Google Makes It Easier to Do the 2-Step



google-2-step-authentication

Google on Monday began rolling out a new two-step authentication feature, Google Prompt, targeting enterprise employees.
The new option consists of a pop-up that displays a mobile user's name and profile image, and that specifies the location and device involved in the attempted sign-in. The device owner is asked whether to allow or deny the sign-in.
Enterprise end users still have other choices for two-step authentication. They can use a Google Security Key or enter a verification code sent to their phone.

Implementing Google Prompt

"Implemented correctly, two-step authentication is an improvement over traditional password-based authentication," said Travis Smith, senior security research engineer at Tripwire.
"Moving to the Google Prompt mechanism is a step to make two-step authentication easier to implement for end users," he told TechNewsWorld. "Instead of having to copy a six-digit code from one device or app to another, they can hit a single button when prompted."
Google will update its Help Center with detailed instructions on how to implement its latest two-step authentication feature.
Google Prompt is available for both Android and iOS. Android users have to update Google Play Services to use Google Prompt, while iOS users have to install Google Search on their devices first.
"Typically with features like this, IT gets lots of notice that it's coming," observed Rob Enderle, principal analyst at the Enderle Group.
"That doesn't seem to be the case here. Google appears to have done this with little or no notification," he told TechNewsWorld.
Springing new features can be annoying for IT departments, because it results in "a bit of an unplanned fire drill," Enderle said.
However, Google Prompt does give users a choice and should be easier to use, which could result in fewer complaints.
It's not without risk, though. A hacker could get the notice and push it to something that already has been compromised, Enderle suggested.
"I'm not sure this is inherently more secure than Google Security Keys, given phones can be hacked," he said.

2-Step Weaknesses

In one example of a phishing attack against a two-step verification system, an attacker could trigger the delivery of a code from a service provider to a user, and lure the user into forwarding the code to the attacker, researchers at the New York University Polytechnic School of Engineering have demonstrated.
The attacker would attempt to log into the victim's account and then claim to have forgotten the password. That would trigger a verification code text. The hacker then would send the victim a second SMS, asking the user to forward the verification code to confirm the phone was linked to the online account under attack.
In the demonstration, most targets weren't aware that the two SMS messages came from different sources.
"We attribute the success of the attack to the lack of an effective and usable means for the user to verify the service provider, the lack of context for the message sent, and an assumption about users' understanding of the authenticating process," the NYU researchers wrote.
"It's critical to enable a password on the lockscreen of mobile devices," said Tripwire's Smith.
"Not only will this reduce the chances of a nefarious actor accessing sensitive data, but it will also prevent the actor from gaining access to the two-step authentication prompts to add rogue devices to your account," he explained.

The Big Picture

"The issue for Google is that Android has been historically insecure," Enderle pointed out.
"For any security solution to work, you have to believe the platform can be made secure," Enderle continued. "Because Android still has a lot of side loading, any security solution on that platform can be compromised by malware more easily than most other platforms."
Google Prompt "does move the ball," said Enderle, "just not as much as it would if people believed Google took security seriously."


Comments

Post a Comment

Popular posts from this blog

DirectX 12 vs DirectX 11

Image
DirectX 12 vs DirectX 11 – How DX12 will transform PC  gaming on Windows 10 DIRECTX 12 VS DIRECTX 11 – WHY DOES IT MATTER? Windows 10  has arrived and, along with integrated Cortana, Xbox One game streaming and a fancy new web browser, one of its key features is DirectX 12, the latest version of the operating system’s gaming API. A software layer that sits between the hardware that powers our computers and the software that runs on them,  DirectX is at the heart of the vast majority of games that run on Windows.  The other major gaming API is OpenGL, which as its name suggests is an open source API. Both offer very similar key functions, but it’s DirectX that tends to be at the heart of most bigger games. Microsoft talks up the amazing new capabilities for every new release of DirectX, but with DirectX 12 it really does have some key new features, at least when it comes to improving performance. It also has some new effects tools and functions for mak...
Read more

Android N's "Freeform Windows"

Last week, we wrote about the " freeform window " mode in the Android N Developer Preview. Brief mentions in the developer documents and hints in the code pointed to Android someday displaying apps in resizable floating windows, just like in a desktop OS. Freeform window mode isn't normally accessible in the current dev preview, but shortly after the post, we were contacted by reader  Zhuowei Zhang  with instructions on how to make it work. We'll get to the instructions, but first let's talk about what's actually here. Freeform window mode is just what we imagined. It's a dead ringer for  Remix OS —multiple Android apps floating around inside windows—and it might be the beginnings of a desktop operating system . It works on Android N phones and tablets, and once the mode is enabled, you'll see an extra button on thumbnails in the Recent Apps screen. To the left of the "X" button that pops up after a second or tw...
Read more

The Chord Mojo turns good headphones into great ones

Image
The best gadget you never knew you wanted Audio processing isn’t sexy. Better sound doesn’t lend itself to easy marketing through numbers or pretty posters, and so many companies treat it as an afterthought when designing their products. The  blissful ignorance  of "good enough" audio pervades the world of consumer technology, leaving only a niche of audio enthusiasts supporting a few boutique hi-fi manufacturers. Things have been like this for quite some time, but recently a new gadget was introduced that bridges the gap between the many and the few, and its name is the  Chord Mojo . The Mojo is an audio processor and amplifier that’s smaller than a pack of cards yet delivers the awesome performance of much larger rivals. Honestly, I think its size works to its disadvantage because it looks like, and is, a portable unit you can plug into your phone and use off its 10-hour battery. By audiophile standards, it’s almost  too  practical. But ...
Read more