Hacker News new | ask | show | jobs
by aichi 2889 days ago
Why Google 'sell' this as an advantage over 2FA over mobile phone? In this case it works on computer only, or you have to be at some computer, with mobile app, you can be anywhere? I see that as huge disadvantage.
5 comments

Mobile phones can be hacked; if you use your Authenticator app to log into an application on your mobile phone, it's by definition no longer two-factor authentication. The basis of that is having a separate device. Having that in a key that cannot be compromised by e.g. being rootable, internet connected, etcetera is an extra layer of security.

The mobile phone is more convenient though, and I also don't know how these things work when you try and log in via a mobile device. For high security access though, like google cloud consoles and such, a policy of not allowing access via mobile phones does make sense. (also because said console is probably not very usable on mobile).

> 2FA over mobile phone

Still vulnerable to phishing. If you include a convincing iframe, your attacker can store your TOTP, and use it from their machine.

U2F relies on the domain of the page you are currently browsing, so the code can't be used by another party on the real site.

And if you were thinking about SMS... vulnerable to any attack on the mobile network + phishing + ...

Security tokens are more secure and can't be as easily fished as phone-based 2FA solutions. It's not about using the key on a mobile phone, it's about replacing phone-based 2FA.

You're right however that their key doesn't seem to have any interface other than USB so it won't be practically usable on smartphones. Yubico has NFC tokens[1] for that use case but it doesn't seem that Google's version offers that yet.

[1] https://www.yubico.com/products/yubikey-for-mobile/

The page Using Security Key links to mentions that Titan supports Bluetooth & USB, with NFC support in a future update.

https://support.google.com/accounts/answer/6103523

The yubikey version of this works with phones, you can plug it in if your phone has the appropriate usb port, and it theoretically supports nfc and bluetooth but those rarely seem to work for me. I'm not sure if the google version also supports the wireless protocols but I don't see why you couldn't plug it into your phone.
All answers above sounds as great explanation! I don't understand mobile 2FA as an app only but also possibility to e.g. being called by system and you have to put some PIN/key over phone.