this post was submitted on 14 Jun 2023
3 points (80.0% liked)

Cybersecurity

20 readers
1 users here now

All about cybersecurity. Be nice, no spam!

founded 1 year ago
MODERATORS
 

All sounds great until you lose your phone or FIDO device, or it’s stolen, or your facial login is spoofed but still probably pretty great on the whole when combined with other methods.

you are viewing a single comment's thread
view the rest of the comments
[–] [email protected] 2 points 1 year ago* (last edited 1 year ago) (3 children)

I think it's a step in the right direction to get users to adopt MFA. I know too many people that still rely on using the same easy to remember password to login to too many accounts, especially important ones and are too "busy" to set up a password manager or even set up MFA through other methods. Having something built in would be good for them. My only concern is that this is something aimed at newer devices and not too much for legacy devices that may not have a Bluetooth enabled desktop. Of course those are probably now viewed as the not the norm for everyone as now everything is done on newer laptops and phones that have everything built in to use these new technologies.

I also don't like having all my eggs in one basket, like relying on Google to protect my backup codes and MFA options while assuming they will use E2EE while transferring my data, which apparently they've already dropped the ball on their new feature of backing up information into the cloud by default.

https://www.bleepingcomputer.com/news/google/google-will-add-end-to-end-encryption-to-google-authenticator/

Edit: added link to article about Google E2EE problem I mentioned above.

[–] [email protected] 2 points 1 year ago (2 children)

Aye thank you for the info on the lacking end to end encryption at Google Authenticator - I didn’t realize that. Big weak point there in the system.

[–] [email protected] 3 points 1 year ago* (last edited 1 year ago) (1 children)

No problem! And ya for how big a company they are this seems like a pretty big thing to be dropping the ball on and with Google making the zip and mov domains I feel like they must be trolling people or something trying to create more problems in the cybersecurity world but that's up for debate also I guess.

Edit: added link to Medium write up from researcher Bobbyr.

https://medium.com/@bobbyrsec/the-dangers-of-googles-zip-tld-5e1e675e59a5

[–] [email protected] 2 points 1 year ago

Thanks for the info about the .zip domain. Totally missed that.