Although web security is something I like to dabble in, I can’t honestly say it always is on the top of my mind. Up until an hour ago, access to the vast amount of information that Google manages for me (including access to my Google Android account) was protected by nothing but a password. A rather strong password for that matter, but it wasn’t entirely random and it has been the same for quite some time now.
As access to important online services such as Google should ideally not only rely on just a password (session hijacking anyone?), I activated Google 2-step authentication. What this means is that access to Google (Mail, Docs, …) is now also limited to authenticated devices. If I try to access Google from another computer, I’ll have to authenticate the device using an SMS-challenge or a code generated by the Google Authenticator application on my Android-phone.
If you’re still unsure about what 2-step authentication entails, here’s a brief intro-video from Google:
So yeah, you can have my password now. Theoretically. If you really insist. But even if I do decide to give it to you, you still won’t be able to access my account. How’s that for peace of mind? And now off to Facebook security settings, to enable login notifications & approvals.
This is really a good feature. Recently Amazon AWS also added support for Virtual MFA Devices (http://aws.amazon.com/mfa/) which supports the same Google Authenticator app.
Thanks for the post – something that everyone should enable.
So does this mean that you have to verify all devices every 30 days? How does it find out your device ID from a browser?
verfiy every 30 days: yep
deviceID: suppose they’re relying on cookies for this feature as well, rather then using some kind of deviceID
did some scroogling, system indeed does not track a device as such, but relies on cookies that are set upon successful authentication with a lifetime of either the session or 30 days.
i should stop looking for more info, but this is too interesting; the cookie is stored with key SMSV with httponly and secure flags set (i.e. it can only be read serverside from https://accounts.google.com). there was a bug, where the expiry of the cookie wasn’t checked by Google, but that has been fixed since.
I’m using that 2 step auth at Google also now for a few weeks already. And getting an SMS (or a voice call, that’s also possible 😉 every 30 days for each device I use is nothing compared to the “perfect” security you get …