Vulnerabilities / Threats
2/10/2011
06:27 PM
Connect Directly
Google+
LinkedIn
Twitter
RSS
E-Mail
50%
50%

Google Enables Two-Factor Authentication For All

You can now protect your Google Account with security techniques employed by online banks.

Having recently made two-factor authentication available for Google Apps customers, Google on Thursday extended its more secure sign-on mechanism to all Google Accounts.

Google calls the process two-step verification. It is intended to reassure those who believe they need more than a mere password standing between their online data and the cyber-thieves of the world.

"Two-step verification requires two independent factors for authentication, much like you might see on your banking Web site: your password, plus a code obtained using your phone," explains Google product manager Nishit Shah in a blog post.

The set-up process isn't ridiculously onerous, but it isn't drop-dead easy either. Google suggests setting everything up may take 15 minutes. Thoughtfully, users aren't entirely on their own: Google provides a set-up wizard to guide people through the necessary steps.

Turning two-step verification on is done through the "Using 2-step verification" link on the Google Account Settings page. Users who don't see any such link can expect it to be available within the next few days.

Once enabled, a user who signs in with the Account password will be presented with an extra Web page asking for a code. Google will either generate an automated call with the code, send the code to a mobile phone via SMS, or allow the user to generate the code using an app on an Android, BlackBerry or iPhone device.

A particularly convenient feature is the ability to register a backup phone to receive codes, in case one's primary phone get stolen or is lost.

Additional security, however, should not be confused with foolproof security. In late 2009, Gartner issued a research note recommending further defenses beyond two-factor authentication. It seems cyber-thieves have had some success bypassing two-factor security schemes at some banks using man-in-the-middle attack techniques. The fraudsters managed to have verification phone calls associated with compromised accounts forwarded to their own phones.

But Google's decision to offer extra security to those who want it represents a step in the right direction.

Matt Cutts, who runs Google's Web spam team, notes that two of his relatives have had their Gmail accounts hijacked because someone guessed their passwords.

"If someone hacked your Gmail account, think of all the other passwords they could get access to, including your domain name or Web host accounts," he wrote in a blog post.

While conceding that the extra security of two-step verification may be an inconvenience, he insists it's worth the trouble. "I use it on my personal Gmail account, and you should too," he said.

Comment  | 
Print  | 
More Insights
Register for Dark Reading Newsletters
Partner Perspectives
What's This?
In a digital world inundated with advanced security threats, Intel Security seeks to transform how we live and work to keep our information secure. Through hardware and software development, Intel Security delivers robust solutions that integrate security into every layer of every digital device. In combining the security expertise of McAfee with the innovation, performance, and trust of Intel, this vision becomes a reality.

As we rely on technology to enhance our everyday and business life, we must too consider the security of the intellectual property and confidential data that is housed on these devices. As we increase the number of devices we use, we increase the number of gateways and opportunity for security threats. Intel Security takes the “security connected” approach to ensure that every device is secure, and that all security solutions are seamlessly integrated.
Featured Writers
White Papers
Cartoon
Current Issue
Dark Reading's October Tech Digest
Fast data analysis can stymie attacks and strengthen enterprise security. Does your team have the data smarts?
Flash Poll
Video
Slideshows
Twitter Feed
Dark Reading - Bug Report
Bug Report
Enterprise Vulnerabilities
From DHS/US-CERT's National Vulnerability Database
CVE-2014-7298
Published: 2014-10-24
adsetgroups in Centrify Server Suite 2008 through 2014.1 and Centrify DirectControl 3.x through 4.2.0 on Linux and UNIX allows local users to read arbitrary files with root privileges by leveraging improperly protected setuid functionality.

CVE-2014-8346
Published: 2014-10-24
The Remote Controls feature on Samsung mobile devices does not validate the source of lock-code data received over a network, which makes it easier for remote attackers to cause a denial of service (screen locking with an arbitrary code) by triggering unexpected Find My Mobile network traffic.

CVE-2014-0619
Published: 2014-10-23
Untrusted search path vulnerability in Hamster Free ZIP Archiver 2.0.1.7 allows local users to execute arbitrary code and conduct DLL hijacking attacks via a Trojan horse dwmapi.dll that is located in the current working directory.

CVE-2014-2230
Published: 2014-10-23
Open redirect vulnerability in the header function in adclick.php in OpenX 2.8.10 and earlier allows remote attackers to redirect users to arbitrary web sites and conduct phishing attacks via a URL in the (1) dest parameter to adclick.php or (2) _maxdest parameter to ck.php.

CVE-2014-7281
Published: 2014-10-23
Cross-site request forgery (CSRF) vulnerability in Shenzhen Tenda Technology Tenda A32 Router with firmware 5.07.53_CN allows remote attackers to hijack the authentication of administrators for requests that reboot the device via a request to goform/SysToolReboot.

Best of the Web
Dark Reading Radio
Archived Dark Reading Radio
Follow Dark Reading editors into the field as they talk with noted experts from the security world.