1

If you visit a site from your desktop, and use GA to login, you create an airgap.

But if you visit a site from your mobile, and use GA to login, in what way are you still protected from Android malware?

1

Two-factor authentication has little to do with "air gap" in this case, and all to do with prevention of brute-forcing or password-guessing ("Something you know"), by requiring a second piece of information: "Something you have" (the app and its generated tokens).

The existence of the mobile app on your device + logging in from that device presents little in the way of a security hazard, unless of course your phone is already compromised, in which case the efficacy of two-factor authentication is not your primary concern.

7
  • If someone steals my password im still relatively safe with two-factor authentication, because the attacker doesn't has control over my phone. Brute-forcing can be prevented simply by rate-limiting or adding a delay, I don't see how that has anything to do with this question? – Muis Jan 23 '15 at 19:54
  • 1
    Your phone is in your possession - your phone acts as the "key generator" - this is the "something you have" part of 2-factor authentication. You misunderstand the purpose of two-factor authentication in your concern about air-gap between your phone and web-browser: "air gap" isn't important. "Person-gap" is: unless someone has your phone (or has compromised your phone), this usage of 2FA should not be a problem. – Panther Modern Jan 23 '15 at 20:00
  • I'm interested in the case where the phone is compromised, it's logical that if my phone is uncompromised there can't be any risk. – Muis Jan 23 '15 at 20:40
  • Better make sure your phone isn't compromised then, huh? – Panther Modern Jan 23 '15 at 22:51
  • 1
    Security isn't about assuming anything: Assumption is the mother of all fuckups. Any sound security strategy will assume nothing, but account for as many factors as are both practically and technically feasible/possible. In your case, the only further practically feasible security measure you could take on a personal level is to buy a second Android phone and use it only for Google Authenticator. – Panther Modern Jan 23 '15 at 23:37

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.