1

If you visit a site from your desktop, and use GA to login, you create an airgap.

But if you visit a site from your mobile, and use GA to login, in what way are you still protected from Android malware?

Improve this question

1 Answer 1

Reset to default
1

Two-factor authentication has little to do with "air gap" in this case, and all to do with prevention of brute-forcing or password-guessing ("Something you know"), by requiring a second piece of information: "Something you have" (the app and its generated tokens).

The existence of the mobile app on your device + logging in from that device presents little in the way of a security hazard, unless of course your phone is already compromised, in which case the efficacy of two-factor authentication is not your primary concern.

Improve this answer
7
  • If someone steals my password im still relatively safe with two-factor authentication, because the attacker doesn't has control over my phone. Brute-forcing can be prevented simply by rate-limiting or adding a delay, I don't see how that has anything to do with this question?
    – Maestro
    Commented Jan 23, 2015 at 19:54
  • 1
    Your phone is in your possession - your phone acts as the "key generator" - this is the "something you have" part of 2-factor authentication. You misunderstand the purpose of two-factor authentication in your concern about air-gap between your phone and web-browser: "air gap" isn't important. "Person-gap" is: unless someone has your phone (or has compromised your phone), this usage of 2FA should not be a problem.
    – Panther Modern
    Commented Jan 23, 2015 at 20:00
  • I'm interested in the case where the phone is compromised, it's logical that if my phone is uncompromised there can't be any risk.
    – Maestro
    Commented Jan 23, 2015 at 20:40
  • Better make sure your phone isn't compromised then, huh?
    – Panther Modern
    Commented Jan 23, 2015 at 22:51
  • 1
    Security isn't about assuming anything: Assumption is the mother of all fuckups. Any sound security strategy will assume nothing, but account for as many factors as are both practically and technically feasible/possible. In your case, the only further practically feasible security measure you could take on a personal level is to buy a second Android phone and use it only for Google Authenticator.
    – Panther Modern
    Commented Jan 23, 2015 at 23:37

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .