LastPass Grid Authentication vs Google Authenticator which one is more secure?

Question

[Being a LastPass user] recently I moved to Google Authenticator instead of using Grid Authentication as a 2-factor security. For me, finding and filling letters from such a dense matrix is a rather clumsy task.

I have basic understanding how Grid, Google Auth some some other LastPass 2 factor-authentication work (Yubikey/Sesame, ...) In general Yubikey is considered slightly more secure than GoogleAuth, so I'm just wondering the comparision between the Grid and Google Authentication App.

Sample of a 6-digit random number generated by Google Authenticator App:

For example: the phone can be lost (it can be stolen or something). In that case, isn't it true that all the pseudo-random numbers being constantly generated by the app are easily exposed to the thief? (If one use the GoogleAuth app extensively, and if he does not protect his phone very seriously - well, doing so slows down our process to open the phone, so normally people just apply some simple pattern)

This is what a LastPass Grid looks like:

For Grid, the normal choice is to print it out and put it in a wallet. Of course, your wallet can also be lost, but if you do not need the grid very frequently, you can keep it at a safe place at home. Not carrying the grid around reduces the chance someone might get it. This is different from the phone: you always have to carry your phone around.

So paper-based grid may be clumsy, but from some certain perspective (as the example above), it seems better. Now consider the "security" aspect, which one can be considered better secure (theoretically/practically) than the other, and why? Or they are just the same level?

It's not very easy to quickly find the corresponding content of the coordinates:

Edit: This guy has made a really good slide about Google authenticator. Well, the case of phone lost is somehow "trivial" but the seed to feed to TOTP is stored in plain-text.

http://www.slideshare.net/zerocool51/google-authenticator-possible-attacks-and-prevention?qid=1a8842ba-45bd-40c4-be0a-dedc19e0a85f&v=qf1&b=&from_search=1

Answer 1

I personally prefer Google Authenticator which is basically an elegant implementation of Time-Based One-Time Password Algorithm but I would not feel comfortable saying it “is more secure”.

To use one of my favourite buzzwords… it all comes down to Threat Modelling. What exactly are you trying to protect against? Is it a technical attacker who might be able to get malware on your phone? Or one of your mates trying to post dirty things on your Facebook page? I think the most important difference between the two methods is: is the attacker someone who might have physical access?

There are also a huge number of variables, do you encrypt your phone? Does your phone automatically lock? Do you leave your wallet un-attended? It’s impossible to give a finite answer but each has its pro’s and con’s and fairs better in some areas than others. Some interesting points are:

Physical Access

When an attacker has physical access you have lost, but some things hold up better than others.

• Grid: Someone can take a photo. Takes about 2 seconds.
• Authenticator: As far as I’m aware you need root access to receive the keys. Without some serous planning you are unlikely to be able to get them in under a few minutes. Many phones have GPS trackers so you can find them if they are stolen.

Remote Access / Malware

• Grid: I do not know of any malware that infects paper. Enough said.
• Authenticator: There have been several malicious apps in the play store, genraly they are pulled pretty quickly but it happens. Some can even get root. There are many ways to keep your phone up-to-date and clean it really depends on your practices if you install untrusted apps or you read the manifest for each one etc...

Compromised host

This is an interesting one where I feel Authenticator has a slight edge. There have been several banking trojans that use Man in the Browser attacks. Neither of these will stop that but:

• Grid: If you’re on a compromised host that’s got a key logger installed after a while it could build up a copy of your grid and then be used by an attacker at a later date. (e.g. work out what U7, M8, I5, and so on are and make your own copy of the grid)
• Authenticator : Each code should be computationally indistinguishable from random so even if you have the last 5,000 codes that were used, you can’t work out what the next one will be.

Convenience

This is a massive factor that often gets overlooked in security. Even if one was far more secure than the other what is important is making it usable and seamless enough that people will actually use it.

• Grid: If lots of different sites used this you would need one for each site with two factor. I just don’t think it scales.
• Authenticator: I always have my phone with me and I have a few sites that use two factor, you just keep adding them, it scales pretty well. Also like you say it's easier to type the 6 digits than searching a grid for the corresponding content. This is very subjective but I find that more convenient.

Answer 2

(I worked for Google's Account team, specializing in Usable Security issues just like this one.)

In authentication, there are three basic factors: "has a", "knows a", or "is a". The two systems under discussion are both "has a". In the case of LastPass, the user has a piece of paper. In the case of GAuthenticator, the user has a particular smartphone.

As such, I'd argue they are roughly similar. Perhaps the tradeoffs are that,

1. Everyone already has a smartphone.
2. People do not loan their own smartphone to others, not so easily as copying a piece of paper anyway.
3. Typing in a number is easier than responding to 4 pass lookup table.

They are both still vulnerable to sophisticated active man-in-the-middle attacks, or theft.