Security Analysis and Protection Measures for Google two-step Login

I wrote an article aboutTwo-step Google login Introduction, InPush upAndCnBetaMany people have questioned its security, mainly because it does not trust telecom operators. It took more than two days to log on to the system in two steps. This morning, I also tried some of the cases. Here I just want to summarize them.

After two-step login, you can obtain the number of the Second-step login through three methods: one is generated by the Program on the mobile phone, and the other is received by the set mobile phone, the third is the standby digital verification code generated during setup. In addition, the Application-specific Password is also a method for accessing data in a Google account. The following describes the security of the Application-specific Password.

It must be noted that,It is useless for an account with two-step Logon Settings to obtain its account password and digital verification code separately.In addition, the six-digit verification code generated by the program and received by SMS has a validity period limit.

I. Security of digital codes generated by mobile apps

The six-digit code is changed every 30 seconds. The time is an important variable in the generation of digital codes, whether it is to close the program or not, the number generated within 30 seconds remains unchanged. However, this does not mean that the probability of a digit being guessed is one thousandth, because the digit code has a "validity period, the time starts from the submission and calculation of the first login data in two steps. From that point on, any of the 10 verification codes generated in five minutes can assist in the login. That is to say, the probability of code verification being broken through should be one in 100,000. This is beyond the control of users, and the focus of confidentiality is not in this step.

Google Authenticator, a program used to generate six-digit code on the Android platform, has only one permission requirement, that is, to control the vibrator. After successfully adding an account, it will vibrate to indicate a reminder. After disconnecting all the networks of the mobile phone, you can still install the program and add an account to log on in two steps. You can also generate a digital code to log on. This means that, in the whole process, Google Authentication does not transmit any data to Google's server, that is, it has nothing to do with the information of the mobile phone itself. It only uses a certain algorithm for computing.

In order to verify that the generated digital code is indeed irrelevant to the device, during the two-step login setup, the QR code diagram is scanned using both mobile phones, as a result, both mobile phones can complete two-step login. In addition, the numbers generated by the two mobile phones are the same. This time, C proves that the generation of the digital verification code has nothing to do with the device.

In fact, the encrypted content of the QR code generated during the two-step login is the following string:

Otpauth: // totp/xxxxx@gmail.com? Secret = 5dytxxxxxxxdc3tb

There are two key elements: User Name and secret. The key of each account remains unchanged. In addition to adding accounts in Google Authenticatior by QR code scanning, you can also manually add accounts. This information is also required when you manually add accounts.

The problem is whether the generated digital code is related to the user name. To verify the code, manually add an account in Google Authentication. If the user name is left blank, use the above key. The results show that, as long as the key is the same, no matter what the user name is, the same digital code is generated. This means that the generation of the six-digit code is only related to the secret key and time. Protecting the secret key becomes the focus of confidentiality. Fortunately, the secret key cannot be viewed in Google Authentication. To view the secret key, you must log on to your Google account.

Protection measures

There are two confidentiality measures in this step. One is to ensure that the secret key is not disclosed, and the other is to ensure that the devices used to generate digital codes are not obtained by others. Mainly for the following

• Do not paste a QR code map containing secret anywhere
• After you do not use the Google service, be sure to clickSign Out)
• Add several accounts to Google Authentication. the user name can be any character (not limited to email format) and the key can be any 16-character combination.So that, even if you get this device, you have to spend time figuring out which six-digit code is true.
• In case of emergency, tryUninstall the Google Authentication program on the device immediately

Add useless accounts with multiple interference to the Google Authenticator application, with random names

 

Ii. Security of SMS verification Codes

This is the best way to handle this problem. Because we need to use text messages to receive six-digit code, but there are bad records for each telecom operator in China, and this step cannot be skipped. After the configuration is complete, once the standby mobile phone number is deleted, the two-step login will automatically expire. This step is indeed not user-friendly.

However, strangers only know the last two digits of the slave phone number before logging on to your account, google recommends that you use a trusted person's number as a backup text message receiving number. However, if you use a person's number you are familiar with, it may be a security risk.

Protection measures

The best way is,Find a friend on the Internet and make sure that you only know the relationship between the person and him, and then use his mobile phone number as a backup number.. In this way, even if you know the most about you, you still cannot figure out the number of the standby SMS recipient,If you can find a netizen whose mobile phone tail number is the same as the number of an acquaintance of yours, it will be even more confusing.. In addition, the second step of two-step login has a timeout time of about five to ten minutes. I believe that it is very difficult to perform a nationwide text message search during this time period.

Two-step login will prompt the last two digits of the backup mobile phone number

 

Iii. Standby digital verification code

This method is used when neither of the above methods can be used for login. Google provides a 10-digit verification code, and each number can be used once. Google recommends that you print it out, however, this is not a good solution. How to protect it has become the most troublesome.

Protection measures

To ensure the security of the 10-digit verification codes, we recommend that you follow these steps:

• 1,Enter the number code into a text file and perform basic encodingFor example, replace all the places where 3 appears with 5 and all the places where 5 appears with 3.
• 2. Use the software to get the result of step 1.
• 3,Compress the image and set the password using tools such as winrar.You must set a password different from your Google account. The file name of the compressed package must be random, for example, "create an external document. rar"
• 5. Upload the image to a permanent storage network disk and share it with you (do not select a shared network disk such as 115). Write down the sharing address.
• 6. Find a custom URL shortening tool to shorten the sharing address in step 5. Remember this URL.Http://snipurl.comIs a tool that can be customized for URL shortening. For example, the final result of shortening isHttp://snipurl.com/wodemimazaizheli

The backup octal Verification Code provides ten opportunities

In this way, other methods cannot be logged in, or after the login path is damaged, you can openHttp://snipurl.com/wodemimazaizheliAnd then download the backup verification octal code map-don't forget that you have also coded it.

4. Real danger: Application-specific password)

Because some programs do not support two-step login, such as Gtalk, Empathy, Picasa, and even the synchronization function of Chrome browser, in order to make these programs normally pass Google account verification, it is necessary to generate a special password for the program, which can be used anywhere. Although it cannot be used to log on to Google accounts and Gmail, it can be used to verify the mail client, then use the mail client to send and receive mails.

Once a special password is generated, you can only delete the password from your Google account. Although software such as Gtalk and Emparty use asterisks to display passwords, it is not difficult to see the hidden passwords of asterisks. This also makes the unique password of the program a weak link for two-step login. Therefore, we recommend that you use two Google accounts and one for important transactions such as emails, another account is used for scenarios where two-step login is not allowed.