6

Sometimes, when I log in to Google, it asks me to print out some backup codes for the two step verification process. This seems like a big back door that breaks the whole point of two step verification to me. None of Googles help articles address this concern at all.

What are the security implications of printing out backup codes?

Improve this question
4
  • 3
    You're trying to delete your question. Have you tried flagging it, with an explanation why you want it deleted?
    – S.L. Barth is on codidact.com
    Commented Jun 2, 2015 at 16:18
  • 5
    Sdf - if you want the question to be disassociated from your account, you can do that by contacting the community at the link at the bottom, but vandalising your post when you have valid answers is not good!
    – Rory Alsop ♦
    Commented Jun 2, 2015 at 17:05
  • Well a obvious implications is that Google can log on your account at anytime even with 2 step authentication and Google can also share this codes to other parties...i don't know how long is the backups codes but they may be too short and then be vulnerable to brute force attacks
    – Freedo
    Commented Jun 2, 2015 at 17:12
  • 1
    @Freedom Google can log on to your Google account whether or not there are backup codes. If you're trying to keep Google from logging on to your Google account, you should know that that is not possible even in theory (if stuff is encrypted with your password they might not be able to decrypt it without deploying new login code that saves your password, but they can trivially bypass access control on their own systems). Also, you should know that backup codes do not bypass the "enter password" step.
    – cpast
    Commented Jun 2, 2015 at 17:40

2 Answers 2

Reset to default
6

Think of it as writing your log in password in a piece of paper since they both serve the same function. The risks associated with it are related to physical access to where the print out is stored, accidental snapshot (office pictures) and the like, in some odd cases even a print queue could allow to print a second time.

At the same time think of storing sensitive information in usb sticks, you may consider encrypting the files or the entire usb drive, but you are still prone to losing it.

Shoulder surfing is also a risk, if you need the piece of paper 5 times a day that's 5 times a day someone can be looking over your shoulder and writing down a couple of digits.

You are right in that this method of authentication is less secure, Im sure they faced a scenario where this was necessary but I would say unless you yourself are faced with that specific situation going with 2-step authentication methods is in general safer. For example, if you use your phone to receive a token, an attacker would need access to your phone, and would need to unlock your phone, which although not impossible it adds an extra layer of complexity.

Improve this answer
6
  • Yes. Unless you have a specific situation where you absolutely need to print the codes I dont see any benefit in doing so.
    – Purefan
    Commented Jun 1, 2015 at 13:21
  • 1
    Ideally, you need the piece of paper only on the rare occasion when you don't have access to your phone.
    – Ajedi32
    Commented Jun 2, 2015 at 13:55
  • 2
    Isn't the specific situation "I lost my phone and I need to log in to disable 2FA so I don't permanently lose access to my account"? At that point it's too late to print out backup codes, you have to do so beforehand.
    – Ajedi32
    Commented Jun 2, 2015 at 13:57
  • You are correct, but google also lets you add a second phone for backup. This of course has its own set of security implications.
    – Purefan
    Commented Jun 2, 2015 at 14:46
  • The backup codes don't bypass the password stage, and are single-use. You don't use them routinely.
    – cpast
    Commented Jun 2, 2015 at 17:42
3

The main concern I would have about the backup codes is that they are too short. The ordinary GA code is 6 digits, and each code is only valid for 30 seconds. The backup codes are 8 digits but are good forever, until used.

One interpretation is that either 6 or 8 is guess-resistant when coupled with per-IP throttling of tries, and the shorter one is as long as 6 digits only to resist shoulder-surfing from the owners phone. If the code was four digits, someone could remember the whole thing from a glance, and possibly log in within the 30 second window on a nearby computer.

Only 8 digits for the backup code still seems arbitrarily stingy, though. Why not 12 or so?

Improve this answer

You must log in to answer this question.