some drawbacks.
As you point out, the smart device often plays an active part in the authentication process in addition to being the second factor credential. This is not so much a problem as it might first seem. The purpose of using your smart device as a something-you-have is so that the attacker must both steal the device and simultaneously have access to your password in order to gain access to your account. This is still true, even when the device is doing both parts of the authentication, but you're right to question it - particularly if you store the password on the device. In this case your dual-factor authentication becomes a single factor - the device.
The other reason smart devices make poor credentials is that they have a software stack, and they typically run third-party applications. In other words, they have malware. A smart device infected with malware is equivalent to a stolen smart device in terms of using it as a credential.
The malware can instigate the login, wait for and capture the incoming SMS/notification, and read out the second-factor code to complete the login. In the most extreme cases, this will happen without the user's knowledge.
So in summary, don't worry too much - the fact that you are aware of this issue is great, just make sure that the phone does not store the password or provide autologin - locking the app is not enough, as an attacker can still read off the stored password from the phone's hdd directly.
And when any real security is required, use hardware tokens that cannot be subverted, such as TOTP/HOTP tokens. That said, using the smart-device is much much better than having no second-factor at all.
As long as you use an app specific password for the apps on your phone that talk to the gmail servers, and you're careful when you install apps, you're fine.
If your phone gets stolen, all you have to do is revoke the app specific password and have GMail log out all other logged in sessions.
See, while the second factor (phone) is compromised, the first factor (password) isn't. The attacker needs both. For this, the attacker would need to first get your GMail password via a keylogger or an MITM attack with a fake certificate, and then get your phone. Much harder, though a determined person can probably get it.compromising your account.
Note that a malicious app could get both your GMail password and intercept authentication messages,
One option to mitigate the loss of the phone is to have an App Blocker that needs a password/PIN to access specific applications. This allows you to have one simple way to unlock the phone itself, and require another step to unlock the application (so if someone borrows your phone for a while, they can only access unblocked features). If the phone is stolen, this should delay an attacker long enough for you to disable 2-factor auth and change your password.
That won't protect you from malware or from a skilled attacker, as @lynks explained, but should allow you to be relatively safe without the inconvenience of having to enter your account password all the time. And since security and convenience is always a tradeoff, you wouldn't be able to reach a high level of protection without sacrificing usability anyway. That's just like the "remember this computer" option: in that case, the computer itself (or, more specifically, the browser's cookie jar) becomes the second factor, so you only need to enter a code on untrusted computers.
Additional Note: if you check your e-mail on your phone dozens of times per day, having auto-login off means you'll either have to type a complex/long password in the tiny keyboard all the time, or you'll end up using a weak password. If you only do it occasionally, then it's not an issue. Keep that in mind, since that's part of the tradeoff I talked about earlier.
